A business email compromise (BEC) campaign directed against an external corporate supplier of the Victorian Auditor-General’s Office (VAGO) resulted in the unauthorized alteration of banking routing records and the diversion of state administrative funds.