Email security protects more than messages. A compromised mailbox can expose stored documents, reset other accounts, impersonate executives and redirect invoices. The strongest defenses combine secure identity, trustworthy domain configuration, payment controls and a response plan that staff can execute quickly.
Harden every email identity
Require multifactor authentication for all users, prioritizing phishing-resistant security keys or passkeys where supported. Disable legacy authentication, use unique passwords and protect recovery channels. Administrators should use separate day-to-day and privileged accounts; shared mailboxes should have named members rather than shared credentials.
Review forwarding rules, delegated access, active sessions and third-party app permissions. Attackers often create hidden forwarding or inbox rules so they can monitor a conversation after a password is changed.
Authenticate the sending domain
| Control | Purpose | Operational note |
|---|---|---|
| SPF | Lists authorized senders | Avoid multiple SPF records |
| DKIM | Cryptographically signs mail | Rotate and protect keys |
| DMARC | Defines handling and reporting | Monitor before stronger enforcement |
These controls reduce domain spoofing but do not prove that every message is safe. Lookalike domains and compromised legitimate accounts can still pass authentication.
Interrupt payment fraud
Create a written rule: new or changed bank details require verification through a known telephone number or approved channel, never contact information supplied only in the suspicious message. Use two-person approval above a risk-based threshold. Display external-sender warnings and make reporting one click, but do not rely on banners alone.
Training should use current examples: urgent secrecy, changed payment instructions, fake document shares, QR codes, consent prompts and requests to bypass procedure. This is a core part of cybersecurity for accountants and other data-intensive firms.
Respond to a suspected takeover
- Contact the security team through a trusted channel.
- Revoke active sessions and risky application tokens.
- Reset credentials and strengthen MFA after preserving needed logs.
- Inspect rules, delegates, sent/deleted mail and sign-in history.
- Identify exposed data and fraudulent instructions.
- Notify banks, affected parties, insurer and authorities as appropriate.
- Document containment, recovery and required notifications.
If money was sent, contact the financial institution immediately. Speed can affect the possibility of recalling or freezing a transfer.
Measure exposure, not just training clicks
Track MFA coverage, legacy authentication, privileged accounts, unresolved DMARC failures, time to report simulations, time to revoke sessions and the percentage of bank-detail changes independently verified. A high reporting rate is healthy; it means employees surface uncertainty early.
Frequently asked questions
Does changing a password remove an attacker?
Not always. Existing sessions, application tokens, forwarding rules or delegated access may remain. Revoke sessions and inspect the account comprehensively.
Is SMS MFA better than no MFA?
Usually, but phishing-resistant methods provide stronger protection. Organizations should migrate higher-risk accounts first while keeping usable recovery procedures.
What should staff do with a suspicious email?
Do not click, reply or use its phone number. Report it through the approved channel, then verify the request independently if business action may be required.
Sources reviewed
- CISA: Recognize and report phishing
- CISA: Require multifactor authentication
- FTC: Start with Security
Last reviewed: August 15, 2026.