How to spot impersonation and BEC emails in Microsoft 365

The most expensive email attacks on small and mid-sized companies don't carry a virus. They carry a plausible request - "can you update the bank details on this invoice", "I need you to buy gift cards for a client", "approve this payment before the end of the day" - from someone who looks like your CEO, your supplier, or your accountant. This is business email compromise (BEC), and the FBI's IC3 consistently ranks it among the costliest categories of cybercrime.

Because there's no attachment to scan, the defence is about reading the signals of identity. Here are the ones that matter.

1. Authentication: did the domain actually send it?

Every legitimate sender publishes records that let you verify the mail came from where it claims:

• SPF - is the sending server authorised for that domain?
• DKIM - is the message cryptographically signed by the domain?
• DMARC - does the visible "From" align with the authenticated domain?

A message that fails DMARC while claiming to be from a partner is a loud signal. The catch: these results live in raw headers most users never see.

2. Display-name and look-alike tricks

Attackers know you read the name, not the address. Watch for:

• Display-name spoofing - the name says "Jane Doe, CEO" but the address is a random Gmail.
• Look-alike domains - olyteck-secure.com instead of olyteck.com, or homoglyphs that swap a Latin letter for a near-identical Cyrillic one.
• Reply-to mismatch - the message shows your colleague's address, but replies quietly route to an attacker-controlled inbox.

3. The language of pressure

BEC has a tone. The classic pattern is authority + urgency + a money or data action: a senior name, a tight deadline, and a request to pay, change bank details, or send sensitive files.

If a message combines "I'm the boss", "do it now", and "move money or data", treat it as

guilty until proven innocent - regardless of how normal the address looks.

4. Links, QR codes, and the new tricks

Even without attachments, attackers route you to credential-harvesting pages via:

• Shortened or redirecting links that hide the real destination.
• QR codes in images ("quishing") that move the malicious link off the text where filters look.
• Lookalike Microsoft 365 login pages that capture your password and MFA code in real time.

Make the signals visible to non-experts

Here's the gap: all of the above is detectable, but it lives in headers and reputation data your finance manager will never open. The teams that resist BEC well do two things:

1. Surface the verdict in the inbox. A plain-language banner - "this sender failed authentication and resembles a known contact" - turns an invisible signal into a decision the recipient can actually make.
2. Make reporting one click. When someone is unsure, the fastest safe path is a "report" button that routes to whoever can act, rather than a forwarded email that gets lost.

A practical baseline

• Enforce SPF, DKIM and DMARC on your own domain (so partners can trust you too).
• Train staff on the authority-urgency-money pattern, with real examples.
• Add visible warning banners for external, failed-auth, and impersonation-suspect mail.
• Give people a one-click way to report, and a clear "verify by phone" rule for any payment or bank-detail change.

You will never catch every message - no product does, and any honest one will tell you so. But making the identity signals visible turns "looked fine to me" into "the banner said it failed authentication", which is exactly the moment a costly mistake gets stopped.