DMARC, SPF and DKIM protect your exact domain. The DMARC standard says it can only be used to combat specific forms of exact-domain spoofing, and that it does not address visually similar domain names or the display name people see in their inbox [1]. A DMARC pass only shows that the sender was allowed to use that domain [1]. Someone who registers a near-copy of your domain owns that copy, so they can set up its email and its own checks, and those messages can pass.

The FBI says scammers use slight variations on legitimate addresses so a fake account looks real [2]. The FTC says a scammer sets up an email address that looks like it’s from your company [3]. This falls under business email compromise, which the FBI’s Internet Crime Complaint Center (IC3) describes as a scam aimed at businesses that work with suppliers or regularly send wire transfers, carried out through tricks or break-ins to move money without permission [4]. The common version is a fake invoice, or a note saying a vendor’s bank account has changed.

The official advice is mostly about habits.

• Verify by phone. The FBI says to verify payment requests in person or by calling, using a number you look up yourself, not one the message gives you [2]. It also says to confirm any change in account number or payment procedure with the person making the request [2]. IC3 says to use a secondary channel to verify account change requests [5].

• Train staff. The FTC recommends teaching staff to spot phishing as part of regular training [3].

• Turn on outside-sender warnings. In Microsoft 365, external sender identification adds an External label to messages from outside your organization [6]. Microsoft’s first contact safety tip warns people when they get email from someone they don’t usually hear from [7]. Microsoft’s domain impersonation protection, part of Defender for Office 365, looks for domains slightly similar to yours, but no domains are protected until someone adds them [7]. In Google Workspace, external recipient warnings are on by default and show a banner when someone replies to an outside sender [8].

• Report the domain. ICANN, which oversees domain registrars, says to report phishing domains to the registrar first [9]. Registrars must take reasonable and prompt steps to investigate abuse reports [10].

• Act fast if money moves. IC3 says to contact your bank right away to request a recall and to file a complaint at ic3.gov [5].