How Email Spoofing Leads to Invoice Fraud and CEO Impersonation

The most expensive email attacks against businesses rarely involve malware or clever hacking. They involve a short, plausible message that appears to come from someone the recipient trusts, asking them to do something they do every week: pay an invoice, update a supplier’s banking details, or process an urgent transfer for the CEO. The FBI’s Internet Crime Complaint Center recorded $2.77 billion in business email compromise losses across 21,442 reported incidents in 2024. Understanding how these attacks work is the first step in knowing which defences actually stop them.

The four ways criminals impersonate you

People often use “spoofing” to describe every kind of email impersonation, but there are four distinct techniques. They look similar to the victim and require completely different defences.

An honest security provider will show you that table. DMARC decisively stops the first row, and that row matters: it is the version that is most convincing, costs the criminal nothing, and works against every client, supplier and employee who knows your address. It is also the one you can close completely with a DNS policy.

How invoice redirection works

A typical payment redirection attack follows a predictable script.

1. Reconnaissance. The criminal learns who your clients or suppliers are, often from your website, LinkedIn, or a previously compromised mailbox elsewhere in the chain.
2. The message. An email arrives from what appears to be your accounts department, often timed near month end. It says your bank account has changed and attaches a letter on convincing letterhead.
3. Urgency. A follow-up asks whether the payment has been processed, adding pressure and discouraging a phone call.
4. The payment. Your client updates the banking details and pays the next invoice into the criminal’s account. Neither side knows until you chase the unpaid invoice.

When the first message comes from your exact domain, the client has no visible reason to doubt it. Without an enforced DMARC policy, many receiving servers will deliver it, because you have not told them otherwise.

How CEO impersonation works

CEO fraud turns the same technique inward. A message that appears to come from a director asks someone in finance to make an urgent, confidential payment, often while the director is supposedly travelling or in a meeting and cannot be reached. The request exploits hierarchy and urgency together.

Criminals use whichever variant works. If your domain is not enforced, exact spoofing is easiest. If it is enforced, they fall back to display name tricks from free email accounts, or to lookalike domains, which are more likely to be noticed by a careful reader. Enforcement does not end the threat, but it forces attackers onto routes that are easier to spot.

What an enforced DMARC policy changes

At p=reject, a message claiming to come from your domain that fails authentication is refused by the receiving server during delivery. It never reaches the inbox, the spam folder or anyone’s attention. This protects:

• Your clients, from payment requests forged with your address.
• Your suppliers, from fake purchase orders and remittance advice.
• Your own staff, from internal impersonation that arrives from outside.
• Your brand, because your domain stops being a free tool for criminals.

At p=none, none of this happens. We explain why in why monitoring-only DMARC is a false sense of security.

Closing the gaps DMARC does not cover

Lookalike domains

Register the most obvious variants of your domain yourself, particularly other extensions and common misspellings, and give them a reject policy and an SPF record that authorises nothing. Mail filtering that flags newly registered or similar-looking domains adds another layer.

Display name spoofing

Configure your mail platform to label messages from external senders, and to warn when an external message uses the name of someone in your organisation. Microsoft 365 and Google Workspace both support this.

Compromised mailboxes

Enforce multi-factor authentication on every mailbox, watch for suspicious inbox rules that forward or hide mail, and remove access promptly when staff leave.

Process controls

The strongest defence against payment fraud is not technical at all. Any change to banking details should be confirmed by phone on a number already on record, never on one supplied in the email. Tell your clients that you will never change banking details by email alone, and put that statement on your invoices. Many South African banks also offer account verification services that confirm an account holder before a new beneficiary is paid.

Frequently asked questions

MailMarq
MailMarq is a managed DMARC service run from Johannesburg. Our team has built and managed business websites, hosting and email infrastructure for South African companies since 2016, and writes these guides from work on real domains.