How do we stop staff getting fake emails from the boss?

The classic version arrives as a short message, apparently from the owner, to whoever handles payments. Urgent, brief, often mentioning being in a meeting so a phone call is inconvenient. The address is either a lookalike domain or a free mail account with the right display name.

What actually reduces it:

• SPF, DKIM and DMARC configured properly. These make your domain substantially harder to forge outright, which pushes attackers to lookalike domains instead, and those are easier to spot.
• External sender marking. A clear banner on mail from outside your organization means a message claiming to be from an internal colleague, arriving from outside, is visibly wrong.
• Lookalike domain monitoring, so you know when somebody registers a domain one character off your own.
• Display name rules that flag external mail using the names of your executives.

The control that actually stops the loss is procedural though. Nobody changes payment details, sends a wire, or buys gift cards on the strength of an email, ever, regardless of who it appears to be from. Verify by phone to a number already on file.

Tell your staff explicitly that you will never ask for that by email, and that checking will never annoy you. The attack depends on people being reluctant to question the boss.