Phishing at work: how your team spots a fake email, and what SPF, DKIM and DMARC catch for them

Friday, a quarter to five. The accountant gets an email from the director: an invoice has to be paid today, he's in a meeting and can't pick up, the details are attached. The name is right, the signature is right, the tone sounds like him. Or a familiar supplier writes that its bank has changed and the next payment should go to a new account.

Both are textbook. The FBI calls this business email compromise, and in its 2024 report (IC3) it was the second most expensive kind of online fraud: 21,442 complaints and about $2.77 billion lost, behind only investment fraud.

What a phishing email looks like now

The old advice was to look for spelling mistakes. That no longer works. CISA, the US cybersecurity agency, warns that attackers now use AI to write phishing with clean grammar, so the language gives nothing away.

What gives it away is what the message wants from you. In February 2026 the State Fiscal Service (SFS) warned about fake notices sent in its name, about funds supposedly being frozen, signed with the director's name. They came over WhatsApp, and the SFS listed what was wrong with them: the wrong address for its portal, an invented letterhead, QR codes and barcodes that it only uses on electronic invoices, and no electronic signature, which every real SFS document carries. Change the channel to email and the same checklist works.

For a small company the expensive ones come in two kinds:

• A fake login page. "Your mailbox is full", "a document has been shared with you", "confirm your account": the link opens a page that looks like Microsoft, Google or your bank, and whatever you type goes to the attacker.
• A fake request for money. There is no link at all, only someone you trust asking for a payment or for new bank details to be used. Filters let these through most easily, because there is nothing technical in them to flag.

What the team checks

• Read the address after the @, not the name. The display name can say anything. If the real address is @exemplu.md, the fake one will be @exemplu-md.com, @exemp1u.md or a Gmail account with the director's name on it.
• Press Reply and look at the address that fills in. If it isn't the sender's, stop there.
• Be wary when urgency, secrecy and money turn up together. "Today", "I can't talk" and "don't tell anyone yet" next to an account number is exactly how these emails read.
• Check where a link really goes. On a computer, hover over it and read the address at the bottom of the window; on a phone, press and hold. To log in anywhere, type the address yourself or use a bookmark.
• Leave unexpected attachments closed: archives, HTML files, documents that ask you to "enable content", anything named like invoice.pdf.exe.
• Phone before paying into a new account. Use a number from the contract or your own contacts, never one written in the email. This rule alone stops most of the money fraud.

What SPF, DKIM and DMARC catch, and what they don't

We explained these three records in the article about mail landing in spam. They also protect you here, but only against one kind of fake.

What they stop

With DMARC set to p=reject, nobody can send mail as @yourcompany.md and have it delivered. A fake email from "the director" on your own domain gets rejected by Gmail, Microsoft and most other big providers. So does a fake invoice sent to your clients in your name. The UK's National Cyber Security Centre (NCSC) puts it simply: setting up DMARC stops phishers from spoofing your domain.

What they let through

• A lookalike domain such as yourcompany-md.com. It belongs to the attacker, who can set up perfect SPF, DKIM and DMARC for it.
• A free Gmail or Outlook address with your director's name on it.
• A real mailbox that has been broken into. If a supplier's account is stolen, the fake invoice comes from their genuine address and passes every check. This is the hardest one, and only the phone call above catches it.

The records are where you start, but the people still matter. Two settings help with what gets through. Most mail services can label every message from outside the company with a tag like "External", so a "director" writing from outside stands out. And two-factor login on every mailbox means a password stolen through a fake page is not enough on its own (see the article about company passwords).

Why one layer is never enough

The NCSC describes a financial company with about 4,000 employees that received 1,800 emails carrying malware, dressed up as an invoice that needed urgent attention and written in good English. The filter stopped 1,750. Of the 50 that reached inboxes, people ignored or reported 36. Fourteen were clicked. In 13 cases the malware failed because the computers were up to date. The one that did install was caught when it tried to contact its operator, and that computer was cleaned in a few hours.

No single layer caught all of it: the filter missed 50, people missed 14, updates missed one. All of them together turned it into an afternoon's work.

The same guidance makes a point that small firms often get wrong: don't punish whoever clicks. People who are afraid for their jobs don't report their mistakes, and an early report is what saves you. Count how many people reported the email, not only how many clicked.

A one-page rule for the team

Print it, or pin it in the team chat:

1. A new bank account or an urgent payment requested by email: call back on a number you already have, and a second person approves the payment.
2. Nobody asks for a password by email. To log in, type the address yourself.
3. Something looks off: forward it to the person who handles IT, then delete it. Thank whoever reported it, even when it turns out to be real.
4. Clicked, or typed a password into a page you're not sure about: say so straight away. Change that password, and have the computer checked.
5. If money has already gone out, call the bank at once. The sooner they hear, the better the chance of stopping the transfer.

The short version

People catch the fakes that pass every technical check, and the domain records catch the ones that pretend to be you. Most phishing reaches a small company because one of the two is missing: DMARC was never switched on, or nobody ever told the accountant that a call is allowed and expected.

Checking your domain's mail records and how your mail treats messages from outside is part of our IT consulting. If you'd like us to look at yours, write to us.