Business-email-compromise wire fraud attempt stopped at a nonprofit, and DMARC moved to p=reject
A nonprofit of about 25 staff with a small finance team, a leader in its segment.
- Scale
- 1 attempted wire of a grant-sized amount, 1 lookalike domain, 9 sending services found, 1 domain moved to p=reject
- Engagement
- 3 days to stop the attempt and trace it, 8 weeks to move DMARC from monitoring to reject
The challenge
A finance coordinator received an email that appeared to come from the executive director, asking her to send an urgent wire to a new vendor. The sender address was a lookalike domain, but the real domain had no enforced DMARC policy, so staff could not tell a spoofed message from a real one. She called the director before paying, and the wire was not sent. The board wanted to know how close it had been and how to stop a repeat.
What our team delivered
- Message trace and header review to confirm the lookalike domain, find which mailboxes received the same lure and rule out a compromised account
- Takedown requests for the lookalike domain and a block on it in mail flow, plus a sweep of sign-in logs for any related access
- DMARC reports analyzed for eight weeks: nine legitimate sending services (donation platform, newsletter, payroll and others) were found and set up with SPF and DKIM alignment
- DMARC moved in steps from p=none to p=quarantine and then p=reject, with SPF kept under the ten-lookup limit and a monitored mailbox for the reports
- A payment callback rule: any new vendor or change of bank details is confirmed by phone, using a number from the file, by a second person
- A one-page staff guide and a short exercise for the finance team and board treasurer
Result
The attempted wire was stopped before any money moved, and spoofed mail from the nonprofit's domain is now rejected by receiving servers that honor DMARC. Failed alignment on legitimate mail dropped from 14 percent to under 1 percent before enforcement, so no donor receipts were lost. The callback rule is written into the finance policy the board approved. This is an illustrative engagement that describes the kind of work our team does; details are composite.
Get this for your company
Related services with fixed prices and a written scope.
Insurance-ready bundle
The three things cyber insurers and clients ask for most: an external assessment, a phishing simulation for 25 users and a disaster recovery plan.
Assessment report in 5 business days; plan draft in 15 business days
$5,400 per bundle, phishing simulation for 25 users
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Show 3 more
Email security with AI detection and DLP
Inbound and outbound protection: phishing, malware and impersonation caught by AI detection, with data loss prevention for what leaves.
Live within 7 business days
$7 per mailbox, per month
Compromised-mailbox monitoring and alerts
We watch each mailbox for signs of takeover, such as odd logins, forwarding rules and mass sending, and alert you fast.
Live within 5 business days
$4 per mailbox, per month
Phishing simulation
A realistic, authorized phishing campaign with short training for anyone who clicks. Priced per person.
Campaign launches within 5 business days of approval
$12 per user, per campaign
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
DMARC: from watching to rejecting
Share of mail claiming the domain that passes DMARC (SPF or DKIM aligned), week by week. In the monitoring phase (p=none) reports reveal forgotten senders; each one gets SPF and DKIM fixed. Quarantine sends failures to spam, reject refuses them at the receiving server. Illustrative figures.
Mail that keeps flowing
Incoming mail is authenticated and scanned before it reaches anyone, mailboxes are copied across three regions so a server failure goes unnoticed, and outgoing mail leaves signed and encrypted.
Payment-change callback flow
A request to change bank details is never acted on from the request itself. Someone rings the number already on file, a second person approves, the outcome is written down, and only then is the payment released or held. If any step fails, the old details stay in use.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.