A supplier invoice arrives with the right logo, a familiar sender name and a request that appears routine. The only difference is a changed bank account number. That is how business email spoofing often succeeds: not through complicated technology, but by exploiting a busy person’s trust. To prevent business email spoofing, small and midsize businesses need protection at both the domain and human level.
Email remains central to quotes, payments, customer service and day-to-day decisions. A spoofed message can lead to fraudulent payments, data loss, damaged client relationships and a difficult recovery process. The good news is that the right controls are achievable without making communication harder for your team.
What business email spoofing looks like
Email spoofing is when a criminal makes a message appear to come from someone else. They may impersonate your managing director, finance team, IT provider, supplier or a trusted customer. Sometimes they use a lookalike address, such as changing one letter in a domain name. In other cases, the message seems to come directly from your real business domain.
The latter is particularly damaging. If criminals can send unauthorised messages that appear to be from your company, customers and suppliers may struggle to tell what is genuine. Your reputation is then part of the target.
Spoofing is closely linked to business email compromise, but the terms are not identical. A compromised mailbox means an attacker has gained access to a real account. Spoofing can happen without access to any mailbox at all. Both risks need attention because they often lead to the same outcome: someone is persuaded to act quickly without completing normal checks.
How to prevent business email spoofing at domain level
The strongest technical starting point is email authentication. This tells receiving mail systems which services are permitted to send email for your domain and how to handle messages that fail verification. It is not a single setting. It relies on three complementary controls: SPF, DKIM and DMARC.
SPF, or Sender Policy Framework, records the mail servers and platforms authorised to send on your behalf. This can include Microsoft 365, a website contact form, a marketing platform, a CRM system or an accounts package. If a genuine service is missed, its emails may fail checks, so the record must be built carefully.
DKIM adds a digital signature to outgoing email. Receiving systems can check that the message was sent by an authorised platform and was not altered in transit. It is especially useful where your business sends email through more than one approved service.
DMARC brings these checks together and gives your domain a policy. It can instruct recipients to monitor, quarantine or reject messages that fail authentication. DMARC also provides reporting, which helps identify unexpected senders and configuration gaps.
For many businesses, the sensible path is to begin with monitoring rather than immediately rejecting every failed message. This allows your IT partner to see what is already sending from your domain, correct any overlooked systems and confirm that legitimate messages are aligned. Once the picture is clear, the policy can move towards quarantine or rejection.
That staged approach matters. A strict DMARC policy is valuable, but switching it on without preparation can interrupt legitimate communications. The aim is not just to block fraudulent messages. It is to protect your domain while keeping invoices, appointment confirmations, newsletters and client correspondence flowing normally.
Keep a record of every authorised sender
Email systems tend to grow over time. A website developer may have configured a contact form years ago, marketing may use a separate campaign tool, and an office may send scans from a multifunction printer. Each can affect your authentication setup.
Maintain a simple record of every platform that sends email using your domain, who owns it and whether it is still needed. Review it before changing SPF, DKIM or DMARC records and whenever new software is introduced. This avoids a common problem where a useful service is added without IT approval and later causes delivery failures.
Secure the accounts behind your email
Domain authentication prevents others from impersonating your domain. It does not stop criminals using a genuine account if a password has been stolen. Protecting Microsoft 365 or your chosen email platform is therefore equally important.
Multi-factor authentication should be standard for every mailbox, particularly directors, finance staff, administrators and anyone who can access customer information. A password alone can be captured through phishing, reused from another breach or guessed if it is weak. Multi-factor authentication makes that stolen password far less useful.
Access should also match each person’s role. Not every employee needs administrator permissions, access to all shared mailboxes or authority to create forwarding rules. Limiting privileged access reduces the potential impact of one compromised account.
It is worth reviewing automatic forwarding as well. Attackers commonly create hidden forwarding rules so they can monitor conversations and wait for the right moment to send a convincing payment request. Alerts for unusual mailbox rules, unfamiliar sign-ins and unexpected location changes give your team a better chance of stopping an attack early.
Make payment checks hard to bypass
Technology can filter a large amount of malicious email, but no filter will catch every carefully targeted message. Financial controls are what stop a persuasive email becoming a costly transfer.
Your team should never treat an email alone as sufficient authority to change bank details, release a payment or share sensitive records. Any request involving money, payroll, supplier details or confidential data should be confirmed through a known method, such as calling a verified telephone number already held in your records. Do not reply to the suspicious message or use a phone number included in it.
For higher-value payments, use a second approver and make the process clear enough that staff feel able to pause a transaction. A criminal will often create urgency by claiming a director is travelling, a supplier will stop work or a deadline is minutes away. Your procedures should make a calm verification call the expected response, not an awkward exception.
This is especially relevant for small businesses, where a few people may hold several responsibilities. Separation of duties may not always be practical, but independent confirmation still is. A short phone call can prevent a serious loss.
Train staff to notice the right signals
Awareness training works best when it is specific to the decisions your people make. Generic warnings about suspicious emails are less useful than showing how a false invoice, fake document-sharing alert or impersonated director request may look in your business.
Staff should be encouraged to check the full sender address, not just the display name. They should be cautious of unexpected attachments, password reset notices they did not request and messages that try to move a conversation away from normal channels. A change in writing style, an unusual request for confidentiality or pressure to act immediately can all be warning signs.
Training should also make reporting easy. Employees should know where to send a suspicious email and feel confident that reporting a mistake quickly is the right action. Delays give criminals more time to access accounts, send further messages or target customers.
Regular, brief refreshers are usually more effective than a single annual session. Threats change, and staff need reminders that fit into a busy working week.
Have a response plan before you need one
If someone reports a suspected spoofed email, speed matters. Preserve the message, including its headers where possible, and ask the recipient not to interact with it further. Your IT team should check whether it is simple impersonation, a compromised mailbox or evidence that your domain authentication needs attention.
If a mailbox may be compromised, reset credentials, revoke active sessions, review multi-factor authentication methods and check forwarding rules, sent messages and sign-in activity. Where clients or suppliers may have received fraudulent messages from your domain, prompt, clear communication helps them avoid further risk.
A managed IT provider can monitor these controls, investigate alerts and keep email security aligned as your systems change. Trust PC Expert supports businesses that want practical protection without needing an internal security team to manage every technical detail.
Email security is not about making people suspicious of every message they receive. It is about putting reliable checks around the moments that matter, so your team can work confidently and your customers can trust communications from your business.
