Protect the accounts people rely on
Strong account controls reduce the chance that an attacker can read a conversation, impersonate a known contact, or change a payment-related workflow.
- Require multi-factor authentication where the email and business systems support it.
- Use named accounts, strong passwords, and a documented process for employee and vendor access changes.
- Review mailbox forwarding rules, delegated access, recovery methods, and administrator roles.
- Make suspicious-email reporting simple and route it to a person who can respond quickly.
Verify payment and account changes out of band
A familiar name or existing email thread is not enough proof for a banking, wire, invoice, or vendor-detail change. Verification should use a trusted contact path that was not supplied in the request.
- Require a second-person review for payment instructions, bank changes, and urgent transfer requests.
- Call a known phone number from your records, not the number or link included in the message.
- Treat urgency, secrecy, unusual language, new bank details, and changed reply addresses as warning signs.
- Record who verified the request, when it was verified, and which trusted contact method was used.
Prepare the response before an incident
The first few minutes matter when an account may be compromised or a payment request looks suspicious. Give staff a clear route to pause, report, and escalate.
- Pause the payment or account change until the responsible manager confirms the request.
- Report suspected compromise to the IT contact and preserve the message, headers, and relevant timestamps.
- Review recent sign-ins, forwarding rules, delegated access, sessions, and password or recovery changes.
- Coordinate with the bank, insurer, legal or regulatory advisors, and law enforcement when the situation requires it.
Questions to ask
Does email security alone prevent wire fraud?+
No. Technology controls are important, but payment verification, staff training, approval separation, and financial procedures are also necessary.
What should staff do with a suspicious payment request?+
Pause the request, do not use the message's links or phone numbers, verify through a trusted contact path, and report it through the organization's incident process.
Can ArcTechOne approve payments or banking changes?+
No. ArcTechOne can help with account, email, device, and access controls. Financial approvals and payment decisions remain with the property management organization and its advisors.
