How hackers compete: the evolution of tactics against finance teams
There's a competitive marketplace you've probably never given much thought to: the one in which fraudsters compete with each other.
Just as legitimate businesses refine their approach to gain an edge, so do fraudsters. They borrow from one another, build on what works and quietly drop what doesn't. Understanding that competition is as useful to a finance director as understanding your own market, because the prize they're all chasing is access to your bank account and your financial data.
How fraud became a competitive market
Ten years ago, things were rather more straightforward. Phishing worked. They sent a basic email with a link, people clicked, and login details rolled in.
Then everyone started doing it, and that's when the competition began. When every fraudster is using the same trick, the only way to stand out, and to succeed where others fail, is to get smarter. The fraud market has evolved much as legitimate markets do: through innovation.
Today, fraud is a commodity with specialists. One group hones the psychology of social engineering. Another concentrates on infrastructure: hosting, domain registration and payment processing. A third is preoccupied with evading detection. Each is trying to outdo the others at what it does best.
When every fraudster uses the same trick, the only way to succeed is to get smarter.
Why finance teams are in the firing line
Finance departments are busy places at the best of times, and in small companies they're often stretched very thin indeed. The 'department' may be one or two people covering everything from the purchase ledger and payroll to VAT returns, management accounts, credit control and the odd HR query. Month-end, quarter-end and year-end arrive on schedule regardless of what else is going on, and payment runs don't wait.
Fraudsters know this. They time their emails for Friday afternoons, the last few days of the month and the run-up to Christmas. Those are the moments when people are working through a backlog, approving payments between meetings and simply don't have time to stop and think. A request that would raise eyebrows on a quiet Tuesday morning can sail through at quarter to five on the last working day of the month.
Small businesses face an added difficulty: many of the textbook controls assume there's a team. Segregation of duties is easy to recommend and much harder to arrange when one person raises, approves and pays. That doesn't make small companies easy targets by default, but it does mean controls need to be designed around how the team actually works, rather than how a large corporate's would.
The current frontier: psychological tricks
At the moment, one of the most active frontiers is what security researchers call the 'psychology arms race' – finding ways to manipulate you into letting your guard down.
Your team knows to check URLs. So attackers have adapted. They now use visually identical characters from other alphabets. The Cyrillic 'с' looks exactly like the Latin 'c', and the Greek 'α' is all but indistinguishable from the Latin 'a'. A web address like miсrosoft.com (with a Cyrillic 'с') looks perfectly genuine to the human eye. These are known as homoglyph attacks, and they represent a clear competitive advantage: they let attackers fool the very security measure, visual inspection, that most organisations train their teams to use.
Why would an attacker choose this approach rather than simply registering a domain in the normal way? Because registration records are traceable and domains can be seized quickly. A visual trick that exploits human perception at the moment of decision is much harder to counter. It's also harder for rivals to copy well, since it takes a solid grasp of typography, character sets and human psychology to execute it well.
The 'arms race' in email impersonation
Another competitive frontier is email impersonation. Finance teams are taught to check the sender's address. But attackers have learned to register lookalike domains, such as accounts@yourcornpany.com (an 'r' and 'n' standing in for an 'm') instead of yourcompany.com. They've learned to compromise genuine business email accounts and send from those. And they've learned to forge email headers.
Each of these represents a group somewhere concluding: 'Most people check the domain. We need something that gets round that.' Those who succeed carry on refining it. Those who don't fade out.
Every security measure you put in place prompts attackers to find a workaround.
Why this matters to finance directors
Recognising that fraudsters are competing with each other is useful for two reasons.
The threat is accelerating
When fraud was simple and widespread, a few basic rules kept it in check. Now that different groups specialise and compete, attacks are becoming more sophisticated faster than the industry can defend against them. Homoglyph attacks are clever, and they work. Once one group perfects them, others follow suit, and within months you're facing a new baseline of sophistication.
Defences need headroom
Your defences need to allow for tactics you haven't seen yet. The fraudster who succeeds isn't the one using last year's methods. Whether it's technical controls, staff training or supplier selection, your approach needs to assume someone is actively trying to outwit it.
What a realistic response looks like
You can't rely on your team to spot every trick, least of all when they're up against a deadline. Training is essential, but it's reactive: it teaches people to recognise attacks that have already been identified. By the time your team has been trained on homoglyphs, fraudsters have already moved on.
A realistic response is layered.
Multi-factor authentication
Multi-factor authentication means stolen passwords are useless on their own. Even if someone enters their password on a phishing site, the fraudster can't get in without the second factor. This isn't optional; it's the baseline.
Email authentication standards
Email authentication standards (SPF, DKIM and DMARC), alongside good email filtering, make it much harder for fraudsters to spoof your own domain and help weed out forged messages. They won't stop a genuinely compromised account and they aren't foolproof, but they raise the bar considerably.
Verification procedures
Verification procedures make it harder for a single fraudulent request to slip through unnoticed. That means always ringing a known number (never the one in the email) to confirm unusual requests or changes to bank details, and always having a second pair of eyes on payments. In a small team, that second pair of eyes doesn't need to be another finance colleague. It might be the managing director approving payments in the banking app, or dual authorisation set up with your bank.
Supplier and third-party access
Supplier and third-party access matters more than it used to. Many successful attacks come in through compromised suppliers, so it pays to know what access you've given out and how often you review it.
The advantage for your organisation
The organisations holding their own against this threat aren't necessarily those with the biggest security teams. They're the ones that accept their people will occasionally get it wrong, and have built systems that can absorb that.
Multi-factor authentication. Payment verification. Segregation of duties, or the nearest practical equivalent. None of these is fashionable. They're unglamorous, they can add a bit of friction, and they've been standard practice for decades. But they work precisely because they don't depend on someone spotting a psychological trick in the split second before they click, usually while juggling half a dozen other things.
The attacker competing for your money is trying to exploit the gap between policy and reality. Your advantage lies in narrowing that gap by building controls that hold up even when people are rushed, distracted or deceived.
Source: The Guardian, 'Read carefully: how to spot – and avoid – a homoglyph attack', 20 September 2026 – TheGuardian.com.
If you'd like help putting layered controls in place, we're happy to talk it through.
Visit /cyber-security to find out more about our cyber security work.
Related insights
The Five Eyes intelligence agencies have warned that advanced AI models are months away from fundamentally transforming cyber attacks. Here's what UK SMEs need to know.
The Cyber Security and Resilience Bill pulls IT providers and their supply chains into scope – including businesses that assumed none of this applied to them.
A cloud region damaged by strikes, six months on and still unrecoverable – with customer data permanently gone. Conflict abroad is now an IT incident at home.