“URGENT: supplier banking details have changed. Please pay today.”
Nothing looked fake, because nothing was. The CEO’s mailbox had been taken over. Business email compromise is now the most common cyber incident in South African organisations, and INTERPOL says 70% of Africa’s BEC detections originate here.
Business Email Compromise (BEC) targets something organizations rely on every day: trust in business communication.
An attacker can impersonate an executive, vendor or partner and use familiar email threads, urgent requests or altered payment instructions to make a legitimate employee take an unauthorised action that makes BEC more than an email-security concern.
It is a payment authorization, financial and business-process risk. The strongest defense often starts with a simple control: verify independently before acting on a sensitive request.
The numbers South African businesses can’t ignore
- Business Email Compromise (BEC): South Africa accounts for roughly 70% of all BEC detections on the African continent, according to INTERPOL. BEC is the single most financially damaging cybercrime category targeting local organisations.
- AI-Driven Phishing: Criminals increasingly use artificial intelligence to craft hyper-realistic, native-sounding phishing and social engineering emails, bypassing traditional language and grammar-based detection tools.
- South Africa ranks third highest in the world for the number of cybercrime victims, with digital scams and cyberattacks costing the economy billions of rands annually (estimated around R2.2 billion to R2.4 billion by SABRIC).
- Research indicates that nearly 8 in 10 South African small-to-medium businesses (SMBs) suffered a cyber incident in the past year, with 18% impacted specifically by BEC. Many lack dedicated IT personnel, use shared or default email settings, and omit multi-factor authentication (MFA).
- Attackers frequently lurk inside compromised email accounts for weeks, studying internal payment workflows, invoice formatting, and executive phrasing, before sending a precisely timed fraudulent payment or banking-details change request.
According to recent data published by Kaspersky, it was reported that, in the first half of 2025, South Africa experienced more than six million online attack attempts and 10.3 million malware-related incidents including ransomware, banking trojans, spyware, and info stealers.
While backdoor attacks surged by 123%, banking trojans and password stealers increased by 136% and 122% respectively compared to 2024. The financial toll is staggering. According to the Annual Crime Statistics published by South African Banking Risk Information Centre, banking customers suffered losses in the region of R1.8 billion in 2024 alone. This figure is widely regarded as conservative. Seemingly, small and medium-sized enterprises (SMEs) continue to be the low hanging fruit, with businesses experiencing attempted intrusions on a near-daily basis.
Major institutions, including the South African Revenue Service and the Department of Justice, frequently warn the public that legitimate government bodies will never request passwords, banking PINs, or upfront payments for tender or tax refunds via email.
What is business email security?
Business email security means stopping criminals from getting into your mailboxes, impersonating your domain, or tricking your staff through email. For a South African SME, the essentials are multi-factor authentication (MFA) on every mailbox, SPF, DKIM and DMARC on your domain, advanced email filtering, protection on every device, and a firm rule that payment changes are confirmed by phone. Together these block the large majority of email-based attacks. Email is where most attacks on small businesses start.
Why do criminals target South African business email?
Your mailbox holds everything a fraudster needs: client lists, quotes, invoices, who approves payments, and how your team writes. Once inside, attackers often wait quietly for weeks, then send one perfectly timed “new banking details” email from your real address.
Small businesses are attractive because they usually have:
- No dedicated IT security person
- Shared or reused passwords and no multi-factor authentication
- Default email settings that let anyone spoof the domain
- Staff who process payments based on email instructions
What are the main email threats to SMEs?
- Phishing: fake login pages or attachments that steal passwords or install malware.
- Business email compromise (BEC): a real mailbox is taken over, or a lookalike address is used, to redirect payments.
- Domain spoofing: emails that appear to come from your exact domain because SPF and DMARC aren’t set up.
- Malware and ransomware attachments: “invoices”, “delivery notes” and CVs carrying malicious files.
- Account takeover: stolen passwords bought or guessed, then used to log in from anywhere in the world.
How do I secure my business email? 7 steps
- Turn on multi-factor authentication for every mailbox. This single step stops most password-based takeovers. Use an authenticator app rather than SMS where possible.
- Publish SPF, DKIM and DMARC records. These tell receiving mail servers which systems may send email for your domain. Start DMARC at p=none to monitor, then move to quarantine or reject.
- Add advanced email filtering. Set up your email to catch obvious spam, but targeted phishing and new malware need an extra layer that scans links and attachments.
- Protect every device that opens email. A laptop or phone with outdated software is a common way in.
- Make a payment-change rule. Any change to bank details, by a supplier or a client, is confirmed by phone on a number you already have. Write it into your processes and onto your invoices.
- Train staff briefly and often. Five minutes a month on real examples beats a once-a-year slide deck.
- Monitor and respond. Someone needs to notice impossible logins (Johannesburg at 9:00, Lagos at 9:05) and lock the account fast.
Best practices for fortifying your email systems
Email remains the primary communication tool for businesses, but it’s also a prime target of cyber-attacks. Small businesses in South Africa are particularly vulnerable, often lacking the robust defences used in bigger corporate enterprises.
Adopting best practices for email security can safeguard your operations and ensure seamless communication.
Implement a secure email gateway. A secure email gateway acts as your first line of defence, filtering out spam, phishing attempts, spoofing and malicious attachments. An API-based solution ensures better accuracy and fewer disruptions to your operations.
Adopt in-line API email security. Unlike legacy email filters, in-line API protection integrates into the email flow, monitoring all inbound, outbound, and internal emails without delays.
Train employees on email security. Human error is a leading cause of data breaches. Regular training helps employees identify phishing emails, suspicious links, and spoofing attempts. Look for an email security solutions provider that understands your business and is able to better implement a solution for your business needs.
Use two-factor authentication (2FA). Adding a second layer of protection to your email accounts significantly reduces the risk of unauthorized access.
Secure your email with encryption. Encryption ensures that emails remain unreadable to unauthorized parties during transit. It is particularly crucial for industries like finance, healthcare, and legal services.
Enable email threat intelligence. Modern secure email gateways leverage machine learning and threat intelligence to stay ahead of evolving attacks. Choose a solution that provides proof-of-concept trials so you can see threat intelligence in action.
Protect internal email communication. Many businesses overlook internal email threats, such as insider phishing attacks. Insider attacks are growing; securing internal communications is critical to maintaining trust and compliance.
Simplify management with easy-to-use tools. Email security shouldn’t require a full-time IT team to manage. Opt for tools with a user-friendly interface and real-time reporting to make monitoring and email trends effortless.
Test before you invest. Before committing to an email security solution, request a proof of concept (PoC). Test in a live environment to evaluate real-time threat detection and ease of use.
Regularly update and audit your security measures. Cyber threats evolve constantly, so your email security strategy must keep up. Audits should include reviewing email security policies, ensuring software and gateways are up to date, and testing API integrations for compatibility.
Why your email provider is the foundation
Every step above sits on top of one decision: who runs your email. A free @gmail.com or @yahoo.co.za address gives you no domain to protect, no SPF, DKIM or DMARC records to publish, and nothing that tells a customer or supplier they are dealing with a legitimate business. A professional address on your own domain does.
An email address using your own domain gives customers a consistent, professional way to recognise your business instead of an old @yahoo.co.za or @gmail.com address. A professional email address does more than deliver messages. It shows customers, suppliers and partners that they are dealing with a legitimate, established business.
That is the foundation 1-grid’s Professional Email is built on:
- Your own domain. Use an email address that matches your business name and reinforces your brand every time you communicate. Register a .co.za or .com domain and start sending from it the same day, or point a domain you already own at your mailboxes without touching your site.
- Secure, ad-free mailbox. Keep your business communication in a secure, ad-free mailbox with support available when you need it.
- Access wherever you work. Access your email from your phone, tablet, laptop, or desktop. Use webmail or a supported email app on Windows, Linux, macOS, iOS and Android.
- Local South African support. Get help when you need it, backed by 1-grid support.
1-grid’s Email Pro gives your business more than a professional inbox. Keep your team connected and organised with built-in collaboration tools that bring your everyday communication and work together in one place, so your staff can chat, schedule and meet without relying on a separate communication platform.
The bottom line
The strongest defense often starts with a simple control: verify independently before acting on a sensitive request. But the controls only work when they sit on a platform you can trust. Choose a reputable provider, put your business on its own domain, turn on MFA, publish SPF, DKIM and DMARC, and write the payment-change rule into your processes.
Ready to look more professional? Give your business an email address that matches your brand.