Email security and payment fraud checklist

Payment fraud usually starts with email. A criminal gets into a mailbox or copies a supplier's address, then sends new bank details that look real. Underwriters know this, so most forms ask about email security and payment checks.

At claim time, the insurer will ask what your team did before the money left. Some policies limit cover when a required check was skipped. Work through this list with your finance team and your IT provider.

Secure the mailboxes

• Turn on multi-factor authentication for every mailbox.Include shared mailboxes and webmail. A screenshot of the settings proves it.
• Screen incoming email for harmful links and attachments.Most business email services offer this. A settings export or a statement from your email provider is good evidence.
• Tag emails from outside the company as external.A clear banner helps staff spot a fake message from "the CEO". Block Office macros from the internet at the same time.
• Keep mailbox audit logs for at least 90 days.Investigators use them to see what an attacker read and sent. Without logs, you will struggle to show what happened.
• Check mailboxes for forwarding rules nobody set up.Attackers often hide replies with a rule. Ask your IT provider to review rules regularly.

Protect your domain

• Publish SPF and DKIM records for your email domain.These tell other mail servers which senders really are you. Your IT provider can show you the records.
• Set your DMARC policy to quarantine or reject.A policy of "none" only watches. Underwriters can read this setting from outside, without asking you.
• Watch for websites and domains that copy your name.For example, a law firm might find a lookalike domain one letter away from its own. Some policies cover the cost of taking fake sites down.

Control every payment

• Verify bank detail changes by phone on a known number.Use a number from your own records, and record who called, when and the result.
• Check new suppliers before the first payment.Confirm the company exists and the account name matches. Underwriters ask about this check, so check your wording for any conditions.
• Require two approvers for payments above a set amount.Write the threshold into a policy and set it in your banking platform. A screenshot of the bank settings is strong evidence.
• Tell customers how you will share bank detail changes.Add a line to every invoice saying you never change bank details by email. This helps stop criminals diverting money owed to you.

Train the people who pay

• Give all staff phishing training at least once a year.Underwriters ask for a completion report. Add extra sessions for finance staff.
• Run simulated phishing emails every quarter.Track who clicks and who reports. A rising report rate shows the training works.
• Teach staff to pause on urgent payment requests.Fraudsters push for speed, often just before a weekend or holiday. A simple rule to call back first protects the business.

If money has gone

• Call your bank straight away and ask for a recall.The faster the bank acts, the better the chance of stopping the transfer.
• Notify your insurer through the channel your policy names.Many policies count only their incident line, app or a set email address. Telling your broker alone may not be enough.
• Report the fraud to the police or cyber crime unit.Many policies require a law enforcement report for cyber crime claims. Keep the reference number.
• Keep the emails, headers and payment records untouched.The insurer and investigators will need them, so leave the attacker's messages in place.

Broker's tip

Check which section of your policy pays when a staff member is tricked into sending money. Some cyber policies cover this social engineering loss, some cap it with a sublimit, and some leave it to a crime policy. Ask your broker to show you the section, and read the payment check wording with your finance lead. For a wider view, see what a cyber policy pays for.