Start with account access.
Use unique passwords and multi factor authentication. Review who has administrative access, how accounts are recovered, and how access is removed when someone leaves the business.
Verify changes through another channel.
Payment instructions, bank detail changes, and requests for sensitive records deserve an independent check. Call a known contact using a number already on file, rather than the number included in the message.
Review domain authentication.
SPF, DKIM, and DMARC help receiving systems evaluate messages using your domain. They need to be configured around your legitimate sending services. They do not stop every kind of impersonation or phishing, so combine them with other controls.
Make reporting easy.
Give employees a clear way to report suspicious messages. Encourage quick reporting if someone clicked a link or entered credentials. A timely report gives the response team more opportunity to investigate.
If you suspect account compromise, use a trusted channel to contact your IT team. ECC offers incident response and consulting to help with business security concerns.