Email security and payment-redirection fraud protection

How payment-redirection fraud usually works

1. An attacker gets into a mailbox, often with a password stolen by phishing. Some register a look-alike domain instead.
2. They read quietly, learning who is due to pay whom and when.
3. Close to settlement or a trust account transfer, an email arrives with "updated" bank details. If it comes from the real mailbox, nothing about it looks wrong.
4. The money lands in the attacker's account and is moved on quickly.

The technical controls we apply

• MFA enforced by Conditional Access. A stolen password on its own no longer opens the mailbox.
• Legacy authentication blocked. Older sign-in methods that skip MFA are switched off.
• 24/7 identity monitoring. The SOC looks into risky sign-ins, such as a login from an unexpected country, at any hour.
• Mail protections reviewed. We check the mail settings in your Microsoft 365 tenant, including sender authentication records (SPF, DKIM and DMARC) and any rules that forward mail outside the practice, which attackers often create to stay hidden.
• Phishing simulation, so staff practise spotting a convincing lure.

The habit that stops the payment

Controls lower the odds. A verification habit stops the transfer even when the email is perfect. These are general good practices that many practices adopt:

• Confirm any new or changed bank details by phone, on a number you already hold. Never use a number from the email itself.
• Tell clients early in a matter that your bank details will never change by email, and ask them to call you if they get a message saying otherwise.
• Have a second person approve trust account transfers and any change to payee details.
• Treat urgency, secrecy and last-minute changes in a payment request as warning signs.

We can help you turn this into a one-page procedure for staff. It is general information, not legal advice. Your obligations for trust money come from the rules that apply to your practice.

If money has already gone

Call your bank straight away and ask it to try to recall the transfer. Hours matter. Then contact us so we can lock the affected account, revoke its sessions and work out how the attacker got in. The data breach readiness guide covers what comes next.