Security awareness
Invoice Fraud in Saudi Arabia Starts With Your Domain
In three lines
- The most expensive attack on a mid-sized Saudi company rarely involves malware.
- Spoofing forges your exact domain in the From field.
- SPF lists who may send for you, DKIM signs the message, and DMARC tells receiving servers what to do when a message fails.
The most expensive attack on a mid-sized Saudi company rarely involves malware. Someone reads a real email thread, sends a final invoice with different bank details, and the transfer is made before anyone picks up the phone.
Two techniques, one outcome
Spoofing forges your exact domain in the From field. A lookalike registers a domain one character away from yours. The first is preventable with records you publish today; the second needs monitoring and human habits.
Publish the three records properly
SPF lists who may send for you, DKIM signs the message, and DMARC tells receiving servers what to do when a message fails. Publish DMARC in monitoring mode, read the reports for a month, then enforce rejection once every legitimate sender is accounted for.
- Include accounting software, CRM and newsletter tools in SPF
- Start at p=none, finish at p=reject
- Register the obvious lookalikes of your own name
The rule that saves the money
No change of bank details is ever accepted by email alone. Confirmation goes through a known phone number, called out — never a number written in the same message.
The practical takeaway
Publish and enforce authentication on your domain, watch for lookalikes, and make a phone call mandatory for any change of payment details.
Frequently asked questions
What actually stops invoice fraud by email?
A published SPF record, DKIM signing on every outbound message, and a DMARC policy moved to quarantine then reject — combined with a rule that bank-detail changes are confirmed by phone.
How long does DMARC enforcement take?
Typically a few weeks: records are published immediately, then reports are monitored before the policy is tightened so that legitimate senders are not blocked.
Related RASED services
Official references
Written by Khalid Namra
Founder & CEO, RASED Solutions — engineering lead of RASED Solutions
Khalid Namra building software since 2015 and leads the engineering and security teams behind RASED Solutions in Riyadh.
Related articles
Web development
SEO Services Prices in Saudi Arabia 2026: Real Costs, Packages and What You Pay For
Indicative market ranges for SEO in Saudi Arabia, what changes the price, what a serious proposal contains, and the questions to ask before you sign.
Web development
What Is SEO and How Does It Work? A Practical Guide for Saudi Businesses
What SEO actually is, how Google decides who appears first, and the three pillars every Saudi business website is judged on.
Web development
Local SEO and Google Maps in Saudi Arabia: How Nearby Customers Find You
How the local results box works, what your Google Business Profile must contain, and why your name, address and phone number must match everywhere.