Email fraud protection
Make it harder for a fake email to move your money.
Fake invoices and changed bank details cost small businesses real money. We tighten the email settings that matter, look for signs someone is already inside, and set a simple rule for confirming any payment change by phone.
The problem, and what we do about it
The usual story goes like this. Someone gets into one mailbox, or sends from an address that looks almost like yours or a vendor's. They wait for an invoice or a closing, then send new bank details. The email looks real because it often comes from a real account.
No single setting stops all of that. Domain settings called SPF, DKIM, and DMARC make it harder for strangers to send email as your exact domain, but they do not stop lookalike addresses, a vendor whose account was taken over, or someone who already has a password. So we work on three fronts. The email settings, the accounts themselves, and the habit of confirming every payment change by calling a number you already have.
Business email compromise is one of the costliest kinds of fraud the FBI tracks, year after year. National numbers say nothing about any single business, so we start with your own setup.
Who it's for
Honest on purpose, so nobody wastes a call.
A good fit
- Businesses that send or receive invoices, wires, or ACH payments
- Accounting and law firms, real estate and title offices, and trades companies paying suppliers
- Anyone who has had a close call with a fake invoice or a changed bank account
Not a fit
- Getting money back that has already been sent. Call your bank right away, then see the hacked page
- Full management of email systems other than Microsoft 365. For those we check the domain settings and tell you what to ask your provider
What you get
Written down so there are no surprises on the quote.
What's included
- SPF, DKIM, and DMARC checked for your domain, with changes made or listed for whoever controls the records
- Two-step login checked on every mailbox, with phishing-resistant sign-in like passkeys or security keys where they fit
- Admin accounts reviewed so only the right people hold them
- A search for suspicious forwarding and inbox rules, the trick used to hide replies
- Sign-in and sharing settings reviewed in Microsoft 365
- A written payment-change rule. New or changed bank details are confirmed by calling a number already on file, never one from the email
- A short staff session on fake invoices, payment changes, and what to do after a click
What it's not
- A promise that fraud can't happen. These steps lower the risk, they don't remove it
- Changes at your bank or payment platform, which you make with them
- Legal or insurance advice
- Microsoft license upgrades, if a feature needs one
What it costs
New services are quoted after a short review, so the price fits your setup instead of a guess. You get a fixed price in writing before any work starts.
| What | Price |
|---|---|
| Email fraud protection review and fixes | Quoted after a short review |
| Free email and domain security check | Free |
| Staff training session | $150 remote, $250 on-site |
| Microsoft licenses | Paid to Microsoft at their price |
See the price for this on the pricing page
The quote covers the mailboxes and domains we agree on. If a protection needs a different Microsoft 365 plan, we say so before anything is bought.
What it depends on
- Access to your domain's DNS settings, or the person who controls them
- Admin access to your email, approved by the owner
- Some protections need a particular Microsoft 365 plan
Next step
Run the free email security check, then book a 15-minute call to go over the result.
How it works
Simple on purpose. You always know what's next and what it costs.
A 15-minute call
Tell us what's going on. We'll tell you honestly if we're a fit.
A quick look
A short visit or a remote session so we see your setup for real.
A fixed price in writing
What we'll do, what it costs, and when. The price doesn't move.
Scheduled work
We book a time that doesn't shut your business down, then get it done. Reply times and support hours are on the service levels page.
Questions owners ask
We set up DMARC. Are we covered?
It helps with one thing, stopping strangers from sending as your exact domain once it is set to enforce. It does not stop lookalike domains, fake display names, a hacked vendor, or someone using a stolen password to send from your real account.
What is phishing-resistant sign-in?
A way to log in that a fake login page can't capture, like a passkey on your phone or a small security key. Microsoft 365 supports them. We suggest them first for owners, admins, and whoever handles payments.
What should staff do when a vendor emails new bank details?
Stop, then call the vendor on a number you already had, not one in the email, and confirm with someone you know. We write that rule down for your office and train everyone on it.
Someone already sent money. What now?
Call your bank right away and ask them to recall the payment, then report it to the FBI at ic3.gov. After that, call us and follow the steps on the hacked page.
What does it cost?
It depends on how many mailboxes and domains you have and what is already set up, so we quote it after a short review.
Sources we used
- FBI Internet Crime Complaint Center, annual reports
- Microsoft Learn, how DMARC protects your domain
- CISA, implementing phishing-resistant MFA
Public guidance we relied on for the facts on this page. None of it endorses Vektrion.
Ask a quick question, get a straight answer
Three fields. You hear back the same business day by text or email, whichever you give us.
Stop being your own IT person.
Tell us what's bugging you. In 15 minutes you'll know what it takes to fix and roughly what it costs.