Email security that stops invoice fraud
New York construction and design firms move a lot of money by email: invoices, pay applications, and payments to subcontractors and consultants. That makes them a common target for fake invoices and spoofed messages. We set up the email protection and the simple payment checks that stop them.
How payment fraud usually happens
Most fraud does not involve hacking a bank. It involves convincing someone at your firm to send money to the wrong place.
- An email that looks like it came from a subcontractor asks to update their bank details before the next payment.
- A partner's email account is taken over and used to send invoices from a real address.
- Your domain has no email authentication, so anyone can send mail that appears to come from your firm.
- A fake invoice arrives in the middle of a real project, for a plausible amount, at a busy moment.
- Staff have no rule for verifying a change in payment details before sending money.
- Nobody notices a hidden forwarding rule copying one mailbox to an outside address.
What we put in place
Technology that catches most fake messages, and a simple process for the ones that get through.
Email filtering
Scanning for phishing, malicious links and harmful attachments before messages reach the inbox.
Impersonation protection
Warnings on messages that imitate your partners, clients or vendors, including lookalike domains.
SPF, DKIM and DMARC
Email authentication on your domain, so others cannot easily send mail pretending to be you and your real mail is more likely to be delivered.
Account protection
Multi-factor authentication and sign-in monitoring, so a stolen password does not hand over a mailbox.
Mailbox rule checks
Watching for hidden forwarding and inbox rules, a common sign that an account has been taken over.
Payment verification process
A simple written rule for your accounting team: any change to payment details is confirmed by phone, using a number you already had.
How we get started
Most of this goes in without changing how your team uses email.
- Step 01
Review
We check your domain's email authentication, your filtering, how accounts are protected, and how your firm currently approves payments.
- Step 02
Protect accounts
Multi-factor authentication and sign-in monitoring go on every mailbox first, because a taken-over account defeats most other controls.
- Step 03
Lock down the domain
We set up SPF, DKIM and DMARC in stages, monitoring before enforcing, so legitimate mail keeps flowing.
- Step 04
Set the payment rule
We help you put a short verification process in writing, and walk your accounting staff through what to look for.
Who this is for
Firms that send or receive significant payments by email.
A strong fit if:
- You pay subcontractors, consultants or suppliers regularly
- Invoices and pay applications arrive by email
- You have never set up DMARC on your domain
- Someone at your firm has received a suspicious payment request
- Payment detail changes are accepted without a call-back check
What you won't have to worry about:
- Wondering whether a change in bank details is real
- Clients receiving fake invoices sent in your firm's name
- A mailbox quietly forwarding copies to an attacker
- Deciphering SPF, DKIM and DMARC records
- Explaining a lost payment to a subcontractor
Why ELMIDA
We treat payment fraud as a business problem with a technical side, not the other way around.
Technology and process
Filters catch most fake messages. A simple call-back rule catches the rest. We set up both.
Email authentication done carefully
SPF, DKIM and DMARC are rolled out in stages, so your legitimate mail keeps arriving while spoofing gets blocked.
Account takeover focus
Many fake invoices come from real, compromised mailboxes. Multi-factor authentication and sign-in monitoring close that door.
Built around how AEC firms pay
Pay applications, subcontractor payments and consultant invoices are exactly the workflows attackers imitate. We start there.
Microsoft partner
Protection configured inside Microsoft 365, where your email already lives, by a Microsoft partner.
Part of your wider security
Email protection sits alongside endpoint protection, backups and access control, managed by the same provider.
What firms ask before getting started.
Ready to talk about your firm's technology?
Schedule a consultation. We'll review your environment, identify any gaps, and give you a clear picture of what proper IT looks like for a firm like yours. No obligation. No pressure.