Business Email Compromise and Invoice Fraud: Practical Protection

Protecting against business email compromise and invoice fraud takes two layers, and neither replaces the other. The technical layer is SPF, DKIM, and DMARC with a p=reject policy so nobody can send mail as your domain, two-factor authentication on every mailbox, especially finance and management, and an immediate alert whenever an auto-forwarding rule is created in any mailbox. The procedural layer matters more: never change a supplier's IBAN based on an email. Confirm it with a phone call to the number already on file from when you signed with that supplier, never the number written in the message. That single rule defeats most fraud attempts, because the fraudster controls the email but not the real supplier's phone.

How the Fraud Usually Happens

The most common scenario needs no advanced hacking and plays out in stages:

1. The fraudster gains access to an employee's mailbox at the supplier or at your company, usually through a fake login page that captured the password.
2. For weeks they do nothing but read and learn who pays whom, when invoices go out, and how both sides write.
3. They add an auto-forwarding rule that moves any message containing words like "invoice" or "transfer" to a hidden folder or an outside address, so the mailbox owner never sees the replies.
4. When a real invoice is due, they send a message in the same tone: "Our bank account has changed due to an internal review, please transfer to the new IBAN," with a PDF that looks identical to the original invoice.
5. Finance sends the money, and nobody notices until the real supplier asks about the payment days later.

A simpler variant needs no breach at all: a lookalike domain such as examp1e.sa instead of example.sa, or direct spoofing of your domain if DMARC does not protect it. FBI reporting consistently ranks this fraud among the costliest cybercrimes, with losses in the billions of dollars every year, and a single incident at a mid-sized company often runs from tens to hundreds of thousands of riyals.

SPF, DKIM, and DMARC: Stop Your Domain Being Spoofed

These three records tell mail servers worldwide who may send as your domain and what to do with forgeries:

Record	Purpose	Example
SPF	List of servers allowed to send	v=spf1 ip4:203.0.113.10 include:_spf.provider.sa -all
DKIM	Digital signature proving the message was not altered	Public key at selector._domainkey.example.sa
DMARC	Policy on failure, and where reports go	v=DMARC1; p=reject; rua=mailto:dmarc@example.sa

Do not jump to p=reject on day one, or you may block your own legitimate mail from a service you forgot about, such as the billing system or a marketing tool. The safe path has three stages:

1. Two weeks on p=none with rua reports, to learn every source sending as you.
2. Two weeks on p=quarantine; pct=25, then raise the percentage gradually to 100.
3. p=reject once every legitimate source passes SPF or DKIM.

To check your domain right now:

dig +short TXT example.sa | grep spf
dig +short TXT _dmarc.example.sa
dig +short TXT default._domainkey.example.sa

Getting these records right also improves how often your legitimate mail lands in the inbox at government entities and banks, whose filters are increasingly strict with anything lacking DMARC. DMARC protects your own domain from spoofing, but it does nothing against a lookalike domain the fraudster owns or a genuinely compromised mailbox at the supplier, which is why you need the next layers.

Two-Factor Authentication and Forwarding Rule Alerts

A password alone is no longer enough for a mailbox that receives invoices. Turn on two-factor authentication everywhere, starting with finance, senior management, and anyone who approves transfers. An authenticator app beats SMS, and a physical security key beats both because it resists phishing pages that steal codes in real time.

The second layer is watching auto-forwarding rules, the clearest trace a fraudster leaves behind. On a mail server running Dovecot with Sieve, you can periodically search for any rule that redirects to an outside address:

# Find redirect rules to addresses outside your domain in every mailbox
grep -rl "redirect" /home/*/sieve/ 2>/dev/null | while read f; do
  grep -H "redirect" "$f" | grep -v "@example.sa"
done

Run this daily through cron and send the output to whoever handles IT. Large cloud mail platforms offer ready-made "forwarding rule created" alerts, so turn them on. Also block automatic forwarding to external addresses at the domain level unless someone has written approval, since most employees never need it.

Lookalike Domains: The Risk DMARC Cannot Stop

Once your domain is well protected, the fraudster switches to a cheaper plan and registers a domain one or two characters away from yours, such as swapping the letter l for the digit 1, adding a hyphen like example-sa.com, or changing the extension from .sa to .com.sa or .co. Registering one costs under 50 SAR, and they can set up SPF and DKIM on it correctly, so it sails through filters.

Defend against this from three directions:

• Register the closest variants of your domain yourself, at least the main extensions and the most obvious typos. The yearly cost is trivial next to a single fraudulent transfer.
• Turn on a clear external-mail tag on your server that prefixes the subject with something like "[External]" for any message from outside your domain, so employees notice when "the CEO" is writing from outside the company.
• Monitor new registrations carrying your brand name through Certificate Transparency log monitoring, since most fraudsters issue an SSL certificate for their fake domain within hours of registering it.

None of this needs a big security budget, yet it closes the route fraudsters turn to once the technical ones are shut.

Phone Verification Before Any Transfer

This is the line a fraudster cannot cross no matter how convincing the message. Write it down as formal finance policy rather than advice:

• Any request to change bank details for a supplier or employee requires a phone call to the number recorded in the supplier file at contract time, never the number in the message or its signature.
• Two people approve the change: whoever received the request, and a second finance officer who reviews the call record.
• The first payment to a new account is held for 48 hours, or sent as a small amount the supplier confirms by phone.
• Any "must be today" request, or a senior executive asking for a confidential transfer, is automatically treated as a red flag, because urgency and secrecy are the fraudster's main tools.

The call takes 3 minutes, while a stolen transfer is rarely recovered if the report comes more than 24 to 48 hours later. If a transfer has already gone out, call the bank immediately to request a recall, then report it to the authorities.

Training the Finance Team With Clear Steps

Generic "security awareness" training fades within a week. What sticks is a short list tied to the person's daily work. Train finance and procurement on five signs:

1. Any change to bank details, whatever reason is given.
2. A sender address that differs by one character, so open the details rather than trusting the display name.
3. Unusual urgency or a request for secrecy.
4. An attachment in an unexpected format, or a "view invoice" link that asks you to log in.
5. Replies going to a different address than the sender (Reply-To).

Keep the training practical with a simulated invoice-themed phishing email every quarter, measuring how many people reported it versus how many engaged with it. The goal is to raise reporting rather than punish mistakes, since an employee afraid of punishment hides the error, and hiding it is worse than the error itself.

Your Email on Infrastructure You Control

Part of protection is knowing where your mail is stored and who can reach it. CLOUD's managed cloud hosting includes email accounts on servers in Riyadh, from 10 accounts on the Starter plan at 2,900 SAR a year up to 50 accounts on the Professional plan at 5,750 SAR, with daily and weekly backups included, so a message deleted after a compromise can be restored for the investigation. If you need a private mail server under your full control, you can build one on a cloud server with root access.

Your Plan for Next Week

1. Check your domain's SPF, DKIM, and DMARC records, and start DMARC on p=none with reports today.
2. Turn on two-factor authentication for finance and management mailboxes within 48 hours.
3. Write the phone verification policy, have the finance manager sign it, and share it with the team.
4. Review every existing auto-forwarding rule and delete any you cannot explain.
5. Schedule the first simulated phishing email for 30 days from now.