Email security & spam protection
Most break-ins start with one email.
A fake invoice, a “new bank details” note from a vendor, a sign-in page that looks like Microsoft’s. Here is how these scams work, what the technical protections do, and the habits that stop the ones the filters miss.
Sample data · “Your Business”, Oxford, AL
Quick answer
How do I protect my business email from phishing?
Use four layers together: email filtering to catch most bad messages, multi-factor sign-in so a stolen password is not enough, SPF, DKIM and DMARC so others cannot easily send as your domain, and trained staff who verify any payment change by phone. No single layer is enough, because some phishing emails contain nothing a filter can detect.
How the scams work
Two attacks every office should recognize.
Neither attack needs a virus. They need one person to trust one message.
Phishing: steal the password
An email says a document is waiting or a mailbox is full, and links to a page that looks like a real sign-in screen. The person types their password, the attacker now has it, and the real mailbox is theirs to read.
Business email compromise: redirect the money
The attacker, often from inside a real mailbox they already broke into, sends a reply in an existing conversation: “We changed banks, please use the new account for this invoice.” No link, no attachment, nothing for a filter to catch. The payment goes to the attacker.
What they do once inside
Read old threads to learn who pays whom, set a hidden rule that moves replies out of the inbox, then wait for an invoice to come due. The owner of the mailbox often notices nothing.
SPF, DKIM and DMARC
Three records that say which email is really yours.
All three are settings on your domain. They cost nothing to publish, and many small businesses have them missing or half finished.
- 01
SPF: the list of approved senders
A record on your domain that lists the mail systems allowed to send email for it. A receiving server can check whether a message came from a system on the list.
- 02
DKIM: the tamper seal
Your mail system adds a digital signature to each message. The receiver checks it against a key published on your domain, which shows the message really came from your system and was not changed on the way.
- 03
DMARC: the instruction
A policy that tells receivers what to do with mail that claims to be from your domain but fails SPF and DKIM: deliver it, send it to junk, or reject it. It also sends you reports of who is sending as you.
These three protect other people from fakes of your domain, and help your real email reach inboxes. They do not stop a look-alike domain with one letter changed, and they do not stop an attacker who has signed in to a real mailbox.
Multi-factor sign-in
The single most useful setting.
Multi-factor sign-in asks for a second proof after the password: an approval in an app on your phone, a code, or a physical key. If a password is stolen through a fake sign-in page, the attacker still cannot get in without the second proof.
Turn it on for every mailbox, including the owner’s and shared accounts. An app or a security key is stronger than a texted code. Teach staff one rule: never approve a sign-in prompt you did not start yourself.
What filtering does
What a filter catches, and what it cannot.
A good filter catches
- Bulk spam and known scam campaigns
- Attachments carrying known malware
- Links to sites already reported as fake
- Many messages that pretend to be from your own domain
- Senders with a bad history
A filter often misses
- A plain-text request from a real, hacked vendor mailbox
- A brand-new fake site nobody has reported yet
- A look-alike domain with one letter changed
- A text message or phone call that follows up the email
- A request that is unusual only if you know the business
Habits that stop the rest
What staff should do with a suspicious email.
Write these down, keep them to one page, and go over them with every new hire.
When an email feels off
- Do not click the link or open the attachment
- Do not reply to ask if it is real; the reply goes to the attacker
- Check the full sender address, not just the display name
- Report it to whoever handles IT, then leave it alone
- If you already clicked or typed a password, say so right away; speed matters more than blame
The payment-change rule
- Any request to change bank details, or to pay somewhere new, is verified by phone
- Call a number you already had on file, never one from the email
- Say the new account details out loud and confirm them with a person you know
- Two people approve any wire or change to vendor payment details
- Urgency and secrecy are warning signs, not reasons to skip the call
What it costs
Part of Managed IT. Standalone work is quoted.
Email filtering and security is part of the plan’s security, along with Microsoft 365 administration and staff training. Minimum 5 users. Microsoft 365 licenses billed separately at Microsoft’s price.
- Advanced security monitoring
- Microsoft 365 administration and support
- Security awareness training
- 24/7 monitoring and alerting
- Unlimited remote help desk (phone & email)
- After-hours emergency support
For a business that is not on Managed IT. Priced in a written proposal before any work starts.
- SPF, DKIM and DMARC set up and checked
- Multi-factor sign-in turned on for every mailbox
- Email filtering set up
- A review of mailbox rules and sign-in history
Questions
Email security, plainly answered.
What is the difference between spam and phishing?
Spam is unwanted bulk email, mostly a nuisance. Phishing is aimed at getting something: a password, a payment or access. Phishing is often sent in small numbers and written to look like it comes from someone you know.
Do I need SPF, DKIM and DMARC if I only have a few mailboxes?
Yes. They protect your domain name, not your mailbox count. Without them it is easier for someone to send email that appears to come from you, and large email providers increasingly treat mail from unprotected domains as suspect.
We have Microsoft 365. Isn’t email security built in?
Basic filtering is included, and more protection is available depending on the plan. The settings matter as much as the license: multi-factor sign-in, forwarding rules and your domain records all have to be set up on purpose.
An employee clicked a phishing link. What should we do?
Change that account’s password and sign it out everywhere, confirm multi-factor sign-in is on, and check the mailbox for forwarding or hidden rules. Then check sign-in history, and warn contacts if anything was sent from the account. If money or bank details were involved, call your bank right away.
Can you stop all phishing emails?
No, and nobody honestly can. Filtering stops most of it. The rest is handled by multi-factor sign-in, which limits what a stolen password can do, and by staff who verify payment changes by phone.
How do I verify a wire transfer request?
Call the person or vendor on a phone number you already had before the request arrived. Do not use a number from the email or reply to it. Confirm the amount and the account details by voice, and have a second person approve the payment.
Is email security included in Managed IT?
Yes. Email filtering and security is part of the security included in Managed IT at $175 per user, per month, with a 5-user minimum. As a standalone project it is quoted.
Contact
Request an IT assessment.
A hands-on review of your computers, network, security and backups, quoted up front, with findings in plain English.