How to secure business email against the usual attack
The attack that actually hits Indian businesses is invoice fraud by email. Here is how it works, the controls that stop it, and the spend that does not.
The attack is not what you are defending against
Business email is rarely broken into by someone clever. The common attack is plain. Someone obtains a password through a convincing login page, reads the mailbox quietly, waits for a conversation about a payment, then sends a message from that mailbox asking for bank details to be updated. The payment goes to them. Nothing was hacked in the way the word suggests.
The second version needs no access at all. An email appears to come from a director asking an accounts clerk to release an urgent transfer. It is well written, it names real people and it arrives at a plausible moment. Both succeed because the control that failed was a human process rather than a technical one.
What security software will not stop
No filter stops an instruction sent from a mailbox that is legitimately logged in. That is the central exclusion and why spending on an email security product before fixing the basics is wasted. Filters also struggle with lookalike domains, because mail from a domain differing by one character is technically valid. Nothing in email security covers a request arriving by WhatsApp or phone.
The costs here are mostly configuration rather than licence. Multi-factor authentication is included in business mail plans. Domain records cost nothing but a change in your DNS. What you spend is time, and if you pay someone to set up domain authentication then GST at 18% applies on the fee.
Who needs what
Every business that discusses payments by email needs the controls below. Exporters, agencies and anyone invoicing overseas clients are targeted more because the amounts are larger and the recovery window shorter.
Do not buy an email security gateway or a phishing simulation subscription while any mailbox still logs in with a password alone. The money is better spent on nothing until that is fixed, because the gateway does not address the failure used against you. Do not buy a separate product for a four-person business either. Your provider's included controls plus a payment verification rule will cover you and a vendor saying otherwise is selling. And do not run a staff phishing test before you have trained anyone. Testing people on what you never taught produces resentment and no improvement.
The controls that actually work
Start with multi-factor authentication on every mailbox with no exceptions, including shared accounts and the administrator account. Prefer an authenticator application or a passkey over codes sent by text, since a text can be intercepted by someone who has taken over a mobile number. Give the administrator a separate account for administration only. Close any mailbox belonging to a leaver rather than leaving it active for colleagues to check.
Then publish the three domain records. A sender policy record names which servers may send mail for your domain. A signing record lets receivers verify a message was not altered. A policy record tells receiving servers what to do with mail failing those checks and reports who is trying to send as you. Introduce the last in monitoring mode so you see your own legitimate senders before rejecting anything. Then audit mailbox rules. An attacker's first move after entry is usually a quiet forwarding rule, so look for rules nobody created and restrict forwarding to outside addresses.
Finally install the control that stops the actual loss. Any change to bank details, and any payment above a threshold you set, is verified by calling the counterparty on a number you held before the request arrived. Not a number in the email. Write the rule down and apply it to the managing director too.
How to tell whether it is working
The metric that matters is coverage. The proportion of mailboxes with multi-factor authentication switched on, which should be all, and the proportion of payment changes last quarter verified by callback. Both are countable and both are usually worse than the owner expects.
The metric that flatters is the volume of threats blocked. Any mail product reports large numbers of spam and malware stopped and that figure has no relationship to your exposure. It measures internet noise. A business with impressive block statistics and one unprotected shared mailbox is not protected.
The common mistake
Treating this as a purchase. A product is bought, a report is produced monthly, and the accounts clerk still updates a supplier's bank details because an email asked politely. Software cannot carry that decision. The callback rule breaks the attack and costs nothing, which is why it loses to something with an invoice attached.
The second mistake is the shared mailbox with a shared password. Accounts and support mailboxes end up with one password known to five people and written somewhere convenient. It cannot have meaningful multi-factor authentication, nobody can tell who sent what, and it survives every departure. Convert shared mailboxes into delegated access from individual accounts.
If money has already gone
Speed decides recovery. Contact your bank immediately and ask them to raise a recall with the beneficiary bank, since funds are often moved onward within hours. Report it to the police and through the national cybercrime reporting portal. Preserve the original emails with their full headers rather than forwarding them. Revoke active sessions on the affected mailbox. Recovery cannot be promised and the first hours matter more than everything after.
This guide explains how something works. It is not legal, tax or financial advice, and rules change. Confirm anything regulatory with a qualified professional before you act on it.