Email remains a way for fraudsters to reach your employees. What has changed is the quality of the attacks. Messages riddled with typos and sketchy attachments haven’t gone away, but they now sit alongside flawless, AI-written emails, sometimes backed up by a phone call in what sounds exactly like your CEO’s voice.
Small and mid-sized businesses have ways to reduce these risks. Here is what we recommend in 2026, from email configuration to procedures for verifying payments.
The threats to know about
- AI-generated phishing: error-free messages tailored to your industry and to the tone of your real conversations, produced at scale. Good grammar is no longer a reliable tell.
- Business email compromise (BEC): a fraudster poses as a supplier or executive, often from a genuine hijacked account, to redirect a payment.
- Synthetic voice and video: a call or voicemail imitating a boss to back up an urgent wire transfer request.
- Session theft: some phishing kits capture both the password and the sign-in token, getting around traditional multi-factor authentication.
Authenticate your domain: SPF, DKIM and DMARC
These three DNS records help recipients identify email that impersonates your domain. They also help your legitimate messages reach the inbox.
- SPF lists the servers allowed to send on behalf of your domain.
- DKIM signs your messages to prove they weren’t altered in transit.
- DMARC checks whether a passing SPF or DKIM result aligns with the domain shown in the message’s From address. The domain’s policy tells recipients how the sender wants failing messages handled and where to send the requested reports.
The key is to progress in stages. Start with a DMARC policy of p=none to observe, long enough to identify every legitimate service that sends on your behalf (newsletters, invoicing, CRM). Then move to p=quarantine, and finally to p=reject once everything is properly aligned. The p=none policy is for observation: it does not request quarantine or rejection of messages that fail the checks.
Protect identities: MFA, conditional access and passkeys
A compromised account can give an attacker access to company email. Multi-factor authentication (MFA) is essential, but not all methods are equal. SMS codes and one-tap push approvals can be defeated by a patient attacker or by session theft.
In 2026, aim for phishing-resistant authentication: passkeys, Windows Hello for Business or hardware security keys. They are bound to the real website and simply won’t work on a fake sign-in page. Start with admin accounts and anyone who approves payments.
Stronger authentication is one layer of protection. Device security and session protection also matter, because a compromised device can expose an already authenticated session.
In Microsoft 365, conditional access rounds things out: block legacy authentication, require compliant devices, restrict risky sign-ins and limit access from countries where you don’t do business.
Strengthen Microsoft 365 security
Microsoft 365 configuration deserves a review. Here are the settings to examine to strengthen account and email protection:
- review the protections included in your Microsoft 365 licences and determine whether Defender for Office 365 features such as Safe Links and Safe Attachments are appropriate, then confirm the required plan and configure the policies for your environment;
- block automatic forwarding of email to external addresses, a favourite attacker technique;
- watch for suspicious inbox rules being created;
- clearly tag messages that come from outside the organization;
- restrict users from consenting to third-party apps;
- keep the number of admin accounts to a strict minimum.
Processes that stand up to fraud
Technology won’t catch everything. A fraudulent email sent from a supplier’s hijacked account can get past the filters. That is where your processes take over.
Any request to change banking details gets verified with a phone call to a number you already have on file, never the one in the email.
Apply the same rule to urgent transfer requests, even when they appear to come from leadership, and even if a familiar voice confirms them over the phone. Consider a verbal passphrase or dual approval for larger payments.
Staff training has to keep pace with the threats: short, regular sessions, realistic phishing simulations and, above all, a culture where reporting a suspicious email is praised, never blamed.
Plan for backups and incident response
Define how your business will recover email and collaboration data after an incident. Confirm the content covered by the chosen backup service and test the types of recovery your team may need. See our Microsoft 365 backup guide for the questions to ask.
You also need a simple, written incident response plan that people actually know about: who to call, how to reset a compromised account and revoke its sessions, how to notify clients and partners, and what reporting obligations apply when personal information is involved. The day of an incident is not the time to improvise.
These measures work together. Email configuration and account protection reduce technical risks; payment verification helps identify fraudulent requests even when they look credible. Backups and an incident response plan prepare the team to act if an incident happens despite those precautions.
Email security is a core part of our managed IT services. To review your organization’s current protections, contact us for an assessment.
