The short answer
No single product solves it. Attackers steal passwords, deliver malware, impersonate executives and redirect payments, so combine technology and process in five layers:
- Authenticate your domainSPF, DKIM and DMARC, so others cannot easily send as you.
- Protect accountsMFA, preferably phishing-resistant.
- Filter and inspectIncoming mail, links and attachments.
- Prepare your peopleTraining, simulations and easy reporting.
- Verify paymentsPayment and account changes confirmed through a separate channel.
1. Authenticate your email domain
Without it, anyone can send mail that appears to come from you to customers, suppliers or staff.
| Standard | What it does |
|---|---|
| SPF (Sender Policy Framework) | Lists the servers allowed to send for your domain |
| DKIM (DomainKeys Identified Mail) | Signs messages to prove they were not altered |
| DMARC (Domain-based Message Authentication, Reporting and Conformance) | Tells receivers what to do with failures, and reports to you |
Complete protection needs all three, set to reject inauthentic messages. Move DMARC gradually from "none" (monitoring) through "quarantine" to "reject", and protect domains you do not send from. Spoofed invoices using real company names are a common fraud route; a protected domain is harder to fake. Monitoring reports often reveal forgotten senders (newsletter tool, billing system, website form) to add before you enforce.
2. Protect accounts with strong MFA
Most compromises start with a stolen password. MFA stops many, but attackers beat common methods with push fatigue, token theft and machine-in-the-middle phishing, so security agencies recommend phishing-resistant FIDO options (security keys, passkeys). SMS codes beat nothing but risk SIM-swap fraud: avoid them for administrators and finance staff.
More detail: MFA steps
- Require MFA on every mailbox, with no exceptions for executives.
- Use phishing-resistant methods for administrators and finance staff first.
- Block legacy email protocols that bypass MFA.
- Enable number matching or similar protections if you use push approvals.
3. Filter and inspect incoming mail
Built into Microsoft 365 or Google Workspace or added separately, filtering should:
Sandbox attachments
And block risky file types.
Check links when clicked
Not only on delivery.
Flag outsiders
External senders and look-alike domains.
Spot impersonation
Of executives and known suppliers.
Block known bad
Malicious domains and IP addresses.
Filtering reduces volume but never catches everything. Staff in Nigeria increasingly read email on phones, where sender and link destination are harder to see, so mobile-friendly warnings and link rewriting help most.
4. Prepare your people
Staff are the last line of defence when filters miss, not the weakest link. Use simulations, training and clear procedures to verify and report suspicious messages. Give everyone a one-click report button, thank reporters (false alarms included) and never punish reporting a mistake.
More detail: training that works
- Keep training short, frequent and based on real examples, including QR-code phishing, fake invoices and messages imitating a bank or mobile wallet alert.
- Use simulation results to target coaching, not to shame.
- See building a security awareness training program.
5. Verify payments and account changes out of band
Business email compromise (fake requests to change banking details, pay urgent invoices or buy gift cards) often involves no malware and may come from a real, compromised supplier mailbox.
- Call a known number (not one in the email) before changing a supplier's or employee's bank details.
- Two people approve payments above a set amount, including transfers from a mobile banking app.
- Urgency, secrecy and new payment instructions are warning signs.
- Your incident plan covers phishing and payment fraud: who calls the bank at once if money has moved and, if personal data was exposed, who assesses reporting to the Nigeria Data Protection Commission (NDPC) within 72 hours.
Email security checklist
- SPF published and accurate for all sending services
- DKIM signing enabled for our domain
- DMARC in place, with a plan to move from "none" to "reject"
- Unused domains protected against spoofing
- MFA on every mailbox; phishing-resistant MFA for admins and finance
- Legacy authentication blocked
- Attachment sandboxing and time-of-click link checks enabled
- External sender warnings turned on
- One-click phishing report button available to all staff
- Callback verification required for banking changes
- Incident plan covers compromised mailboxes and payment fraud
Limitations
These measures reduce risk, not remove it: DMARC does not stop look-alike domains, and training fades without reinforcement. Review controls yearly and when a new service sends email for you. Not legal advice: check reporting duties with your legal adviser; see ngCERT and the NDPC for official guidance. Our email security service sets up authentication, filtering and account protection; cybersecurity awareness training prepares staff. On Microsoft 365, see our security baseline.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Nigeria's national computer emergency response team, ngCERT
- #StopRansomware, Cybersecurity and Infrastructure Security Agency (CISA)
- NIST Cybersecurity Framework, National Institute of Standards and Technology (NIST)
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.