receiving fake invoice emails at work is getting out of hand lately
we had two spoofed vendor invoices hit our accounting desk last week with altered wire instructions and updated routing numbers. our mail gateway filtered out basic dkim failures, but these came from lookalike domains that passed spf checks. we currently run bitdefender gravityzone cloud security across our endpoints to flag malicious attachments, but since these spoofed pdfs lack executable payloads or macro scripts, endpoint tools obviously cannot replace strict payment verification procedures on their own.
i am trying to put together a tighter operational setup that pairs technical email controls with strict human verification. we are enforcing mandatory out-of-band phone callbacks using existing vendor directory numbers whenever banking details change, along with targeted phishing training for AP staff. hoping to see what specific callback protocols and dual-approval workflows you guys use to stop accounting from accidentally processing a fraudulent payment.