Business email compromise prevention

Gmail can block inbound mail spoofing your own domain, warn on employee-name impersonation from external addresses, flag lookalike domains, and stamp external senders with a banner. Turning all of that on is an afternoon of work and it removes the cheap end of the attack entirely.

The ceiling is reached the moment the attacker is inside a genuine supplier mailbox. The message is authentic, aligned, from a domain with good reputation, and the request is plausible because it references a real invoice. Nothing in the mail layer will stop it, and vendors implying otherwise are selling against a threat model that no longer applies.

Compromise is usually quiet for days before money is requested. During that window the attacker reads mail, learns the invoice cycle, and sets up a filter so the real user does not see the replies. Alert rules on filter creation, forwarding to external addresses, delegate additions and unusual login geography catch that period.

These alerts have a low false-positive rate in most organisations because ordinary staff rarely create forwarding rules. Where they do — a shared role mailbox, a departing employee's redirect — the exceptions are few enough to allowlist by name rather than by rule.

One rule prevents the majority of loss: no change to bank details is actioned without a voice callback to a number already held in the supplier record, made by someone other than the person who received the request. Not a number in the email signature, and not a number in the attached letterhead.

Add a payment threshold above which two named approvers are required, and a monthly reconciliation that lists every changed payee. These are finance controls rather than IT controls, which is exactly why they are so often missing — nobody owns the boundary, and the IT audit stops at the mailbox.

Suspend the account rather than resetting the password first, because a password reset leaves existing sessions and application-specific access alive. Then revoke sessions and OAuth tokens, remove filters and forwarding, and export the audit log before the retention window closes on the period of interest.

Contact the receiving bank within hours: recovery rates fall sharply after the first day and to near zero after a week. Report to Action Fraud in the UK or the IC3 in the US, notify the supplier whose mailbox may be the actual point of compromise, and record the timeline while people still remember it.