Business Email Compromise in Dental Offices: The $50k Wire-Fraud Pattern

The wires that go missing in dental offices almost never go missing because of malware. They go missing because someone replied to a real email thread with new bank details on a Friday afternoon, and nobody picked up the phone to check.

Once you have seen the pattern, you stop arguing about whether it could happen to your practice and start asking what is in place to catch it.

The pattern, in plain terms

There are two doors. Either the attacker has compromised the office manager's mailbox, or they have compromised the lab or a supplier the practice pays regularly. Either way, the attacker is now sitting inside a real Microsoft 365 inbox watching real conversations.

They are not in a hurry. They are reading email, looking for one specific thing — an invoice exchange. A thread where the lab says "here is the bill for the crown work" and the office manager says "got it, paying Friday."

When that thread surfaces, the attacker replies to it. From inside the real mailbox. Against the real invoice. Same signature, same tone, same chain the office manager has been reading all week.

"Hi — quick heads up, we've changed banks for ACH and wires. Please send Friday's payment to the new account below. Old account is closed as of this week. Thanks."

The wire goes. The office manager has no reason to suspect anything. The email came from the lab's real address. It is sitting under the lab's real invoice. The signature is identical. The amount is right.

Nothing looks wrong until the real lab calls a few weeks later asking about the unpaid invoice.

A composite incident

Let me put it on a timeline. This is a composite — none of this is one specific practice — but every beat in it has happened in real dental offices in the last two years.

Tuesday morning. The office manager receives an email that looks like an ADA membership renewal notice. The link goes to a clean-looking login page that looks exactly like Microsoft 365. She enters her password. The page prompts her for the Microsoft Authenticator code on her phone.

She approves it. The page redirects to a generic ADA landing. She moves on with her day.

What actually happened: she entered her credentials on a proxy. Behind the scenes, an adversary-in-the-middle kit forwarded the password to the real Microsoft login, captured the MFA prompt, forwarded that too, and then captured the post-authentication session cookie that Microsoft handed back. The attacker now has the cookie.

Wednesday. The attacker logs in from another country using the stolen session cookie. Because the cookie is post-MFA, Microsoft treats them as fully authenticated. No second prompt. No alert from the user's authenticator app. They then create an inbox rule that is the real fingerprint of this attack:

• Any message containing the words "invoice", "wire", "ACH", "payment", "bank", or "remittance"
• Forward externally to an attacker-controlled address
• Mark as read
• Move to RSS Subscriptions or Deleted Items

That last step is the cruel part. The office manager never sees the incoming invoices or the supplier replies. The attacker does.

Thursday. The attacker watches the lab invoice thread come in for a $48,000 monthly statement. The real lab sends the bill. The rule routes a copy to the attacker and hides the original. The attacker now has the thread, the invoice PDF, the wording the lab uses, and the office manager's normal payment cadence.

Friday, 2 p.m. The attacker replies to the lab thread from inside the office manager's own mailbox — or, in the other variant of this attack, from inside the lab's compromised mailbox — with new payment instructions. The office manager initiates the wire through the bank's portal. Two hours later it is gone.

The following Tuesday. The real lab calls asking when payment is coming. The office manager pulls up the thread, reads the "we changed banks" message, and the floor falls out.

Why MFA didn't save anyone

MFA is not the problem. MFA is necessary. But the version of MFA most dental offices have — a push notification or a 6-digit code — does not stop adversary-in-the-middle.

Public AiTM phishing kits like EvilProxy, Tycoon, NakedPages, and Mamba 2FA have been documented widely throughout 2024 and 2025. They are sold as subscription services.

They proxy the real Microsoft login page and capture the session cookie that Microsoft issues after MFA is satisfied. Once that cookie is replayed, the tenant cannot tell the attacker apart from the user.

The only MFA factors that resist this cleanly are phishing-resistant ones — FIDO2 security keys, Windows Hello for Business, or certificate-based authentication. Most dental practices are not on those yet. That does not mean you are stuck. It means MFA is one layer, and you need at least one more.

The technical controls that actually catch this

This is where managed identity threat detection earns its keep. The signal pattern in the composite above is loud if anyone is watching for it:

• A sign-in from a country the office manager has never traveled to, minutes after a successful US-based sign-in (impossible travel).
• A session token being used from an IP address that does not match the original device fingerprint (token replay).
• A new mailbox rule that hides messages containing "invoice", "wire", or "ACH" — the single most specific BEC indicator in Microsoft 365.
• OAuth consent grants to third-party apps the practice has never used.

Managed ITDR surfaces all four of those as monitored signals for the security operations team to triage when it is connected and monitored.

The mailbox-rule anomaly in particular is one of the highest-confidence detections in the entire identity-security category, because legitimate users almost never create rules that hide financial keywords from themselves.

If you only do one technical thing after reading this, get eyes on Microsoft 365 sign-in logs and mailbox rule creation events. That is the layer that matters.

The process controls that catch it even when the tech doesn't

Here is the uncomfortable truth: every BEC wire-fraud case I have walked through could have been stopped by a phone call. Not a tool, a phone call.

The process controls worth more than any technical layer:

• Out-of-band callback verification, no exceptions. Any change to a vendor's payment instructions — bank, ACH, wire details, even a routing-number tweak — requires a phone call to the vendor on a number from the contract or your existing vendor record.

  Not the number in the email signature. Attackers can edit signatures. They cannot edit your old phone records.

• Dual approval over a threshold. For most dental practices, wires above $5,000 or $10,000 should require a second person to sign off. The office manager initiates, the practice owner or a partner approves. Two sets of eyes is a remarkably strong control for the cost.

• Vendor master-data change protocol. Treat a new bank account on a vendor record like a new vendor — a second person verifies it before it gets saved.

• Focused phishing simulation for the people who actually move money. The office manager and the bookkeeper should get targeted, recurring training on payment-redirect patterns. Generic monthly phishing tests do not move the needle on this specific risk; themed simulations do. That is what Managed SAT is for.

If you implement the callback rule and nothing else, you eliminate most of the realistic loss path.

The first four hours after you realize

When a wire has already gone out and someone in the practice has figured out what happened, the next four hours decide how much money you get back and how clean the breach response is.

1. Call the bank immediately. Ask for the wire to be recalled and ask them to initiate the Financial Fraud Kill Chain (FFKC) process. Domestic wires under the FFKC threshold can sometimes be clawed back if the request reaches the receiving bank before the funds are layered out.
2. File at IC3.gov the same day. The FBI's Internet Crime Complaint Center is the entry point for FFKC. File even if you are not sure of every detail yet. You can update later.
3. Notify your cyber insurance carrier. Most policies require notification within 24 to 72 hours, and the crime sublimit will often not pay if you missed that window. See cyber insurance readiness for what carriers expect.
4. Preserve the evidence — do not delete the inbox rule yet. Forensics needs to capture the malicious mailbox rule, the sign-in logs, and the audit trail before anything is reset. Tell IT explicitly: do not "clean up" the mailbox.
5. Force a password reset and revoke all sessions on the compromised mailbox. In Microsoft 365 that is a password change plus "Sign out of all sessions." Both. The sign-out is what kills the stolen session cookie.
6. Review the Microsoft 365 audit log. What else did the attacker access? Did they download mailbox contents? Did they touch shared folders? This is where the HIPAA picture starts to form.

The HIPAA angle most practices forget

A compromised dental office mailbox is almost never just a mailbox. It contains treatment plans emailed to specialists, X-rays sent to insurers, pre-authorization correspondence, and patient questions answered directly. That is ePHI.

If an attacker had access to that mailbox for any length of time, you have a potential HIPAA breach in addition to the wire-fraud loss. The 60-day breach notification clock starts on the date you reasonably should have known.

This is not a reason to panic, but it is a reason to engage breach counsel and your forensics team early. A defensible HIPAA risk assessment requires the audit log evidence — which is exactly the evidence the rushed "cleanup" reflex destroys.

Two insurance buckets, not one

A wire-fraud loss in a dental practice typically pulls from two parts of the insurance stack at once:

• The crime rider or social engineering fraud sublimit pays the actual wire loss. This sublimit is almost always lower than the headline cyber limit — commonly $25,000 to $100,000.
• The cyber policy pays the forensics, the mailbox investigation, the breach counsel, the notification costs, and any HIPAA breach response.

Both should be triggered. Practices sometimes notify only one carrier and leave significant coverage on the table, or notify late and lose coverage entirely. The right answer is to call the broker the same day and let them coordinate.

The owner's lesson

The reason this article exists is that the practice owners who have lived through this almost always say the same thing afterward: it was not really a technical failure. It was a process failure compounded by a credential-theft event. Both ends needed fixing.

The credential theft is what MDR and ITDR are for — Managed Detection and Response on endpoints, Managed ITDR on Microsoft 365 identities. Those catch the AiTM signature, the foreign sign-in, the mailbox rule, and the token replay before the wire ever goes.

The process failure is what the callback verification policy, the dual-approval rule, and the Managed SAT program are for. Those catch the wire even if the credential theft slips through.

A dental practice that has both layers is a hard target. A practice that has neither is the case study in next month's incident report.

Where Obsidian Ridge fits

Managed ITDR — included in the Protected and Complete tiers — matters for dental practices because inbox-rule and foreign-sign-in detections are among the strongest controls against this attack pattern.

Pair it with Managed SAT focused on payment-redirect scenarios for the office manager and bookkeeper, plus a short tabletop on the callback verification policy so that when the moment comes, nobody is making it up in real time.

If you are not sure where your practice stands on the controls above, that is the conversation to have before a Friday afternoon arrives with a $48,000 invoice on it.

See the full dental cybersecurity program, talk to us about Managed ITDR for your practice, or review your cyber insurance readiness before renewal.

Last updated: May 14, 2026.