A common alternative attack on email accounts is brute-forcing weak passwords (enabled by lack of multi-factor authentication), accessing the inbox to identify customers and financial patterns, and then sending fraudulent payment instruction emails to all customers claiming payment should go to attacker-controlled accounts