DMARC/SPF/DKIM only authenticate sender domains; they don’t analyze content. Layer defenses with AI‑based email gateways that inspect attachments and links.

Train employees to spot subtle domain mismatches in sender addresses (e.g., “@vendor-services.com” instead of “@vendor.com”).

Implement strict payment‑approval processes: call vendors using verified numbers before paying invoices and require internal sign‑off for large transfers.

Enable external email banners in Outlook or Gmail to alert users when messages originate outside your domain.

Consider subject‑line and attachment filters that quarantine messages with high‑risk keywords or file types.

Perform periodic security awareness training so staff remain vigilant as scam tactics evolve.

Use phishing‑simulation tools such as Google’s free Phishing Quiz to run regular, realistic training exercises.

Teach employees to examine email headers and domain details (via tools like MX Toolbox) and hover over links before clicking.

Implement DMARC, SPF and DKIM on your domain to reduce spoofing, and enforce external sender warnings in your email client.

Deploy AI‑powered email filtering platforms (Microsoft Defender, Proofpoint, Mimecast) that can detect unusual language patterns.

Emphasize common red flags: perfectly written emails from normally casual contacts, urgency or threats, and requests for sensitive data.

Reinforce MFA on all accounts; while phishing can bypass weak MFA, hardware keys significantly reduce risk.

Immediately lock or disable the QuickBooks account via Intuit support, change the password, and enable MFA or hardware‑based security keys.

Audit all recent transactions and bank feeds; contact your bank(s) right away to reverse unauthorized transfers and report suspected fraud.

Enable transaction approval workflows and require dual authorization for large or unusual payments to prevent one‑click transfers.

Create separate admin accounts with limited privileges for bookkeeping tasks, and avoid sharing logins among multiple users.

Monitor bank feeds and QuickBooks notifications daily so you can catch suspicious activity quickly.

If Intuit’s support proves insufficient, evaluate alternative accounting platforms that may offer stronger security features.

Force a password reset and enable MFA for every user; consider enforcing FIDO2 hardware security keys for stronger phishing resistance.

Use the Google Workspace Admin console to restore deleted files and drives from the trash or the Admin “Vault” within the allowable recovery window.

Audit recent account and login activity to spot suspicious IP addresses, devices, or third‑party access, and revoke anything unrecognized.

Implement Security Key enforcement so only users with approved hardware keys can access sensitive data.

Train your team to detect phishing emails that may bypass basic MFA and avoid entering credentials on untrusted links.

Consider using Google’s security tools (Alert Center, automated rules) to notify admins of unusual behavior.

Start with free MFA tools included in your existing subscriptions—Microsoft Entra ID (Azure AD) with Microsoft Authenticator or Google Authenticator.

Avoid SMS codes due to SIM‑swap risk; instead, use authenticator apps or push notifications.

For phishing‑resistant security, invest gradually in FIDO2 hardware keys (YubiKey, Google Titan) at about $20–$50 per user.

Use conditional access policies to require MFA only on risky logins or when users access sensitive apps from new devices.

Evaluate MFA providers like Duo or Okta Essentials (around $2–$5 per user per month) if you need centralized management.

Provide training and support to ensure non‑technical staff understand and adopt MFA without frustration.