Many London SMEs rely on the spam filter that came with their email platform and assume the job is done. Spam filtering removes bulk junk, but it does little against a single convincing message from a supplier, or from a director’s mailbox that a criminal has taken over. One security vendor’s guidance attributes over 90% of successful cyber incidents to email-based attacks, which makes the gap beyond the filter a board-level concern. This article sets out the controls a small business should have in place before winter, when year-end payments and seasonal staff changes create more openings for fraud. For a wider view of how these controls fit into managed support, see iTO.London.
Table of Contents
- Quick Takeaways
- Why Spam Filters Leave Gaps
- Business Email Compromise and Spoofing
- Email Authentication with SPF, DKIM and DMARC
- Microsoft Defender for Office 365 and Layered Controls
- Monitoring, Response and MFA Before Winter
- Frequently Asked Questions
- References
Quick Takeaways
| Key Insight | Explanation |
|---|---|
| Treat spam filtering as a baseline | Phishing and impersonation emails often contain no malware and no bulk pattern, so they pass filters without difficulty. |
| Publish SPF, DKIM and DMARC for every sending domain | These records allow receiving servers to reject mail that claims to come from your domain but was not sent by you. |
| Move DMARC from monitoring to enforcement | Start with p=none to collect reports, then quarantine, then reject once all legitimate senders pass. |
| Require multi-factor authentication on every mailbox | Multi-factor authentication limits the damage from passwords obtained through phishing, including shared and former staff accounts. |
| Verify every bank detail change by phone | Payment redirection is the most common financial outcome of business email compromise. A call to a number already on file stops it. |
| Name an owner for mailbox alerts | An alert that nobody reviews provides no protection. Define who responds, who can suspend an account, and how quickly clients are told. |
Why Spam Filters Leave Gaps
Spam filters score messages against sender reputation, known malicious patterns and malware signatures. They are designed to remove volume, not to judge whether a request is genuine. A message that asks for a change of bank details, arrives from a plausible address and contains no link or attachment can pass cleanly.
Three threat types sit largely outside the filter’s model: business email compromise, where an attacker takes over or convincingly imitates a real mailbox; spoofing, where the sender domain is forged; and credential phishing pages hosted on newly registered domains. Fortinet’s cyberglossary describes email security as protecting against phishing, malware and data breaches, which is a wider remit than spam control alone.
Pro tip: Ask your IT provider to show the full mail flow for one recent invoice email, including every check it passed. This makes the gap visible within a few minutes.
Business Email Compromise and Spoofing
A typical payment fraud follows a set pattern. An attacker compromises or imitates a supplier mailbox, waits for an invoice cycle, then sends a request to change bank details. Finance staff act on it because it looks routine.
Controls that stop a payment change
Three process controls address this directly: a call-back to a number already held on file, dual approval for any change to supplier bank details, and a rule that no payment change is actioned from email alone. These controls work regardless of how capable the filter is.
Impersonation of directors is a second route. Staff should treat urgent requests to move money or share credentials as a warning sign that requires a second channel to confirm. Festive and year-end periods, when invoice volumes rise, give attackers useful cover.
A control that depends on a person noticing something unusual will eventually fail. A control that requires a second channel to confirm money movement is far more reliable.
Email Authentication with SPF, DKIM and DMARC
These three DNS-based standards let receiving mail servers check whether a message genuinely came from the domain it claims. SPF lists the servers permitted to send for your domain. DKIM attaches a cryptographic signature, and DMARC tells receivers what to do when checks fail and sends reports back to you. Cisco’s guidance on deploying these standards notes that SPF must be configured correctly before DMARC planning can succeed.
Sequencing the rollout
Start with an inventory of every service that sends mail for your domains, including accounting software, CRM platforms, marketing tools, scanners and printers. A missed service causes legitimate mail to fail once enforcement begins. Publish SPF and DKIM first, then DMARC with p=none so that reports arrive without blocking anything.
Pro tip: Keep a shared record of every domain and sending service. Authentication failures most often occur when a new tool is added and nobody updates the DNS records.
Moving DMARC to enforcement
Review reports over several weeks, correct legitimate senders, then move to quarantine and finally to reject. The DMARC.org best practice guidance states that DKIM keys should be at least 1,024 bits long, and that shorter keys are often ignored by receivers. Use the strongest key length your platform supports.
Microsoft Defender for Office 365 and Layered Controls
For organisations on Microsoft 365, Defender for Office 365 adds protection beyond the standard filter, including scanning of links and attachments and detection of impersonation. Microsoft publishes plan details on its product page. The right plan depends on how many users need advanced features and whether you need investigation tools, so confirm current licensing with your supplier before purchasing.
Settings that are often left at default
Impersonation protection only works when you list executives and key finance contacts. Safe Links and Safe Attachments need policies that cover every user, not a pilot group. Alert policies must notify someone who will act on them.
Pro tip: Review impersonation protection targets each quarter. Staff changes in finance and leadership are a common reason for protection gaps.
| Approach | What It Addresses | Main Limitation |
|---|---|---|
| Standard spam filtering | Bulk spam and known malware | Does not assess the intent of a convincing request |
| SPF, DKIM and DMARC | Forged sender domains | Does not stop attacks from a genuine, compromised mailbox |
| Defender for Office 365 with impersonation protection | Malicious links and attachments, impersonation of named staff | Needs configuration and named users, and depends on the licence tier |
| Managed monitoring and response | Alert triage and early detection of mailbox takeover | Requires agreed service levels and a named accountable provider |
Monitoring, Response and MFA Before Winter
Multi-factor authentication for every mailbox
Stolen passwords remain a common route into business mailboxes. Multi-factor authentication for every account, including shared and former staff mailboxes, limits the damage from a password obtained through phishing. Review legacy sign-in methods that bypass multi-factor authentication and disable them wherever applications allow.
Defining response before an incident
A mailbox takeover is usually detected through unusual sign-in activity or new forwarding rules, rather than through a report from the sender. Document who receives alerts, who can suspend an account, and how clients and suppliers are informed. Where personal data is involved, breach reporting duties may apply, and the ICO publishes guidance on the subject.
A tabletop exercise once a year, using a realistic scenario such as a fake supplier invoice, shows whether these steps work in practice. Most gaps found in these exercises concern ownership rather than technology.
Frequently Asked Questions
Is a spam filter enough for a small business?
No. A spam filter reduces unwanted volume, but it does not verify whether a request is genuine. Business email compromise and spoofing require authentication records, process controls for payments and multi-factor authentication.
Do we need DMARC if we already have SPF?
Yes. SPF alone does not tell receiving servers what to do with a message that fails, and it does not provide reporting. DMARC adds a policy and reports, which show who is sending mail using your domain.
Does Defender for Office 365 replace staff training?
No. Defender reduces the volume of malicious messages reaching staff, but some requests will still look legitimate. Staff need to know the verification steps for payments and credential requests.
How long does DMARC enforcement take?
The timeline depends on how many services send mail for your domain. Reviewing reports over several weeks is a sensible planning assumption before moving to a stricter policy.
What should a business do first?
Begin with a list of every system that sends email, then confirm multi-factor authentication and payment verification. These steps are low cost and address the most common losses before winter.
We would welcome your experience of how your business verifies payment change requests, so please share what has worked well or caused difficulty in your organisation.