Safeguarding Your Business Email from CEO Fraud and Invoice Redirection Scams

Summary

This guide helps you troubleshoot and resolve: Safeguarding Your Business Email from CEO Fraud and Invoice Redirection Scams. Follow the steps below to fix the issue.

Common Causes

CEO fraud and invoice redirection scams are sophisticated email attacks targeting Australian businesses. In these scams, cybercriminals impersonate a company executive, such as a CEO or Managing Director, or a trusted supplier to trick employees into transferring funds to fraudulent bank accounts. These emails often appear legitimate and create a sense of urgency to bypass standard security checks.

Recognising the Warning Signs

Attackers typically use specific tactics to deceive staff. Look for these common indicators:

• Requests for urgent payments or changes to supplier bank account details.
• Email addresses that look similar to a colleague's but contain slight misspellings or different domains.
• Messages sent from personal email accounts (e.g., @gmail.com or @outlook.com) claiming to be a company executive.
• Requests to keep the transaction confidential or to avoid discussing it with other staff members.
• Poor grammar or unusual language that does not match the sender's typical writing style.

Quick Fix Steps

If you suspect a fraudulent email, take these immediate actions:

1. Do not click any links or download attachments within the suspicious email.
2. Do not reply to the email or attempt to verify the request via the same email thread.
3. Verify the request through a separate, trusted communication channel, such as a phone call to a known number or an in-person conversation.
4. Report the email to your IT administrator or managed service provider.

Detailed Instructions

Verifying Sender Identity

Before actioning any payment request, verify the sender's identity using these steps:

1. Hover your mouse over the sender's name to reveal the full email address.
2. Check the email domain carefully. For example, [email protected] is different from [email protected].
3. If the email appears to come from an executive but uses a public domain like @gmail.com, treat it as a scam.
4. Contact the sender using a phone number already saved in your business contacts, not one provided in the email.

Securing Microsoft 365 Email

If your organisation uses Microsoft 365, enable these security features to reduce the risk of email compromise:

1. Sign in to the Microsoft 365 Admin Center.
2. Navigate to Security & compliance > Threat management > Policy.
3. Select the user account and ensure Multi-factor authentication is enabled.
4. Review Anti-phishing policies to ensure spoof intelligence and impersonation protection are active.

Securing Google Workspace Email

If your organisation uses Google Workspace, follow these steps to harden your email security:

1. Sign in to the Google Admin console.
2. Navigate to Menu > Security > Settings.
3. Ensure Two-factor authentication is enforced for all users.
4. Go to Gmail > Safety > Spam, phishing, and malware.
5. Configure strict delivery settings to quarantine emails that fail SPF, DKIM, or DMARC checks.

Preventative Measures

Implement these organisational controls to protect your business from financial loss:

• Establish a dual-authorisation process for all payments above a set threshold.
• Require verbal confirmation for any changes to supplier bank account details.
• Conduct regular security awareness training for all staff members.
• Implement DMARC, SPF, and DKIM records for your business domain to prevent email spoofing.
• Limit the amount of executive contact information published on your public website.

Tip: Always verify changes to payment details by calling the supplier on a previously verified phone number. Never use contact details provided within a request email.

Warning: If you have already transferred funds to a fraudulent account, contact your bank immediately to attempt a recall. Report the incident to ReportCyber via the Australian Cyber Security Centre at cyber.gov.au or call the ACSC hotline on 1300 CYBER1 (1300 292 371).

For further assistance with securing your business email or reviewing your current security configuration, Open a Ticket with our Brisbane support team.

Still Having Issues?