Contents
Short answer
Email remains the most common route for phishing and payment fraud. For small businesses three layers work together: filters at your email provider, technical sender verification for your own domain (SPF, DKIM, DMARC) and clear procedures for payments and account changes. None of them replaces the others.
Why does this matter for small businesses?
Fake invoices, changed bank details or supposed instructions from management quickly cause major losses in small businesses because approvals often rest with few people. Attackers can also abuse your domain to deceive your customers.
What does it include?
Spam and phishing filters
Usually included in business mailboxes. They catch a lot, but not targeted or new attacks.
Basic
Understanding domain spoofing
Attackers send email that looks as if it came from your domain or a similarly spelled one.
Basic
SPF, DKIM and DMARC
SPF defines which servers may send for your domain. DKIM signs email. DMARC tells recipients what to do with email failing both checks – and provides reports. Set up in DNS settings, usually with your email or IT provider.
Useful as IT grows
Advanced email security
Additional checking of links and attachments, for example in an isolated environment. Worth it with high volume or targeted attacks.
Useful as IT grows
CEO and supplier fraud
Deception without malware: supposed instructions from the boss or changed bank details. Protection comes mainly from procedures.
Basic
Staff training
Short, regular exercises and a simple route for reporting suspicious messages.
Useful as IT grows
What does it protect against?
- Mass phishing and known malicious attachments (filters)
- Abuse of your own domain towards customers (DMARC with a strict policy)
- Payment fraud, if approvals are confirmed via a second channel
What does it not protect against?
- Look-alike third-party domains – DMARC only protects your own domain
- Genuine supplier mailboxes that were taken over
- Staff paying under time pressure without a call-back
Which basic measures are often enough?
- 01Keep provider filters on, tag external email
- 02MFA for all mailboxes
- 03Payments and bank-detail changes only after a call-back to a known number
- 04Define a reporting route for suspicious email
- 05Have SPF, DKIM and DMARC checked by your email provider
When does a more advanced solution make sense?
Advanced filtering, a gradually tightened DMARC policy with report review and regular phishing exercises make sense when many staff exchange email with external partners, regularly trigger payments or the business has already been targeted.
Common mistakes
- Relying on the spam filter alone
- Setting up DMARC but never reading the reports
- Confirming changed bank details by replying to the same email
- Criticising staff for reported mis-clicks – then nobody reports anymore
Checklist
- MFA on all mailboxes
- Four-eyes principle or call-back for payments and bank-detail changes
- Reporting route for suspicious messages known
- SPF, DKIM and DMARC checked for your domain
- Short phishing exercise at least once a year
Frequently asked questions
Does DMARC prevent phishing?
DMARC makes abuse of your own domain harder. It does not help against look-alike domains or compromised third-party mailboxes.
Do we have to set up SPF, DKIM and DMARC ourselves?
Not necessarily. Your email or IT provider can check and create the records.
What if a payment went to the wrong account?
Contact the bank immediately and request a recall. Our guide on invoice fraud describes the next steps.
Sensible next step
Make it a rule that every change of bank details is confirmed by calling a known number.
Sources
- Bundesamt für Sicherheit in der Informationstechnik (BSI)
- Allianz für Cyber-Sicherheit (BSI)
- DMARC.org
- CISA – Cybersecurity and Infrastructure Security Agency
Checked on 6 Oct 2026.
General orientation – does not replace an individual security review, legal or data-protection advice.