The wire fraud emails hitting Southwest Florida businesses don’t look like the examples in a security training deck. No misspellings, no urgent all caps subject line. What shows up instead is a reply inside a thread you were already having, from a domain that’s one letter off, with the right file number and the right signature block pasted at the bottom.
That version works. It works because email security in Fort Myers usually means one Microsoft 365 license and nothing else switched on. The FBI’s Internet Crime Complaint Center tracked more than $55 billion in exposed losses from business email compromise between October 2013 and December 2023, and the typical victim isn’t a bank. It’s a title company, a dental office, a contractor whose bookkeeper pays invoices every other Friday.
Four things stop most of it. Here they are roughly in order of how much fraud they block per hour of work.
Why email security in Fort Myers keeps breaking at the same spot
Almost every case starts identically. A password gets reused on some site that later got breached, the attacker signs into the mailbox, and then they do nothing. They read. Sometimes for weeks. They learn who approves payments, what your invoice template looks like, which vendor is due, how you sign off on emails. Then they wait for a real conversation about a real payment and step into the middle of it.
Nothing gets encrypted. There’s no ransom note, no locked screen, no obvious moment where you know you’ve been hit. The money leaves, and your bank has maybe 24 to 72 hours to recall it before it’s been split across three accounts and pulled out. Catch it the same day and you’ve got a decent shot. After that, usually not.
So a better spam filter doesn’t help much here. The filter is grading the wrong thing. That message came from a real mailbox with a real login, or from a lookalike domain the attacker registered two weeks earlier and configured properly so it passes every technical check on the way in.
Stop letting strangers send mail as you
Three DNS records decide whether some random server in another country can send email claiming to be from your domain. SPF lists who’s allowed to send for you. DKIM signs the message so it can’t be quietly altered in transit. DMARC tells the receiving server what to do when the first two fail.
Most small offices around here have SPF, about half have DKIM, and almost nobody has DMARC set to anything except p=none, which is the setting that means notice the problem and deliver the mail anyway. Moving to p=quarantine and then p=reject is the cheapest thing on this list. It costs you a DNS edit and a couple of weeks watching the reports so you don’t accidentally block your own QuickBooks notifications or your Constant Contact sends.
While you’re in there, turn on external sender tagging in Exchange so every message from outside your company carries a visible banner, and switch on impersonation protection for whoever touches money. Microsoft 365 Business Premium already includes both. Plenty of Naples and Bonita Springs offices are paying for Business Premium and running it on defaults, which is a bit like buying an alarm system and never arming it.
MFA, and the two ways attackers still get past it
Multifactor on every mailbox, no exception for the owner. That part isn’t controversial anymore. What people miss is that plain MFA has two well known holes.
The first is push fatigue. The attacker already has the password and just spams approval prompts at 2am until somebody taps yes to make it stop. Number matching kills that one, and it’s a toggle. We went through it in more detail in our post on MFA push bombing.
The second is session token theft, where a convincing fake login page relays your password and your MFA code to Microsoft in real time and walks off with the session cookie. Your MFA worked exactly as designed. The attacker is in anyway. Conditional access policies are what help here, and blocking sign ins from outside the US costs a business that operates in Lee and Collier counties basically nothing.
Then go check the mailbox rules. When somebody gets into an inbox, the first thing they usually do is create a forwarding rule that quietly copies every message with invoice or wire or ACH in it out to an address they control, plus a second rule that files replies from the real vendor into a folder nobody opens. Those rules survive a password reset. Resetting the password and leaving the rule in place is one of the most common mistakes we see after a breach, and it means the attacker keeps reading your mail for months.
The verification rule that beats any software you can buy
Every payment instruction that arrives by email gets verified by voice, on a number you already had before that email showed up. Not the number in the signature block. Not the number printed on the PDF. The one sitting in your accounting system from before this conversation started.
Write it down, make it policy, and tell your bookkeeper out loud that nobody will ever be in trouble for making a phone call. That last part matters more than the rule does. Most of these frauds land because someone junior didn’t want to annoy the boss by questioning an urgent request that appeared to come from the boss.
Pair it with training that isn’t the once a year video everybody clicks through. CISA publishes free material on recognizing and reporting phishing that works fine for a small office, and running a short simulated phish every month or two beats one long session in January. (We wrote about that separately in our piece on security awareness training.) If you want the specifics of how the wire fraud version plays out end to end, that’s covered in our business email compromise writeup.
Getting your email security sorted in Fort Myers
None of this is exotic. It’s three DNS records, a handful of toggles in Microsoft 365, a rule audit, and one written policy. The reason it doesn’t get done is that it’s nobody’s job at a 12 person company, and the settings are scattered across four different admin portals.
That part we handle. HenkTek works with small businesses across Fort Myers, Cape Coral, Bonita Springs and Naples on exactly this: DMARC rollout that doesn’t break your existing mail, conditional access, mailbox rule audits, and training people actually pay attention to. If you want somebody to look at what your domain is currently telling the world, get in touch or call (239) 234-2334. First conversation is free, and we’ll tell you straight if you’re already in decent shape.