Business email compromise in practice: what DMARC stops, what it does not, and what Defender for Office 365 adds

The scam, as the police describe it

In May 2026 the Singapore Police Force published an advisory on business email compromise (BEC). Since 1 January 2026, at least 66 cases had been reported, with losses of at least $19 million. The pattern: criminals pose as colleagues or vendors, either from spoofed addresses or from vendor mailboxes they have taken over, and announce that the vendor's bank details have changed. Victims usually notice when the real vendor asks where the payment is.

The advisory recommends, among other things, training staff to treat bank detail changes as a red flag, verifying changes through a different channel, checking sender addresses for lookalike domains, enabling two-factor authentication, and implementing DMARC.

That list is useful because it shows the attack has several variants. Each one needs a different control.

Four variants, four controls

The last row is the uncomfortable one. A perfectly authenticated email from your real vendor can still be fraud. No filter knows that the bank account in the PDF is new. Only a process does.

Get DMARC done first

DMARC on your own domains stops criminals from sending as you, to your staff and to your customers. The path from p=none to p=reject is described step by step in DMARC for Singapore companies. Two BEC-specific additions:

• Parked domains, the ones that never send mail, are favourite spoofing targets. Give them v=spf1 -all and p=reject now.
• Check whether Exchange Online honours the DMARC policy of other domains. In the anti-phishing policy, HonorDmarcPolicy should be on, with spoofed messages sent to quarantine or junk according to the sender's policy.

What Defender for Office 365 adds

Exchange Online Protection (EOP), included in every Exchange Online plan, brings spoof intelligence, honouring DMARC and first-contact safety tips. Impersonation protection and mailbox intelligence need Defender for Office 365 Plan 1 or higher, included for example in Microsoft 365 Business Premium. The settings live in the anti-phishing policy:

Connect-ExchangeOnline
Set-AntiPhishPolicy -Identity "Anti-phishing - finance" `
  -EnableTargetedUserProtection $true `
  -TargetedUsersToProtect @("Jane Tan;jane.tan@example.com.sg","Ravi Kumar;ravi.kumar@example.com.sg") `
  -TargetedUserProtectionAction Quarantine `
  -EnableOrganizationDomainsProtection $true `
  -EnableTargetedDomainsProtection $true `
  -TargetedDomainsToProtect @("vendor-one.example","vendor-two.example") `
  -TargetedDomainProtectionAction Quarantine `
  -EnableMailboxIntelligence $true `
  -EnableMailboxIntelligenceProtection $true `
  -MailboxIntelligenceProtectionAction MoveToJmf `
  -EnableFirstContactSafetyTips $true `
  -EnableSimilarUsersSafetyTips $true `
  -EnableSimilarDomainsSafetyTips $true `
  -EnableUnusualCharactersSafetyTips $true `
  -HonorDmarcPolicy $true

• User impersonation: protect the people whose names get abused: management, finance, the people who approve payments. Senders with a similar display name or address are caught.
• Domain impersonation: your own domains are covered by EnableOrganizationDomainsProtection. Add your most important vendors and banks as custom domains. That is where lookalikes do the most damage.
• Mailbox intelligence: learns who each user normally corresponds with and flags senders that look like a known contact but are not.
• Safety tips: small banners such as "You don't often get email from this sender". They cost nothing and make people pause.

Start with the action MoveToJmf (junk folder) for a week and look at what gets caught, then move the high-value targets to Quarantine. Impersonation rules produce false positives at first, typically with a vendor whose name resembles your own.

Two more settings that cost little:

# Mark external senders in Outlook
Set-ExternalInOutlook -Enabled $true
# Block known lookalike domains for the whole tenant
New-TenantAllowBlockListItems -ListType Sender -Block -Entries "examp1e.com.sg","example-sg.com" -NoExpiration

Close the doors attackers use after the first email

Many BEC cases start with a compromised mailbox inside the company: the attacker reads along, learns which invoices are due and sets up a rule that hides the vendor's replies. Look for exactly that.

# Inbox rules that forward, redirect or delete
Get-EXOMailbox -ResultSize Unlimited | ForEach-Object {
  Get-InboxRule -Mailbox $_.UserPrincipalName -ErrorAction SilentlyContinue |
    Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo -or $_.DeleteMessage } |
    Select-Object MailboxOwnerId, Name, Enabled, ForwardTo, RedirectTo, DeleteMessage
}
# No automatic forwarding to external addresses unless explicitly allowed
Set-HostedOutboundSpamFilterPolicy -Identity Default -AutoForwardingMode Off

On large tenants the loop over every mailbox takes a while. Run it as a scheduled job and compare the results with last week's. Add multi-factor authentication through Conditional Access for every user, with phishing-resistant methods for administrators. See Conditional Access in phases.

The control no filter replaces

Write down one rule and make it non-negotiable: a change of bank details is confirmed by phone, using a number from the vendor master data or the contract, never from the email that asks for the change. Then make it easy to follow. A short form in finance, a second person who approves, and a "report phishing" button in Outlook that people actually use. Cyber Essentials A.4.4 (j) asks for exactly that last point: employees report suspicious emails immediately.

Checklist

• DMARC on all domains, parked domains on p=reject
• HonorDmarcPolicy on in the anti-phishing policy
• User impersonation protection for management, finance and payment approvers
• Domain impersonation for your domains plus key vendors and banks
• Mailbox intelligence and safety tips on, actions reviewed after a week
• External sender tagging in Outlook
• Known lookalike domains blocked in the Tenant Allow/Block List
• Automatic external forwarding off, inbox rules reviewed regularly
• MFA for everyone, phishing-resistant for administrators
• Bank detail changes verified by phone with a known number, with a second approver
• A report button that people use, and feedback when they do