The most expensive security incident I have worked on at a small company involved no malware and no vulnerability. A finance assistant received an email that appeared to come from a long-standing supplier, saying their bank had changed and attaching an updated invoice. The email thread was real; the supplier's mailbox had been compromised weeks earlier. The payment went out, and by the time the real supplier asked where their money was, it had moved through three accounts.

Email remains the main way attackers reach people. This playbook covers the forms of email attack you should expect, the technical controls that block most of them, and the process controls that stop the rest, because some attacks will always reach an inbox.

The forms of email attack

Type Target Goal Typical lure
Phishing Many people at once Credentials, malware Shared document, delivery notice, password expiry
Spear phishing One person or team Credentials, access Real project names, real colleagues, real suppliers
Whaling Executives Payments, sensitive data Legal matter, acquisition, urgent board request
Business email compromise (BEC) Finance, HR, sales Money transfer, payroll diversion Changed bank details, urgent payment, gift cards
Clone phishing Recipients of a real email Credentials, malware Resent copy of a genuine message with a bad link

BEC is different in an important way: it often contains no malicious link or attachment at all. It is a plausible request from a trusted address, sometimes from the real, compromised mailbox. Email filters built to find bad links have little to work with.

Layer 1: authenticate your domains

Three DNS-based standards let receiving mail servers check that mail claiming to be from your domain is legitimate:

  • SPF lists the servers allowed to send mail for your domain.
  • DKIM adds a cryptographic signature to each message, verified with a public key in DNS.
  • DMARC tells receivers what to do when SPF or DKIM checks fail and where to send reports.
example.com.          TXT  "v=spf1 include:_spf.mailprovider.example -all"
selector1._domainkey  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."
_dmarc.example.com.   TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com; adkim=s; aspf=s"

Roll DMARC out in stages: p=none while you read reports and find every legitimate sender, then p=quarantine, then p=reject. With p=reject, attackers can no longer send mail that passes as exactly your domain, which removes the easiest form of impersonation against your customers and suppliers.

DMARC does not stop look-alike domains such as examp1e.com or a compromised supplier mailbox. Those need the next layers.

Layer 2: filter and warn

  • Use your mail provider's advanced filtering: attachment sandboxing, link rewriting with time-of-click checks, and impersonation protection for executives' names.
  • Add a visible external sender banner to mail from outside the organisation, and a stronger warning for first-time senders.
  • Flag newly registered domains and domains that look similar to yours or your main suppliers'.
  • Block or quarantine risky attachment types that your business does not need, such as executables, scripts and macro-enabled documents from outside.

Layer 3: make stolen credentials useless

Phishing for credentials only works if the password is enough. Phishing-resistant MFA, such as passkeys or FIDO2 security keys, binds the login to the real website's origin, so a fake login page cannot relay it. Prioritise it for email, single sign-on, finance systems and administrators.

Also watch the mailbox itself after a compromise. Attackers who get in commonly create inbox rules that hide replies from the real supplier or forward mail to an outside address. Alert on new forwarding rules to external domains and on rules that move messages to rarely used folders.

Layer 4: the process control that stops BEC

Technology cannot reliably tell a real request for a bank change from a fake one sent from a real but compromised mailbox. A process can.

Out-of-band verification: any request to change payment details, payroll accounts or to make an unusual payment is confirmed through a channel other than the email, using contact details already on file. Never use a phone number or link from the request itself.

Write it as a short policy finance can point to:

  1. Bank detail changes for suppliers, customers or employees require a call-back to a number from the existing record, by someone other than the person who received the request.
  2. New or changed details are held for a cooling-off period, for example 48 hours, before the first payment.
  3. Payments above a threshold need approval from two people.
  4. Urgency or secrecy in a payment request ("the CEO needs this done today, do not discuss") is a reason to slow down, and staff will never be blamed for verifying.

Point four is the one that makes the others work. People skip verification when they fear being seen as obstructive. Leadership has to say, explicitly and repeatedly, that verifying is always the right call.

Layer 5: make reporting easy and fast

Users are your detection system for the attacks that get through. Make reporting a single click with a "report phishing" button, and close the loop:

  • Acknowledge every report quickly, even if it is harmless.
  • When a report is real, search for the same message in all mailboxes and remove it.
  • Block the sender, domain and URLs, and check whether anyone clicked or entered credentials.
  • Share a short, blame-free note with the company when a campaign targets you.

A metric worth tracking is time from the first delivery of a phishing email to its removal from all mailboxes. Teams with good reporting culture get it under an hour.

Phishing simulations, done carefully

Simulated phishing can build awareness, but it can also damage trust. If you run simulations:

  • Focus on teaching, not catching. Show a short explanation immediately after someone clicks.
  • Avoid lures that exploit real anxieties, such as fake bonuses or layoffs.
  • Measure the reporting rate, not only the click rate. More reports is the goal.
  • Never use results to punish individuals.

When someone clicked or paid

For a credential compromise:

  1. Reset the password and revoke all sessions and tokens for the account.
  2. Check for and remove malicious inbox rules, forwarding and newly registered MFA methods.
  3. Review sign-in logs for access from unusual locations and what was accessed.
  4. Search for other recipients of the same campaign.

For a fraudulent payment, speed matters more than anything:

  1. Call your bank immediately and request a recall of the transfer; the chance of recovery drops quickly.
  2. Report to the police and the national cybercrime reporting channel.
  3. Notify the real supplier through known contact details; their mailbox is likely compromised.
  4. Preserve the emails with full headers for the investigation.

Key takeaways

  • Expect phishing, spear phishing, whaling and BEC; BEC often has no malicious content to filter.
  • SPF, DKIM and DMARC at p=reject stop direct impersonation of your domain.
  • Phishing-resistant MFA makes stolen passwords far less useful.
  • Out-of-band verification of payment changes is the control that stops the costliest fraud.
  • Easy reporting and fast removal turn employees into your best detection layer.

References