The short answer
- The costliest email attack is not ransomware. It is a convincing request to change banking details, often sent from a real, compromised account.
- Text-message and app-approval MFA can be bypassed by modern phishing kits that steal the session after you sign in. Passkeys and security keys cannot be phished this way.
- Microsoft 365 Business Premium already includes most of the filtering, impersonation protection and encryption a small business needs. Many tenants have it switched off or at defaults.
- A one-line payment rule stops most fraud: any change to banking details is confirmed by phone, on a number you already had.
Anatomy of a business email compromise
Business email compromise rarely looks like an attack. There is no ransom note and nothing breaks. Money simply goes to the wrong account, and nobody notices until a supplier asks why they have not been paid. This is how a typical case unfolds, and where each step can be stopped.
The email threats that matter most
| Threat | What it looks like | The main defence |
|---|---|---|
| Credential phishing | A shared document, voicemail or invoice link that leads to a fake Microsoft sign-in page | Link scanning, plus MFA that cannot be phished |
| Session theft | A phishing kit relays your real sign-in, MFA included, and keeps the session it creates | Passkeys or security keys, and sign-in only from managed devices |
| Payment-change fraud | A supplier, lawyer or executive “updates” their banking details | A verbal call-back rule on a known number |
| Impersonation | Mail from a look-alike domain or a personal account using your CEO’s name | Impersonation protection and external sender tags |
| Malicious attachments | Disguised scripts, macro documents and password-protected archives | Attachment sandboxing and blocking risky file types |
| QR code phishing | An image asking staff to scan a code with their phone, outside company protection | Training, and phone sign-ins covered by the same MFA rules |
| Spoofing of your own domain | Fakes sent from your exact address | SPF, DKIM and DMARC |
| Accidental data leaks | Client files sent to the wrong recipient or a personal address | Sensitivity labels, data loss prevention and encryption |
Why some MFA is no longer enough
Multi-factor sign-in remains the single most effective defence against stolen passwords. But the kinds that rely on a code or an approval prompt can be defeated by phishing kits that sit between the user and Microsoft. The victim signs in normally on a fake page, approves the prompt, and the kit captures the session that results. The attacker then uses that session without needing the password or the phone again.
| Sign-in method | Stops password reuse | Stops session-stealing phishing |
|---|---|---|
| Password only | No | No |
| Text message code | Yes | No |
| Authenticator app with number matching | Yes | Partly |
| Passkeys or security keys | Yes | Yes |
| Any method plus managed-device rule | Yes | Largely |
For finance staff, executives and administrators, move to passkeys or hardware security keys first. For everyone, Conditional Access rules that allow sign-in only from company-managed devices block most stolen sessions from being used elsewhere.
What Microsoft 365 already gives you
Microsoft 365 Business Premium includes Microsoft Defender for Office 365 Plan 1 and message encryption. Used properly, they cover most of the threats above.
- Safe Links checks links when they are clicked, not just when the email arrives, catching pages that turn malicious later.
- Safe Attachments opens attachments in a sandbox before delivery.
- Impersonation protection flags mail pretending to come from your executives or partner domains.
- External sender tags mark every message from outside the company.
- A report button in Outlook lets staff send suspicious mail straight to review.
- Message encryption and sensitivity labels protect client files sent by email.
The common problem is not missing licences but settings left at defaults. Our email security service sets these up and reviews what they catch.
The process controls that stop fraud
Technology catches most attacks, but payment fraud is ultimately stopped by process. These rules cost nothing and should be written down.
- Verify every banking change by phone, on a number from your own records, never one in the email.
- Require two people to approve new payees and payments over an agreed amount.
- Treat urgency as a warning sign. “The CEO needs this today, keep it quiet” is the classic script.
- Report, do not just delete. One reported phishing email can protect the whole office.
- Train with real examples, briefly and often, rather than once a year.
If money has already gone
Call your bank immediately and ask them to recall the payment: the first hours matter most. Then reset the affected account’s password, end all its sessions, check for inbox rules and forwarding, and call your IT provider and insurer. Our data recovery and incident page explains the first steps.
Spoofing of your own domain is a separate problem with its own fix, covered in our guide to SPF, DKIM and DMARC. For the wider picture, see our cybersecurity service.