Business email security basics: phishing, spoofing and hijacked accounts

What attacks on business email look like

The common thread is trust: the message looks like it comes from someone the recipient knows, and asks for something urgent. The defences are a mix of technology (so the obvious fakes never arrive) and habits (so the clever ones don't work).

Protect your domain from being impersonated

Without authentication, anyone can send mail with From: ceo@yourcompany.com. Three DNS records stop that:

• SPF lists the servers allowed to send as your domain,
• DKIM signs every message so the receiver can check it wasn't forged or altered,
• DMARC tells receivers to reject or quarantine mail that fails both - but only with p=quarantine or p=reject. A p=none policy only reports; it doesn't stop anything.

That's why AnyMail's DNS check requires an enforcing DMARC policy before a domain counts as verified. Check your domain with the email authentication checker. A domain that never sends mail should still publish v=spf1 -all and v=DMARC1; p=reject, so it can't be abused either.

DMARC has a limit worth knowing: it protects your exact domain. It does nothing against a lookalike domain the attacker owns and authenticates properly. For those, the people reading the mail are the defence.

Learn to spot lookalike domains

A few tricks account for most lookalikes. For a company at example.com:

Internationalised domain names add another variant: letters from other alphabets that look identical to Latin ones. Practical checks for anyone handling invoices or payments:

• Look at the address, not the display name - on a phone, tap the sender to see it.
• Compare the Reply-To with the From: replies that would go to a different domain are a red flag.
• Hover over links (or long-press on a phone) before clicking, and type the address of anything you sign in to yourself.
• Be suspicious of urgency, secrecy ("don't tell anyone yet") and requests to bypass the usual process.

Business email compromise: a process problem

The classic case: a "supplier" writes that their bank account has changed, or the "CEO" asks for an urgent transfer while travelling. The message may come from a lookalike domain - or from the supplier's real mailbox, if it was hijacked, in which case every technical check passes. So the defence is a rule, not a filter:

• Any change of bank details is confirmed by phone, using a number you already had - never one from the message.
• Payments above a threshold need a second person to approve.
• Nobody is punished for checking. A request from the boss that can't survive a phone call wasn't from the boss.

Protect the accounts themselves

Passwords and two-factor sign-in

Use a unique, long password for every mail account - a password manager makes this painless - and turn on two-factor sign-in. An authenticator app (TOTP) means a stolen password alone isn't enough. Store the recovery codes somewhere safe and offline; they are how you get back in if the phone is lost.

An app password per device

Mail apps on phones and computers often can't do two-factor sign-in themselves. Instead of typing your main password into each one, give every device its own app password. If a laptop is stolen, you revoke that one password; your main password and the other devices are unaffected.

Fewer people, fewer permissions

Give each person their own access instead of sharing a password, and only the rights they need - see shared inboxes for teams. When someone leaves, remove their access, app passwords and devices the same day.

When an account has been compromised

Signs include replies to messages you never sent, sent items you don't recognise, missing mail, or colleagues asking about a strange message from you. Work through this in order:

1. Change the password from a device you trust, and make it one you have never used anywhere else.
2. Sign out every other session, so the attacker's open session ends.
3. Turn on two-factor sign-in, or if it was on, reset it and generate new recovery codes.
4. Revoke app passwords and API keys. They usually keep working after a password change - which is the point of them, and exactly why an attacker creates one.
5. Check forwarding and filter rules. Attackers like to add a rule that silently forwards mail to them or hides replies to their fake messages. Also check who else has been given access to the mailbox.
6. Look at the Sent folder and the account's connected tools (webhooks, integrations) to see what was done in your name.
7. Warn the people affected - colleagues, customers, suppliers who may have received fraudulent messages - through another channel.
8. Change the same password everywhere else it was used, and check the registrar and DNS accounts too.
9. Consider your legal duties. A compromised mailbox usually holds personal data. Under the GDPR (Art. 33), a personal data breach must be reported to your supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people. You can also report the incident to your national CERT/CSIRT.

How AnyMail helps

• Your domain: every mail server gets its own 2048-bit DKIM key, and the domain is only verified with an enforcing DMARC policy.
• Sign-in: two-factor sign-in with an authenticator app (TOTP) and eight one-time recovery codes; a password reset doesn't bypass it. On the Account page you can change your password and use Sign out other devices.
• App passwords: each inbox can have up to five, each shown once when created and revocable on its own; revoking one closes that device's open IMAP connection immediately. They only work over encrypted connections and only for their own inbox. Like API keys, they are not revoked by a password change, so revoke them yourself after an incident.
• Where to look after an incident: each inbox's Filters (forwarding rules), Access (who it is shared with) and Mail app (app passwords) panels, plus API keys and webhooks in the Developer section.
• Spam: every message is scored for spam, and HTML mail is sanitised before you see it.