Key takeaways
- •Treat unexpected payment or bank-detail changes as high risk.
- •Protect email accounts with strong authentication.
- •Use mail filtering and domain controls as part of a wider approach.
- •Give staff an easy way to report suspected messages.
Protect accounts as well as inboxes
Use multi-factor authentication for email and administrator accounts where available. Review legacy sign-in methods, recovery options and access from third-party applications as part of an identity review.
Build an independent payment verification step
Do not rely on the reply address or phone number contained in a change request. Verify changes using a known, previously established contact channel and follow the organisation’s approval process. Make the process easy to follow under time pressure.
Layer technical email protection
Email filtering can assess links, attachments, spam and impersonation indicators. Domain authentication can help receiving systems evaluate whether mail is authorised, but settings must be configured and monitored carefully.
Make reporting useful
Staff should know how to report a suspicious message without forwarding it widely or feeling blamed for asking. Security and finance teams can use reports to investigate and adjust controls.
Prepare for a suspected compromise
Agree who can suspend a mailbox, reset credentials, review forwarding rules, contact affected parties and coordinate with financial institutions. Actions and approval boundaries should be set before an incident.
Sources and further guidance
Official guidance may change. Check the source directly for current requirements. This article is general information, not legal advice.
Put your next step into context.
A free 30-minute cybersecurity review provides a Red, Amber or Green score and prioritised fixes.
Book a review