How to keep your business email secure

The invoice with the changed bank details

It arrives as a routine invoice or a payment instruction. Usually from a supplier you deal with regularly, sometimes from inside your own company. The wording fits, the amount is plausible, and the only thing different is the account it asks you to pay into.

It reads well because it often is your own correspondence. Whoever sent it has been reading the thread, either from inside a mailbox at one end or from a lookalike address, and they have copied the phrasing, the reference numbers and the timing from real messages. That is why “it looked odd” is not a reliable filter, and why staff who have never fallen for anything still get caught.

Replying to check does not settle it. If they are reading the mailbox, they answer your reply themselves. If they are sending from an address that differs by one character, your reply goes to them by design. A reply only ever confirms that whoever is on the other end says it is genuine.

What settles it is a channel they are not sitting in the middle of. Phone the number you already had on file for that supplier, from your own records, and get confirmation from a person. Not the number in the email, not the one in the signature block.

The awkward case is worth naming, because it comes up. If the whole relationship happened by email and every contact detail you hold came out of the same thread, you do not have an independent channel yet. Find one before the money moves: the company’s published number, the person who introduced you, an address on a previous statement.

Then make it a rule other people can follow. Whoever pays your invoices needs to know that payment details are never changed on the strength of a message, and that holding a payment for a day to make a call is the expected behaviour rather than an accusation.

Two-factor, and what it does not cover

Turn it on for every mailbox, not just the owner’s. Accounts nobody watches are useful to sit inside quietly, which is exactly why they get taken.

It is not absolute, and it is worth knowing where the edges are. Codes sent by text can be intercepted, and a convincing fake login page can collect a code and use it within the minute. An app-based code or a security key handles both better than SMS.

What it does remove is the common case: a password that leaked in somebody else’s breach, tried against your mailbox by a machine. That is most of what gets attempted.

Rules you did not set

When somebody does get into a mailbox, a frequent first move is a rule. Forward everything to an outside address, or file anything mentioning invoices into a folder nobody opens. Then they read for a while.

So the rules and forwarding settings are worth opening and reading, on every account including the dormant ones. Anything sending mail to an address you do not recognise needs dealing with the same day.

SPF, DKIM and DMARC

These are DNS records that tell other mail servers which servers may send using your domain. SPF lists the servers allowed to send for you. DKIM signs your outgoing mail so it can be checked in transit. DMARC says what a receiving server should do when a message fails those checks, and can send you reports of what is being attempted.

They do not stop a lookalike domain, which is a different attack, and they do not protect a mailbox somebody has the password to. What they stop is mail sent from anywhere else with your own domain on it.

You can look up any domain’s records, including ours. dot.bm publishes one SPF line, v=spf1 include:spf.messagingengine.com -all, naming a single mail provider and asking receivers to reject the rest. Our DMARC is still set to p=none, which means we are reading the reports rather than enforcing on them. That is the honest order of operations: turn on enforcement before you know everything that legitimately sends mail for you, and the first casualty is usually your own invoices.

One thing to watch on shared hosting. If a provider tells you their whole server IP belongs in your SPF record, that record then vouches for every other customer on that server as well.

People who have left

Shared mailboxes and shared passwords are how somebody keeps access for years after leaving, without anyone intending it. One login per person, closed on the day they go, and a password manager so nobody needs to write anything on a card in the drawer.

The same applies to the accounts around the mail. The domain, the hosting and the website admin are covered in how to keep a small business website secure.

If a mailbox has been compromised

Change the password and sign out every session, which drops anyone still logged in. Turn on two-factor now if it was not already on.

Delete any rules that were added, and read the sent and deleted folders to work out what went out in your name and to whom. If a payment was made or personal information was exposed, tell the bank the same day and treat it as a reportable breach under PIPA.

Then contact the people who were emailed from the account. They are the ones now holding an invoice that passed every check they know how to make.

If you take card payments, the gateway has its own controls worth checking at the same time. The Authorize.Net security checklist covers those. If you would rather we set the DNS records up and check what your mail is currently doing, ask us.