A message asks your accounting team to change a payment destination. The display name matches a familiar client or vendor. The address is almost right, but one character is different.
Softfusion has seen domains registered to resemble a customer's domain. Registration alone does not prove an attack; it is a reason to verify carefully when an unexpected request arrives.
Build a pause into the process
Treat changes to bank details, payroll instructions, or sensitive records as a separate verification step. Call the person using a number already in your records, not the number included in the message. A reply to the same email thread is not independent verification if the mailbox or conversation has been compromised.
Make the details visible
Train staff to inspect the actual sender address and destination links, particularly on mobile where details can be hidden. Encourage them to report a suspicious request without worrying that they will be blamed for asking. A clear process protects people from the pressure to act quickly.
Protect the account, too
Use multifactor authentication for email, review mailbox forwarding rules when compromise is suspected, and limit who can approve payment changes. If a payment has already been sent, contact the financial institution promptly and follow the organization's incident process.
The strongest habit is a small one: verify the change through a channel you already trust.
Further reading: FTC Scams and Your Small Business and CISA Secure Our World.