What to do if clients receive fake invoices that look like they're from you

Ask a client to send you the fake email as an attachment (.eml or .msg), not a forward, so the original headers survive. In the headers, look at the Authentication-Results line: spf, dkim and dmarc results of 'pass' for your domain mean the message was sent through your authorized systems, usually your real mailbox. 'Fail' or 'none' suggests spoofing. Also check the Return-Path, Reply-To and the 'Received' chain for servers you don't use.

Compare against your own Sent Items and message trace in Microsoft 365 or Google Workspace. If the invoice was sent from your account, it will show there, unless the attacker deleted it, which the audit log can reveal.

Warn clients by phone for the ones most at risk (those with open invoices), and by a short email from a clean account for the rest. Keep it factual and don't speculate about cause before you know it.

Suggested wording: "We've learned that some clients have received invoices or payment instructions that appear to come from us but did not. Our banking details have not changed. Please don't pay any invoice with new banking details without calling us at the number you already have on file. If you've made a payment you're unsure about, contact your bank right away and let us know."

• Block sign-in, revoke sessions, reset the password and MFA methods for the affected account.
• Look for inbox rules hiding client replies, external forwarding and suspicious app consents.
• Use the audit log and message trace to find every message the attacker sent and every mailbox item they accessed.
• Treat it as a possible privacy breach: the attacker may have read personal information in the mailbox.
• Full admin sequence: What to do if a Microsoft 365 account is hacked. Business email compromise investigations: Business email compromise response.

DMARC (defined in RFC 7489) lets you publish a policy telling receiving mail servers what to do with messages that claim to be from your domain but fail SPF and DKIM alignment. A policy of p=none only monitors; p=quarantine sends failures to junk; p=reject tells receivers to refuse them. Many organizations sit at p=none for years, which leaves the domain open to exactly this kind of fraud.

Move to enforcement carefully: make sure every legitimate service that sends as your domain (your email platform, accounting software, CRM, newsletters) is covered by SPF and signs with DKIM, review DMARC aggregate reports, then step up to quarantine and reject. M3AAWG publishes industry best practice for this rollout. Step-by-step: Rolling out DMARC from p=none to p=reject.

If the fraudster registered a domain that looks like yours, DMARC on your domain won't stop them; they control their own. Record the lookalike domain, report it to the registrar's abuse contact and to the hosting or email provider it uses, and report the fraud attempt to the Canadian Anti-Fraud Centre at reportcyberandfraud.canada.ca. Consider registering obvious variants of your own domain, and monitoring for new registrations that resemble it.

If any client paid, ask them to call their bank immediately. Questions about who bears the loss are for your lawyer and insurer; call our 24/7 line at (289) 582-9930 to establish the facts first.