What this covers:
A scammer does not need to break into your email to send an invoice in your name. If your domain never told the world’s inboxes to reject mail that fakes it, anyone can put your exact address on a fake message.
That is the plain version of email spoofing, and AI has made the payload convincing: correct logos, correct tone, correct invoice layout, and a forwarded thread that reads like a conversation between two executives.
Here is what changed, what a survey of South Florida firms found, and how to close the gap in an afternoon.
Why AI Made Email Spoofing Worse
The old fake invoice was easy to spot. Bad grammar, a mangled logo, a bank account that changed at the last second. Most people caught it because something felt off.
Microsoft’s write-up from September 2026 is the clearest look at how email spoofing scaled once AI entered the template.
Microsoft documented what that looks like now. Between August 3 and 5, 2026, its researchers tracked a campaign of more than a million emails, 87.7% of them sent to users in the United States.
The attackers impersonated CEOs, CFOs and presidents in three places at once: the sender display name, the reply-to name and the email signature.
Beneath the signature sat a professional-looking but fabricated invoice for a software subscription, complete with itemized lines and bank transfer instructions. Below that, a short forwarded thread of two executives agreeing the invoice was approved.
The ask was an ACH transfer of nearly $50,000. None of the companies referenced had been breached, the researchers noted. The campaign ran entirely on look-alike domains registered days before it started.
Microsoft also found the fingerprints of AI-assisted template building: verbose HTML comments, uniform section labels, em dashes and capitalized banner lines.
How Exposed Are South Florida Firms to Email Spoofing
A Miami company, Raileon, wanted a local number instead of an industry average. It checked the public email settings of 749 South Florida law firms and real estate offices in October 2026, reading only public DNS records.
The result: about four in five of the domains that actually receive mail had not told inbox providers to block fake mail in their name.
The detail matters more than the headline. In the sample, 519 law firm domains and 230 real estate domains had mail records. Roughly 79% of the law firms could have their exact address spoofed, and nearly nine in ten criminal defense practices could.
Raileon is careful about what this means, and so are we. A missing or weak record does not mean a firm was hacked or that its inbox is unsafe. It means nothing was stopping a scammer from wearing the firm’s name.
The money at stake is not hypothetical. The FBI’s 2025 Internet Crime Report ranked business email compromise second among crime types by losses, at $3.05 billion across 24,768 complaints, behind only investment fraud. Florida placed third for total reported losses at $1.60 billion.
Raileon is running a no-cost online session on the topic on Thursday, November 5, 2026, from 12:00 PM to 12:45 PM Eastern, as the first in a monthly series for business offices. Details and registration are on the Refresh Miami listing, and the full report with its method is public.
The Email Spoofing Fix: SPF, DKIM and DMARC
The email spoofing fix is three DNS records, and they build on each other.
SPF lists which servers are allowed to send mail for your domain. It has to include every service that sends on your behalf: your email host, your CRM, your e-signature tool, your scheduling app. Miss one and legitimate mail starts failing.
DKIM adds a cryptographic signature so a receiving server can confirm the message really came from you. In Microsoft 365 it is switched on in the Defender portal under email authentication. In Google Workspace it lives in the admin console under Gmail authentication.
DMARC is the instruction that ties it together. It is a public record that tells inboxes what to do with mail that fails those checks.
“p=none” means watch and report. “p=quarantine” sends fakes to spam. “p=reject” refuses them outright, and that last step is the only one that actually blocks a spoofed invoice.
The safe path is to publish DMARC in monitor mode first, collect reports for two to four weeks, fix whatever legitimate senders surface in those reports, then step up to quarantine and finally reject. The specification is RFC 7489 for anyone who wants the source.
Be honest about the limit: DMARC stops mail that uses your exact address. It does not stop a look-alike domain, and it does not stop a real mailbox that has been taken over. That is why the payment checks still matter.
If an outside provider runs your email, this is usually under an hour of work for them. Send the request in writing, and ask for the report you can forward to your insurer.
The Payment Checks That Catch What the Record Misses
No record stops a compromised mailbox, so email spoofing defense needs a second layer on the money side. Three habits cover most of it.
1. Verify any change of bank details by phone, using a number you already have on file. Never use the number in the email, because that is the one the attacker controls.
2. Split the approval from the payment. The person who approves an invoice should not be the only person who can release the funds.
3. Slow down the “urgent” invoice. Pressure to pay today is the oldest part of the scam and the part AI cannot fix for the attacker.
Those three checks belong at the front desk and in accounts payable, not only in an IT policy document.
Our post on why the person clicking is still the weakest link makes the same point from the other direction, and how one compromised mailbox sent 9,000 phishing emails shows how fast a single taken-over account spreads.
Email Spoofing FAQ
Does email spoofing mean my email has been hacked? No. Spoofing is sending mail that claims your address without touching your account. A compromised mailbox is a different, more serious problem.
Can Gmail and Outlook not just filter this? They filter some of it, but nothing on your side has told them to reject your domain’s mail outright. That instruction is what DMARC publishes.
How long does the fix take? Publishing the records takes minutes. Reaching the “reject” setting safely takes a few weeks of watching reports, which is why it is worth starting now rather than during an incident.
Is a look-alike domain enough to fool us? Often, yes, especially with an AI-written body. Check the domain character by character, not the display name, and confirm the payment request through another channel.
What should we do first? Read your own public DMARC record, then ask your email provider to walk it to reject. Read the four layers that protect a business inbox for the wider picture.
Sources: Raileon, South Florida Email Spoofing Report 2026 (public DNS survey of 749 firms, October 18, 2026); Microsoft Security Blog on AI-assisted executive impersonation and invoice fraud; RFC 7489 for DMARC; FBI 2025 Internet Crime Report for the loss figures.
Not sure whether your domain can be spoofed? Contact Nextek IT to book a call and we will read your SPF, DKIM and DMARC records, then tell you plainly what they do and do not block.