Email fraud: what practitioners need to act on now

TL;DR: Email fraud costs small and mid-sized businesses an average of $286,000 per incident, according to At-Bay, and financial fraud frequency has jumped by 55% since 2021 as legacy email security misses lookalike domains, suspicious headers, and urgent payment scams. The control problem is not inbox filtering alone, but trust verification at the moment a payment request is acted on.

Editorial analysis by NHI Mgmt Group, based on content published by At-Bay: “Fraud Defense Turns One”.

By the numbers:

• Since 2021, financial fraud frequency has jumped by 55%.

Key questions

Q: What should teams do first when email fraud is slipping past inbox security?

A: Start by adding an out-of-band verification step for any request that changes payment details, requests a wire transfer, or pressures staff to bypass normal checks.

Q: Why do lookalike domains and urgent payment requests create such high fraud risk?

A: Because they combine sender impersonation with time pressure, which reduces the chance that staff will challenge the request.

Q: What are the signs that email trust controls are failing?

A: Repeated replies to suspicious requests, high forward rates, weak reporting discipline, and inconsistent escalation around vendor changes are all warning signs.

Practitioner guidance

• Implement out-of-band verification for payment changes Require a second channel check for any new wire instruction, banking detail change, or high-value transfer request before approval is granted.
• Tune detection for lookalike and newly registered domains Prioritise domain similarity, registration age, reputation history, and sender impersonation rules for messages that request money movement or sensitive changes.
• Add behavioural review to executive impersonation alerts Flag urgent requests, off-hours sending, unusual reply-to addresses, and language that discourages verification as case-review triggers.

Bottom line: Email fraud remains effective because it targets human approval workflows, not just email infrastructure.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →