Imagine one of your best customers pays a $12,000 invoice. The email came from your address, used your logo and quoted a real job. The only difference was the bank details. You find out a month later, when you chase the payment and they say, “But we already paid you.”
For most small businesses, nothing stops that email from being sent. The good news: closing this gap is cheap, quick and mostly a one-off job.
The risk in plain terms
Your email address is like your company letterhead. Anyone can print a letter that looks like yours. What stops forgeries is that people can check whether it’s genuine. With email, that check only works if you’ve set it up. Many businesses never have.
This isn’t rare. In the Australian Signals Directorate’s Annual Cyber Threat Report 2024–25 factsheet for businesses, email-related fraud was the most common cybercrime reported by businesses, and the average reported cost for a small business was $56,600. That’s not an IT problem. It’s a cash flow problem.
What it can cost you
- Lost payments. A customer pays the scammer instead of you, and getting that money back is hard.
- Damaged trust. Customers start second-guessing every email you send. Some quietly go elsewhere.
- Your real emails going missing. Gmail and Outlook increasingly check for these protections. Google’s sender guidelines have required basic checks since February 2024. Without them, your genuine quotes and invoices are more likely to land in spam, and you may never know.
The fix: three settings that prove an email is really yours
The protection comes from three settings with awkward names: SPF, DKIM and DMARC. You don’t need to remember them, just what they do together:
- SPF is your approved-sender list: which services may send email in your name.
- DKIM is a tamper-proof seal on each email.
- DMARC tells everyone else: “If an email claiming to be from us fails those checks, block it.” It also reports who is sending email using your name.
Together, they let your customers’ inboxes spot a forgery and bin it before anyone reads it. They’re settings on your web address, not software, and they don’t change how your staff use email.
They won’t stop lookalike addresses (like yourbusiness-au.com) or a stolen staff password. Two-step login handles that. But they close off the easiest and most convincing form of impersonation.
Don’t rush it
Technology added to an unprepared business makes things worse, faster. Switch on strict blocking without knowing every system that sends email for you (your invoicing software, booking system, website forms) and you can block your own invoices. The Australian Cyber Security Centre’s guide How to combat fake emails recommends a staged approach: watch first, then tighten gradually.
Where to start
- Ask the question. Ask whoever manages your email: “Do we have SPF, DKIM and DMARC set up, and is DMARC actually blocking fakes?” A vague answer usually means it hasn’t been done.
- List everything that sends email for you: inbox, invoicing, bookings, newsletters, website forms.
- Agree one simple rule. Any change to bank details is confirmed by phone, on a number you already have. This habit alone stops a lot of fraud.
- Turn on two-step login for every mailbox.
Email protection is part of our IT & Cyber Security service. If you’re not sure what tools you have running in the first place, a Business Review is a sensible first step.
Let's make sure your business is protected
Not sure whether a scammer could send invoices in your name today? That's exactly what we help small businesses sort out, in plain English, without breaking anything that already works.
Book an initial call with Three Bulls →Tell us what you're using and what worries you, and we'll tell you where you stand and where to start.