Almost every expensive incident at a small business starts in an inbox. Not with a break-in, with a convincing message and an ordinary person having a busy morning.
When people picture a cyberattack they picture ransomware: a locked screen, a demand, a dramatic bad day. It is vivid, it makes the news, and it is not the thing most likely to take money out of a small business in western Kentucky.
The more common and more expensive version is quieter. Somebody’s password gets phished. The attacker signs in, changes nothing, and reads mail for a few weeks. They learn who your suppliers are, how your invoices are worded, who approves payments, and when the owner travels. Then they wait for a genuine invoice, alter the bank details, and send it from inside a real conversation. A real employee approves a payment that looks entirely legitimate, and the money is gone.
There is nothing to restore afterward. No backup helps, because no data was destroyed. Recovery depends on how quickly the banks are called, and the odds are not good. This is why we treat email as the highest-value place to spend security effort in a small business, ahead of almost everything else.
The good news is that the controls that stop it are mostly cheap or free, and several take an afternoon. Multi-factor authentication, blocking external forwarding, publishing domain authentication records, alerting on new inbox rules, and a written rule that bank detail changes are verified by phone. None of that is exotic. Most businesses simply have never had anyone sit down and turn it on.
What Arrives in the Inbox
None of these require the attacker to be sophisticated. They require you to be busy.
A real invoice arrives, from a real supplier, in a real thread, with the bank details changed. The attacker has been reading the mailbox for weeks and picked the moment. Nothing about the email looks technically wrong because nothing about it is, and the money leaves by wire before anyone notices.
A message from an address one character off the owner’s, sent to the person who handles payments, marked urgent and explaining that the sender is in a meeting and cannot take a call. It works because it exploits hierarchy and hurry rather than technology.
A convincing Microsoft or bank sign-in page hosted on a domain registered two days ago. The password gets captured, and increasingly so does the multi-factor code, relayed in real time. One harvested password is the entry point for everything above.
Without an enforcing DMARC policy, anyone on the internet can send email claiming to be from your domain and much of it will be delivered. Your customers receive fraudulent invoices apparently from you, and your reputation absorbs the damage.
What We Put in Place
Ranked roughly by how much risk each one removes per dollar spent.
Filtering ahead of the mailbox that goes beyond bulk spam: impersonation detection, newly registered and lookalike domain checks, link rewriting so URLs are inspected at the moment of the click, and attachment sandboxing that opens files somewhere safe first.
SPF, DKIM, and DMARC published correctly and moved to enforcement in stages, so the rest of the internet can tell your real mail from an impersonation. It also improves the deliverability of your legitimate email, which is a pleasant side effect.
Enforced on every account, with app-based or hardware factors preferred over SMS. This one control stops the large majority of account takeovers, and it is still missing or optional at a surprising number of businesses.
External auto-forwarding blocked tenant-wide, and alerting whenever a new inbox rule appears. Attackers create hidden rules to divert or delete their own traces, so a rule nobody remembers making is one of the most reliable early warnings there is.
A written rule that any change to bank details is verified by phone, to a number you already had, never a number in the email. It costs nothing, it is not technology, and it defeats the single most expensive attack aimed at small businesses.
Short, frequent, specific training plus simulated phishing, and a culture where reporting a mistake is routine rather than embarrassing. The damage almost always happens in the hours between the click and the confession.
Independent backup and retention of mailbox data, because Microsoft replicates rather than backs up and its retention windows are short. Also what you need when a lawyer or a regulator asks for two years of mail.
When an account does get taken over, speed decides the outcome: sessions revoked, credentials reset, malicious rules removed, and a review of exactly what was accessed and who needs to be told. We handle that same-day for clients.
SPF, DKIM & DMARC
Three records that let every mail server on the internet tell your real messages from someone impersonating you. Rolled out in four stages so nothing legitimate breaks.
Your mail platform is not the only thing sending as your domain. Accounting software, appointment reminders, marketing tools, and your website contact form all count.
A complete SPF record listing legitimate senders, and DKIM signing enabled so each message carries a signature that proves it came from you unaltered.
Start with a policy of none so nothing legitimate breaks, then read the reports. This is where the forgotten sender nobody remembered always surfaces.
Once the reports are clean, tighten the policy to quarantine and then reject. From that point impersonating your domain becomes very hard for anyone.
The reason this gets skipped is that the middle step is unglamorous. You publish the records, then you wait and read reports, and you discover that your appointment reminder system and your accountant’s invoicing tool have both been sending as your domain for six years and nobody knew. Working through that list is the actual job, and it is why incomplete DMARC setups are so common: somebody started it, hit the messy part, and left the policy in monitoring mode forever.
If You Only Do One Thing
Every item on this list is either free or nearly free, and together they eliminate most of the realistic ways a small business loses money through email. None of them require new software, a project, or a budget cycle.
If you want to check where you stand before calling anyone, start with two questions. Is multi-factor authentication genuinely enforced on every mailbox, including the owner and the person who handles payments? And can a compromised account silently forward every message to an outside address? Those two answers predict most outcomes.
We will run this check for free and give you the findings in writing, whether or not you hire us. It pairs with our broader cybersecurity work and with the tenant hardening on our Microsoft 365 page.
FAQ
They are three records you publish in your domain settings that together tell the rest of the internet how to recognize real mail from your business. SPF is a list of the servers allowed to send as your domain, so a receiving mail server can check whether a message came from one of them. DKIM adds a cryptographic signature to each message so it can be proven the content was not altered and genuinely came from you. DMARC is the instruction that ties the two together and tells other mail servers what to do when a message fails those checks: ignore it, put it in spam, or reject it outright. It also sends you reports on who is attempting to send mail as your domain. Published properly, these three make it very difficult for anyone to convincingly impersonate your business by email.
Business email compromise is when an attacker gets into a real mailbox at your company, usually with a stolen password, and then uses it patiently. They do not encrypt anything or announce themselves. They read mail quietly for weeks, learn who pays what to whom and how invoices phrase things, and then intercept a genuine transaction and change the bank details. Sometimes they set an inbox rule that hides their own replies from the mailbox owner. It is worse than ransomware for small businesses in one specific way: there is nothing to restore. The money left by wire transfer, the transaction was authorized by a real employee, and recovery depends entirely on how fast the banks are called. The FBI has tracked this as one of the costliest categories of cybercrime for years, and it is overwhelmingly aimed at small and mid-sized companies.
It handles ordinary bulk spam competently. It is weaker against the targeted messages that actually cost businesses money: a single carefully written email to your bookkeeper, with no attachment and no obviously malicious link, sent from a lookalike domain registered two days ago. Nothing about that message is technically malicious, which is exactly why generic filtering struggles. Layered filtering adds impersonation detection, lookalike domain checks, link rewriting so a URL is checked at the moment it is clicked rather than when it arrived, and attachment sandboxing. We also configure the tenant-level protections that Microsoft ships turned off, which is a separate and equally important piece of the job.
You have done the single most valuable thing, and no, you are not finished. Multi-factor authentication stops the great majority of password-based account takeovers, which is why it is the first thing we enable everywhere. Attackers adapted: they now use prompt fatigue, pushing approval requests repeatedly until somebody taps accept to make it stop, and phishing pages that relay your code in real time. The follow-up controls that matter are conditional access rules that restrict where sign-ins can happen from, blocking external auto-forwarding, alerting on new inbox rules, and using app-based or hardware factors rather than SMS codes where possible. MFA is the foundation, not the roof.
That is precisely the job of SPF, DKIM, and DMARC, and it is the piece most small businesses have either never configured or configured incompletely years ago and never revisited. Without an enforcing DMARC policy, anyone can send mail claiming to be from your domain, and it will often reach the recipient. That is how your customers get invoices that appear to come from you, and how your own staff get requests that appear to come from the owner. We publish the records, start DMARC in a monitoring mode so nothing legitimate breaks, review the reports to catch systems you forgot send mail as you, and then move the policy to enforcement. It also improves deliverability of your legitimate mail as a side effect.
It helps, provided it is short, frequent, and specific rather than an annual hour-long video. What moves the needle is showing people the scams actually aimed at businesses like theirs, running simulated phishing so they get a safe chance to fail and learn, and above all making it socially safe to report something rather than quietly hope it was nothing. The most damaging incidents we see are not the initial click, they are the four hours between the click and the moment somebody admits it. A workplace where reporting is routine detects problems in minutes. Pair that with a written rule that bank detail changes are always verified by phone to a known number, and you have removed most of the risk.
It is part of running IT properly, which is why it is built into our IT services in Murray, KY and our managed IT plans. See also cybersecurity and backup and disaster recovery.
We will check your domain records, multi-factor coverage, forwarding rules, and filtering, and send you the findings in plain English. No obligation.
Murray, KY 42071 • Serving Calloway County and western Kentucky
Ready to Transform Your Technology?
Let’s discuss how we can help streamline your IT infrastructure, improve security, and accelerate your business growth with our comprehensive technology solutions.
Ready to discuss your technology needs? Our team of experts is here to help you find the perfect solution for your business. Contact us today for a free consultation.
Phone
(270) 807-1000Service Area
Murray, KY & Western Kentucky — Remote Support Available Nationwide
Support Hours
24/7 Emergency Support
For urgent technical issues or emergency support, our team is available 24/7 to ensure your systems stay operational.