Email, Payments & Fraud for Small Business
Section updated .
Small-business email fraud is stopped by four habits: recognising business email compromise, verifying every change to payment details by a second channel, publishing SPF, DKIM and DMARC so your domain is hard to spoof, and making it easy to report phishing and spot malicious mailbox rules. The money moves quickly, so the checks have to happen before the payment, not after.
Business email compromise does not need malware. A convincing message, a spoofed domain or a hijacked mailbox is enough to redirect an invoice or a payroll deposit. The FBI's Internet Crime Complaint Center has repeatedly ranked it among the costliest categories of cybercrime it receives reports about.
The guides here put the controls where the money moves: the person who approves payments, the person who changes bank details, the domain that outsiders see, and the mailbox rules that hide an attacker's activity.
Guides in this section
Business email compromise
How invoice, payroll and executive-impersonation fraud works, and the signs worth stopping for.
Read the guide →Payment-change verification
A call-back rule for new bank details that works even when the email looks perfect.
Read the guide →SPF, DKIM and DMARC
Make it harder for anyone to send mail that pretends to be your domain.
Read the guide →Phishing reporting and mailbox rules
A one-click reporting habit, and how to find forwarding rules an attacker left behind.
Read the guide →How to work through this section
Read business email compromise so the pattern is familiar. Put payment-change verification in writing for finance and payroll. Ask whoever manages your domain to publish SPF, DKIM and DMARC, using the DMARC record builder. Finish with phishing reporting and mailbox-rule checks.
Wednesday is email and payments day in the daily briefing: pick one payment workflow each week and walk it through.
Frequently asked questions
What is business email compromise?
Fraud in which an attacker uses a spoofed or hijacked business email account to trick staff into sending money or sensitive data, often by changing payment details on a real invoice.
How do I confirm a change of bank details?
Call the supplier or employee on a phone number you already hold, not the one in the message, and have a second person approve the change before any payment goes out.
Do SPF, DKIM and DMARC stop phishing?
They stop others from sending mail that passes as your exact domain. They do not stop look-alike domains or phishing sent from compromised accounts, so they work alongside the other controls.
What if money has already been sent?
Contact your bank immediately and ask for a recall, then report to the FBI IC3 in the United States or the Canadian Anti-Fraud Centre and the Canadian Centre for Cyber Security in Canada. Speed matters.
Be first when the email edition starts
The briefing is published on this site every morning. The email edition is not sending yet — leave your address and you’ll be among the first told when it starts. Nothing is sent in the meantime.