How to protect yourself from email interception fraud

Email interception fraud is one of the costliest scams for small businesses. Criminals get into a mailbox, quietly watch it, and then step in at exactly the moment money is about to change hands.

How it works

1. A criminal gets a password, usually through a phishing email or a password reused from another leaked account.
2. They log in through webmail and set up forwarders or filters that copy or hide emails about invoices, quotes and banking details.
3. They wait for a payment request. When one arrives, they hide the real email from you and send a copy with their own banking details, from your hijacked account or from a look-alike address.
4. The customer pays the wrong account and the money is usually gone within hours.

How to reduce the risk

• Use a strong, unique password for every mailbox and change them regularly. See How to create a strong password.
• Use SSL/TLS in your mail app settings. See Email server settings.
• Every few weeks, check your forwarders and filters, including the domain-wide ones, and delete any you do not recognise. See Forwarders and Filters.
• Keep your computers and phones updated and scanned for malware.
• Set up SPF, DKIM and DMARC so fake email from your domain is easier to block.
• Always confirm banking details by phone using a number you already have, never one from the email itself, before paying or changing a supplier’s details.

If you think it has happened

1. Change the mailbox password at once, and the passwords of any account that used the same one.
2. Remove unknown forwarders and filters.
3. Tell anyone you were corresponding with, so they do not pay to the wrong account.
4. If money was sent, phone your bank immediately and open a case with the police.
5. Contact us so we can help secure your domain.