Email Security & 2FA Setup

The attack that actually hits small businesses: BEC and invoice fraud

Forget movie-style hacking. The FBI’s IC3 reports have ranked business email compromise (BEC) among the costliest cybercrimes for years — billions in annual losses, and small firms are heavily represented because the scam needs no malware at all. The pattern is depressingly consistent: an attacker compromises (or convincingly spoofs) a vendor’s mailbox, watches real invoice threads for weeks, then sends a perfectly timed email — same signature, same PDF template — asking to “update our banking details for future payments.” Your bookkeeper changes the ACH details, and the next real invoice pays a mule account. The money is usually unrecoverable after 72 hours.

Two controls kill this pattern: email authentication so your domain cannot be spoofed and spoofed mail to you gets flagged, and a boring process rule — any bank-detail change is verified by phone to a number you already had on file, never one in the email. Everything else on this page reduces the odds the attacker gets a foothold in the first place.

SPF, DKIM, and DMARC without the jargon

Three DNS records decide whether receiving servers trust mail claiming to come from your domain — and whether criminals can send mail as you:

DMARC rolls out in stages. Start at p=none, which changes nothing but sends aggregate reports revealing every service sending as your domain — there are always surprises: the CRM, the payroll platform, a newsletter tool from 2019. Once every legitimate sender passes SPF or DKIM, step up to p=quarantine (failures go to spam) and then p=reject (failures are refused outright). Jumping straight to reject without the reporting phase is how companies accidentally block their own invoices; done in stages, the rollout takes four to eight weeks and is invisible to everyone but the spoofers.

Not all MFA is equal

Multi-factor authentication blocks the overwhelming majority of automated account-takeover attempts — Microsoft’s own telemetry has put it above 99% for commodity attacks. But the methods differ sharply in how they hold up against a determined phisher:

SMS deserves its bad press with nuance: SIM-swapping and real-time relay attacks are real, but they are targeted attacks. For a receptionist’s account, SMS still defeats the password-stuffing bots that constitute most attempts. The tiering that fits small-business budgets: passkeys or hardware keys for admins, owners, and anyone who can move money; authenticator apps for everyone else; SMS only as a fallback.

MFA fatigue, number matching, and conditional access

Attackers adapted to push notifications with “MFA fatigue”: armed with a stolen password, they trigger approval prompts repeatedly — at dinner, at 3 a.m. — until the victim taps Approve to make the phone shut up. The 2022 Uber breach famously started this way. The fix is number matching, now default in Microsoft Authenticator: the login screen shows a two-digit number the user must type into the app, so a mindless tap can no longer approve a stranger’s session.

Conditional access adds context on top: rules like “block sign-ins from countries we never operate in,” “require MFA on every new device,” or “block legacy protocols entirely.” Microsoft 365 Business Premium and Google Workspace both include enough of this for a small firm — it is configuration work, not new licensing.

The tell-tale sign of a compromised mailbox: inbox rules

When attackers get into a mailbox, their first move is usually creating rules: auto-forward copies of everything to an external address, or auto-delete anything containing “invoice,” “payment,” or the real vendor’s name — so the victim never sees the replies exposing the fraud in progress. This is why mailbox-rule auditing is part of our monitoring: a new forwarding rule to a Gmail address, or a rule that moves messages straight to RSS Feeds or Deleted Items, triggers a same-day investigation. We also disable external auto-forwarding tenant-wide by default; almost no small business has a legitimate need for it.

Filtering layers and closing the legacy back door

Beyond authentication, two mechanical layers stop the messages that do arrive: link rewriting (every URL is rerouted through a scanner at click time, so a link weaponized after delivery — a favorite trick — still gets blocked) and attachment sandboxing (files are detonated in an isolated VM before delivery; Microsoft calls the pair Safe Links and Safe Attachments in Defender for Office 365). Finally, legacy protocols — IMAP, POP3, and SMTP basic authentication — accept a bare username and password with no MFA prompt at all, which makes them the standard bypass for everything above. Microsoft began force-disabling basic auth in Exchange Online in late 2022, but we still find it re-enabled for an old scanner or accounting integration. Locking those protocols down, and giving the one device that genuinely needs to send mail an app password or OAuth-based connection instead, closes the last unguarded door.

Frequently asked questions

Won’t staff push back on MFA slowing them down?

Less than owners expect. With trusted-device policies, most people see a prompt once every couple of weeks per device, not per login — a few seconds each time. Passkeys are actually faster than typing a password. The rollout matters more than the technology: we enroll people in small groups with a two-minute walkthrough rather than flipping a tenant-wide switch on a Monday morning.

We already have Microsoft 365 spam filtering. Why add anything?

Baseline Exchange Online Protection catches bulk spam well but is weaker on targeted phishing and delayed-weaponization links. The step up — Defender for Office 365 via Business Premium, or an equivalent third-party layer — adds link rewriting, attachment detonation, and impersonation protection that flags “CEO-lookalike” display names. For most clients it is a licensing change plus configuration, not a new product.

What should an employee do the moment they suspect they clicked a phishing link?

Tell someone immediately — that is the whole policy, and it only works in a no-blame culture. From our side the response is mechanical: reset the password, revoke active sessions, check sign-in logs and mailbox rules, and search-and-purge the same message from every other inbox. Reported within the hour, it is a non-event; hidden for a week, it is an incident.

Do we need DMARC if we’re a ten-person company nobody has heard of?

Yes, for deliverability if nothing else — Google and Yahoo now expect authenticated mail, and unauthenticated senders increasingly land in spam. The anti-spoofing benefit is not theoretical either: fraudsters spoof small vendors precisely because their customers’ guard is down, and the first you hear of it is an angry client who paid a fake invoice bearing your name.