A customer telephoned our credit control team in October to check whether our bank details really had changed, because the email saying so had arrived from our own domain, in our own template, quoting a real outstanding invoice number. It had not come from us. Three customers had already paid. We recovered two of the payments and not the third, and the amount we did not recover was a little over forty four thousand pounds.
Every penny of our email security effort had been spent facing inwards. Filtering, attachment sandboxing, quarantine, a phishing awareness programme with a completion figure I could quote to the board. Nothing at all faced outwards, and outwards is where our customers are.
The technical position was ordinary and embarrassing. Our sender policy record listed eleven services and ended in a soft fail, which instructs the receiving world to accept mail that fails it anyway. Two platforms sent on our behalf without signing. There was no reporting policy published at all, which meant that in fifteen years nobody had received a single report about mail claiming to be from us, and there had been plenty.
Fixing it took four months, and almost none of that was configuration. It was finding out who sends mail as us. The answer was nineteen systems. Six were unknown to my department, including a recruitment platform bought by human resources in 2021 and an appliance in a depot that had been emailing dispatch notes since before I joined. Two were shut down. The rest were signed properly, the policy was published in reporting mode for ten weeks while we read what came back, then moved to quarantine, then to outright rejection in April.
The control that would actually have prevented the loss is not technical. Finance now verifies any change of bank details by ringing a number held on file before the request arrived, never a number in the message, and that rule applies to letters and phone calls as well. We also tell customers plainly, on the invoice itself, that we will never notify a change of account by email.
We had spent years protecting our staff from other people's email and nothing whatever protecting other people from ours. A domain's reputation is an asset. Ours had been lent out for fifteen years.
– Serguey Shinder
