Spotting phishing and business email compromise before it costs you

The most damaging attacks on small businesses rarely look dramatic. There is no obvious virus or locked screen – just a convincing email that persuades an employee to transfer money, change bank details, or hand over a password. This is business email compromise (BEC), and for many Israeli SMBs it causes larger direct losses than ransomware. Because it relies on deception rather than malware, it often slips past technical defenses and lands directly in front of a busy person.

What Business Email Compromise Looks Like

BEC takes a few recognizable forms. In CEO fraud, an attacker impersonates a manager or owner and asks an employee to make an urgent payment or buy gift cards 'quietly.' In invoice fraud, a real or spoofed supplier sends an invoice with new bank details, redirecting a legitimate payment to the attacker. In account takeover, a real mailbox is compromised and the attacker watches conversations, then inserts themselves at the moment a payment is due. The common thread is money or credentials, plus a sense of urgency that discourages double-checking.

Red Flags to Train Your Team On

Teach staff to slow down when an email combines money or sensitive data with pressure to act fast or stay discreet. Watch for sender addresses that are subtly wrong (a lookalike domain or a reply-to that differs from the display name), unexpected changes to bank or payment details, requests that bypass normal procedures, and unusual phrasing from a familiar contact. A link that asks you to 'log in to view a document' is a classic credential-harvesting trap – hover before clicking, and never enter your Microsoft 365 password into a page you reached from an email.

Technical Controls That Reduce the Risk

Awareness works best alongside technical safeguards. Enforce MFA everywhere so a stolen password is not enough to take over a mailbox. Configure SPF, DKIM, and DMARC on your domain so attackers cannot easily spoof your own company's address. Enable external-sender warning banners and anti-impersonation protection in Microsoft Defender for Office 365. Together these controls block a large share of attempts and flag the ones that get through.

Build a Verification Habit

The single most effective defense against payment fraud costs nothing: verify any change to bank details or any unusual payment request through a second, trusted channel – a phone call to a known number, not the contact details in the suspicious email. Make this an explicit, non-negotiable procedure so employees feel empowered to pause a payment without fear of overstepping. Attackers rely on urgency and authority; a calm 'let me confirm that directly' defeats most of them.

Closing the gap before it costs you

If you are not sure whether your domain is protected against spoofing or whether your team would recognize a well-crafted BEC attempt, that uncertainty is the gap attackers exploit. NetFortress helps Israeli SMBs lock down email authentication, configure Microsoft 365 anti-phishing controls, and run practical staff awareness – without the jargon. A short call with our team will give you a clear picture of where your business stands.