The three ways scammers impersonate a business
The first is spoofing your exact domain, sending email that claims to be from [email protected] without having access to your systems. The second is a lookalike domain, such as yourbusiness.co or yourbusinness.co.nz, registered cheaply and set up to send email that passes a quick glance. The third, and most convincing, is using one of your real mailboxes after stealing a staff member's password. Each needs a different defence. Many businesses only think about one of them, which leaves the others wide open. A sensible plan covers all three.
It helps to know which one you're facing, because customers will describe all three the same way: 'we got an email from you asking us to pay a new account'. Ask them to forward the message with its full headers, or at least tell you the exact sender address. That small detail usually shows straight away whether the scammer is using your real domain, a lookalike or one of your actual mailboxes.
Block exact-domain spoofing with DMARC
Set up SPF and DKIM for every service that sends email from your domain, then publish a DMARC record and move it gradually to a policy of reject. Once that's in place, major email providers will refuse or quarantine messages that pretend to come from your exact domain but didn't come from your systems.
This takes some planning, because you need to find every legitimate sender first, from your accounting software to your website contact form. But once it's done it quietly blocks a whole category of fraud against your customers. Check your DMARC reports occasionally afterwards, as new services get added over time.
Watch for lookalike domains
Lookalike domains are cheap and quick to register. Scammers swap letters that look similar, add a hyphen or extra word, or use a different ending such as .com, .co, .net or .nz instead of .co.nz. They then use the lookalike to send invoices or payment changes to your customers, often after reading a real conversation.
Consider registering the most obvious variations of your domain yourself, especially the .nz, .com and .co versions if you don't already own them. Some domain monitoring services alert you when similar domains are registered. If you find a lookalike being used for fraud, report it to the registrar and warn your customers.
Protect your real mailboxes and your domain account
The most damaging impersonation uses your real email account, because every technical check passes. Strong multi-factor sign-in on every mailbox, including shared and admin accounts, prevents most of these takeovers. Alerting on new forwarding rules and unusual sign-ins helps catch the rest early. Don't forget the domain registrar account itself. Anyone who controls it can redirect your website and email entirely. Use a strong unique password and MFA on the registrar login, make sure it belongs to the business rather than a former staff member or web developer, and turn on registrar lock where available to prevent unauthorised transfers.
Tell customers what to expect from you
The best defence for your customers is knowing your rules. Tell them, on invoices, in your email signature and on your website, that your bank details won't change by email, and that you'll always confirm any change by phone. Explain which addresses you send invoices from, and that you won't ask for payment by gift card or cryptocurrency. Repeat the message periodically, especially at busy times such as the end of the financial year or before Christmas. A customer who remembers your rule is far more likely to pause and call when a fake request arrives.
When scammers use your brand elsewhere
Impersonation isn't limited to email. Scammers create fake social media pages, fake listings on marketplaces, fake job adverts and fake text messages using your business name. Search for your business name now and then, and ask staff to tell you if they spot anything odd. Report fake pages to the platform using its impersonation reporting process, and post a short notice on your genuine pages if customers are being targeted. If customers have lost money, encourage them to report to their bank and the police, and keep a record of what you've seen.
If customers are already being targeted
Act quickly and openly. Send a short, clear message to customers explaining that scammers are using your name, what the fake messages look like, and what to do if they receive one. Don't include links in the warning; ask them to contact you using details they already have. Then work out which method the scammers are using. Check DMARC reports for spoofing, search for lookalike domains, and review your own mailboxes for signs of compromise. Fix the route they're using, and report the activity to the NCSC so others can be warned.
In short
- Impersonation comes via spoofing, lookalike domains or hacked mailboxes.
- DMARC at reject blocks exact-domain spoofing.
- Register obvious lookalike domains and watch for new ones.
- Secure your domain registrar account with MFA and registrar lock.
- Tell customers your bank details never change by email.