Business
The invoice looked right. The bank account had changed. Nobody called.
In most BEC cases we see, the attacker spent weeks reading a real mailbox, yours or a supplier's, then sent a real-looking invoice with new bank details at the right moment. Technical controls stop a lot of it. A two-minute call-back rule stops the rest. We put both in place and test them.
- SPF, DKIM and DMARC taken to enforcement without breaking your legitimate mail
- Mailbox hardening: MFA, legacy protocols off, forwarding and OAuth controls, alerting on rules
- A payment-change control that finance will actually follow, tested with a simulated request
- Response plan for the day a supplier says they never received the payment
Fixed price for the assessment and DMARC rollout; payment-control design and training quoted with it. Suitable for companies on Microsoft 365, Google Workspace or hosted email.
Typical engagement
- Assessment
- Technical rollout
- Process and training
- Verification
Who this is for
- Finance and accounts teams that approve supplier payments from email instructions
- Manufacturers, traders and exporters with many suppliers and large invoices
- CA and law firms whose clients act on payment instructions from the firm's email
- Companies whose domain is being spoofed to phish customers or staff
- Organisations that have had a near miss or a loss and want it to be the last
- Any company on Microsoft 365 or Google Workspace that has never reviewed its security settings
What is included
Email authentication
Inventory of every service that sends as your domain, SPF and DKIM configured for each, DMARC moved from monitoring to quarantine to reject with reports reviewed along the way.
Mailbox and tenant hardening
MFA for every account, legacy authentication disabled, external forwarding blocked, OAuth app consent restricted, admin roles reviewed, and alerts on new inbox rules and unusual sign-ins.
Anti-phishing configuration
Impersonation protection for executives and suppliers, external-sender tagging, attachment and link protection tuned for your tenant, and quarantine handling that staff understand.
Payment-change control
A written procedure for any change to supplier bank details or payment instructions: call-back to a known number, dual approval above a threshold, and a record. Designed with finance so it survives month-end.
Supplier and customer guidance
A short note to suppliers and customers on how you will and will not communicate payment changes, which also protects you when their mailbox is the one compromised.
Simulation and training
A controlled fake payment-change request to test the control, and a session for finance and leadership on what the attacks look like.
How we work
Assessment
Current DNS records, tenant settings, mail flows and the payment process reviewed; findings and a plan within a week.
Technical rollout
Authentication and hardening changes made in stages with your IT or MSP, with DMARC reports reviewed so legitimate mail is not blocked.
Process and training
Payment control agreed with finance, communicated to suppliers, and tested with a simulation.
Verification
Final check of DMARC enforcement and tenant settings, a written summary, and a six-month review.
What you walk away with
- Your domain cannot easily be spoofed to your customers, suppliers or staff
- Attackers who steal a password still cannot read or forward mail unnoticed
- A changed bank account on an invoice triggers a phone call, every time
- Evidence of controls for insurers, auditors and customers
What we do not do
We would rather lose an enquiry than mislead you.
- We do not provide the email platform or security products; we configure what you have and recommend only where there is a gap
- No control makes fraud impossible; the goal is that it needs more than one failure
- Recovery of money already paid is handled under incident response, not this service
Frequently asked questions
We already have SPF. Is DMARC necessary?
SPF alone does not tell receiving servers what to do with a failure and does not survive forwarding. DMARC with a reject policy tells Gmail, Microsoft and others to discard mail that fails authentication for your domain, which is what stops exact-domain spoofing of your CEO or accounts team. Getting there without blocking legitimate mail is the work.
Our supplier's email was hacked, not ours. How is that our problem?
Because you paid the attacker. The courts and your insurer will ask what verification you did before changing bank details. A call-back control makes a compromised supplier mailbox a non-event. We also help you set expectations with suppliers so they call you too.
Will MFA and the other changes annoy staff?
Briefly. We stage the rollout by department, use app-based or passkey methods that take a few seconds per sign-in, and tell staff why it is happening and what to do if they are locked out. Most complaints stop within a fortnight. The alternative, a mailbox read for months by someone waiting for the right invoice to arrive, is considerably more annoying and much more expensive.
What about WhatsApp payment requests from the "CEO"?
Same control. Any payment or bank-detail change is verified by a call to a known number, regardless of channel or urgency. We include WhatsApp and SMS impersonation in the training and the simulation, because that is where many requests now arrive.
Tell us your email platform and how payments are approved
Microsoft 365, Google Workspace or other, number of mailboxes, and who can change a supplier's bank details today. We reply with a scope and fixed price within two working days.