the quiet fraud costing UK firms – Daily Business

Photo by Philip Oroni on Unsplash

Most finance teams in the UK have seen some version of it: a polite email from the managing director asking for an urgent transfer or a note from a long-standing supplier announcing new bank details. Nothing about the message looks broken. The logo is right, the tone is familiar and the sender name matches. That is why business email impersonation keeps working.

Much of this fraud borrows a real identity, and quite often the identity is your own domain. Without an enforced DMARC policy, attackers can spoof your visible From domain, while receiving systems must rely more heavily on their own authentication, reputation and anti-phishing controls to detect the attempt. Mailbox providers send daily reports listing the servers that use your name, and feeding them into a DMARC report analyser is often the first time a business sees unfamiliar senders acting on its behalf. Few firms look until money has already gone.

How the scams usually play out

The tactics vary, but most attempts fall into a handful of patterns that banks and police forces see again and again:

CEO fraud: A message appears to come from a director and asks finance staff for a confidential, urgent payment, often late on a Friday or while the real executive is travelling.

Invoice and mandate redirection: A supplier, builder or solicitor seemingly writes to say their bank details have changed, so the next genuine invoice is paid to the fraudster.

Exact-domain spoofing: The From address is identical to the real one because the targeted domain has no DMARC enforcement.

Lookalike domains: The criminal registers a near copy of the real name, with a swapped letter or an extra hyphen, which authentication on the genuine domain cannot block.

Compromised mailboxes: Attackers log into a real account, read past threads and reply within them. Because the message is sent through that legitimate account, it may pass standard SPF, DKIM and DMARC checks.

The last two are a useful reminder that no single control covers everything. Authentication protects the domain you own, while the process protects the payment.

Fraudsters also study timing. Month-end, quarter-end and the weeks before Christmas bring heavy payment volumes and stretched teams, so one more urgent request is easier to slip through.

Why it rarely makes the headlines

Ransomware takes systems offline and gets reported. Impersonation does neither. A payment leaves, the supplier chases the unpaid invoice a fortnight later, and the loss is often written off quietly rather than disclosed.

The figures that do surface are still sizeable. UK Finance recorded £41.3 million lost to invoice and mandate scams in 2025, £28 million of it from business accounts, plus a further £5.6 million to CEO fraud. Its report notes that these schemes typically rely on intercepted emails, compromised accounts or spoofed messages sent to finance staff.

For many companies, that money does not come back. The mandatory reimbursement rules introduced in October 2024 protect consumers, micro-enterprises and charities, so most businesses above that size carry the loss themselves unless an insurer pays out.

Government data points to the same conclusion. The latest cyber breaches survey found that 43% of UK businesses identified a breach or attack in the previous 12 months. Phishing was the most common type, and 12% of businesses said someone had impersonated their organisation. Those are only the incidents firms noticed.

Photo by Gustavo Fring on Pexels

 What SPF, DKIM and DMARC do

Email authentication is the technical layer that stops criminals from sending from your exact domain. There are three standards, and each does a different job.

StandardWhat it checksIts limitSPFWhether the sending server is authorised to send for the domainBreaks on forwarding and does not protect the visible From address by itselfDKIMWhether the message carries a valid cryptographic signatureA lookalike domain can sign its own mailDMARCWhether SPF or DKIM passes and aligns with the From domain, and what receivers should do if notOnly blocks spoofing once the policy goes beyond p=none

That last row is where many UK organisations fall short. They publish a DMARC record set to p=none and assume they are protected, yet that policy is monitoring-only. It does not request quarantine or rejection for DMARC failures, but receivers still apply their normal spam, reputation and security filtering.

Moving to the “quarantine” configuration and then to “reject” is the step that tells receivers to block spoofed messages. Gmail, Yahoo and Outlook.com require DMARC from bulk senders as well, so the record affects deliverability too.

The move needs care. Payroll platforms, CRMs, invoicing tools and marketing services often send as your domain, and if any of them are misaligned when you enforce, legitimate invoices start disappearing into spam folders.

For that reason, review your reports for at least two weeks and fix every legitimate source before tightening the policy. Expect several rounds of updates, particularly in larger businesses with years of forgotten sending services.

A practical checklist for finance and IT teams

Technical fixes and payment controls work best together. A sensible starting point looks like this:

Collect DMARC aggregate reports for every domain you own, including parked domains that never send mail, which should carry a reject policy.

Identify each legitimate service sending on your behalf and align SPF and DKIM for it.

Move from p=none to quarantine and then reject in stages, watching for new or failing senders.

Verify any change of bank details by calling a number from your own records, never one supplied in the email.

Require two people to approve new payees and payments above an agreed threshold.

Brief accounts payable staff on the pressure tactics fraudsters favour, especially urgency and requests for secrecy.

Business email impersonation succeeds because it looks routine. Firms that can see who is sending under their name and that check unusual payment requests by phone take most of the easy opportunities away from fraudsters.

#quiet #fraud #costing #firms #Daily #Business