A Diverted Deposit, One Reused Password, and What Changed in the Advice Since 2015

The money moved on a Thursday, which is the detail that matters most about it. A homeowner in the middle of a kitchen remodel received wiring instructions by email, from the address she had been corresponding with for eleven weeks, in a thread that contained her own earlier messages quoted underneath. She sent the second draw. The contractor, who had not written the email, called nine days later asking about it. By then the receiving account had been emptied and closed, and the recovery question had stopped being technical and become a question about who holds unfinished money.

Following the payment backward to the account that was open

Fraud of this kind is almost never a break-in at the bank. The entry point was the contractor's email, a small-business mailbox protected by a single password that had been chosen years earlier and reused on a supplier portal, a materials catalog, and a forum login. One of those third parties was breached, the credentials were sold in a list, and someone tried them against the email provider because that is the highest-value door a reused password opens. Nothing on the contractor's own computer was infected. The account simply answered correctly when asked.

What the intruder did next explains why the homeowner had no reason for suspicion. They read the thread, learned the payment schedule, noted the tone, and set a quiet forwarding rule so the contractor's copies of certain messages were routed away. Then they waited for the draw to come due. The email that arrived was written in the contractor's voice because the author had a hundred samples of it. The wiring instructions were the only new information in the message, and they were the one thing nobody verified by phone.

The same decision, as it looked ten years ago

Put that contractor back in 2015 and the advice he would have received was not negligent, it was mainstream. Pick something hard to guess, mix cases and symbols, swap a letter for a digit, and change it every ninety days. Write nothing down. Treat memorability as the goal, because you were expected to carry the password in your head across every account you owned. A small business was told to rotate credentials on a schedule, and the rotation itself was taken as evidence of diligence, which it was never really able to be.

The failure mode in that advice is visible in the case. Rules about symbols and capital letters push people toward a small number of predictable patterns, and the ban on writing anything down pushes them toward reuse, because a human being cannot hold forty distinct strings. Forced quarterly changes made reuse worse, since the easiest way to satisfy a deadline is to increment a number at the end. The password that opened the contractor's mailbox satisfied every composition rule on the screen that created it.

What changed in the guidance, and why it changed

The National Institute of Standards and Technology is responsible for the federal digital identity guidelines that most corporate password policies were copied from, and the revision of those guidelines is the reason the advice you hear now sounds inverted. Length is favored over character classes. Arbitrary periodic expiration is discouraged, with changes tied instead to evidence of compromise. Composition rules that force a symbol and a capital are out of favor. Pasting is to be allowed, because blocking it defeats password managers, and the full printable character set should be accepted so that passphrases work.

The reasoning behind the shift is empirical rather than theoretical. Once enormous corpora of real breached passwords existed, it became possible to see what people actually produce under each rule, and the finding was that complexity requirements generate guessable output while length and uniqueness do not. That pushed the center of gravity toward a password manager holding one long unique secret per account, a screening check against known breached strings, and multi-factor authentication on anything that touches money. More recently, passkeys have moved the mailbox question further, replacing the shared secret with a key the user never types and a phishing page cannot capture.

For a business mailbox that quotes payment instructions, the practical reading of all this is narrow and achievable. The email account becomes the most protected credential in the company rather than the most casually chosen one, it gets a second factor that is resistant to interception, and forwarding and delegate rules get reviewed, because an attacker who cannot stay logged in will try to stay in the message flow. The contractor in this case now has all three, and the audit of mail rules took his bookkeeper under an hour.

Where unfinished money should sit while the work continues

The security repair solves the next attempt. The payment design solves the loss, and that is the part homeowners control directly. Staged payments exist so that neither side is holding the other's money for long, and the schedule is written in the contract, which means any change to the destination of a draw is a change to the contract. A new account number arriving by email is therefore not an administrative update. It is an amendment, and amendments get confirmed on a number you already had, not on one printed in the message asking for the change.

Several habits make that confirmation routine rather than awkward. Agree at signing that banking details will be exchanged once, in person or by phone, and never updated by email. Keep retention in the schedule so the final portion is held until punch list items close, which preserves leverage and shrinks the size of any single transfer. Pay draws by check or by a verified transfer to a destination you have used before. Ask the contractor who else can read the project mailbox, because that answer tells you how many people could write to you in his name.

The homeowner in this case recovered part of the draw, because the bank was notified inside the window where a recall still has force, and the remodel finished on the original schedule with the remaining payments moved to checks. What the episode cost her was time and a difficult month. What it bought was a payment protocol she will use on every project after this one, and a clearer sense of why the password advice she grew up with was retired by the people who had written it.