The scams that actually cost money don't touch your antivirus at all. They go through your finance team's willingness to be helpful.
How the con runs
An attacker spends a week or two doing ordinary research. The public supplier list on your website. Your bookkeeper's name and title from LinkedIn. The normal phrasing of your purchase orders. Then one morning finance gets an email from what looks like a long-standing supplier: new banking details due to a bank migration, please pay invoice 4471 here. Or it arrives as you, the CEO, urgent, needed before close of business, don't call me, WhatsApp instead. There's no attachment to scan and no link to sandbox. The email is just text, and the text is normal business. Your defences were built to catch code, and no code was involved.
What actually stops it
Procedures, mostly boring ones. Every change of banking details gets verified by phone to a number you already had on file, not the number in the email that announced the change. Payments over a threshold need two approvers who don't report to each other. And you train the team on one odd rule: urgency is the tell. A real supplier can wait one day. A CEO who demands you skip the callback is the sound of an attack.
The email layer underneath
All of this gets stronger when attackers can't even spoof your domain convincingly. SPF, DKIM and DMARC are DNS records that tell receiving mail servers what email from your domain is genuinely allowed to look like. Set them properly and forgeries either fail outright or land in spam instead of your customer's inbox. It's a one-time configuration job that keeps paying for itself.
Want to know if your domain is spoofable right now? Ask us. It's a five-minute check and we'll tell you exactly what a fraudster sees when they aim at your customers.