Why can't a network security tool stop invoice fraud?

Because invoice fraud happens in conversations and decisions, not in network traffic. The fake invoice arrives as an ordinary e-mail in a cloud mailbox; the person who pays it uses online banking as on any other day; and no malware has to run anywhere. From the network's point of view, everything is normal. A network detection and response (NDRNDR: network detection and response. Security monitoring that watches the traffic between devices and raises an alert when one behaves like an attacker.) tool watches how devices behave: which machines talk to which, regular check-ins with outside servers, internal scanning, unusual data volumes. It does not read e-mail text, and it cannot know that an account number is wrong. That is not a weakness to hide but a boundary to plan for. Invoice fraud is stopped by payment controls, by e-mail authentication on your own domain, and by people who are allowed to pause and call back. NDR becomes relevant only when the fraud starts with an intrusion, for example a hacked mailbox used to get into other systems.

← All 29 questions on Phishing and e-mail aftermathAll topics