A Secure Email System Does Not Mean Your Email Is Secure
This one doesn’t surprise me at all, but it’s worth talking about because a lot of business owners think they’re covered when they’re not.
There are technologies called DKIM and DMARC. As part of our managed services, when we have the access, we set those up on your email. What they do is authenticate your email system so that not just anybody can send emails that look like they came from you. It makes it harder for bad guys to fool your vendors or your customers by spoofing your domain. That’s great, and it works.
Why Authentication Alone Is Not Enough
The problem is this: if someone gets into your actual email account, none of that matters. The email they send is legitimate. It came from your real account, from your real domain. DKIM and DMARC look at it and say, yep, checks out. And it gets delivered. And it fools people.
How do they get in? Usually because there’s no MFA, no multi-factor authentication, and nobody’s watching the account. We run alerting systems that flag when an email account gets accessed from two different places at once, or accessed from one city and then a short time later from somewhere far away. If you check your email in Traverse City and then it gets checked in Bangladesh an hour later, something’s wrong and the system reacts. Most businesses don’t have anything like that.
So the bad guys get in, and now they’re sending emails from inside your legitimate, authenticated email account. The message inside that email may be completely fraudulent, but the email itself is real. It’s going to get delivered, and it’s going to fool people.
What You Actually Need to Have in Place
Start with DKIM and DMARC if you don’t have them. That’s the foundation. Then get an email monitoring system that watches for suspicious access patterns. Those two things together will take care of about 95% of your problems.
The remaining 5 to 10% comes down to your team, especially whoever handles accounts payable. Do not send a payment just because you got an email. Double-check it. And it’s even worse than that now, because you can’t just call the number on the email and assume you’re talking to the right person. The AI voice tools out there are convincing. You’ve seen what they can do with public figures, making it look and sound like someone it isn’t. They can do the same thing with the voice of whoever you think you’re calling. So verify through a separate channel, a number you already have on file, not one that came in the email.
Train your team. Make sure they know this can happen. We offer that training if you want to hand it off.
The short version: just because you have a secure email setup doesn’t mean your email is secure. Those are two very different things.
Questions about how this affects your setup? Schedule a free IT consultation and we’ll walk through it with you.
Wherever your team is based, ACS provides hands-on managed IT support — see how we help businesses in Traverse City & Northern Michigan.