Email Security for Indonesian Businesses: A Practical Guide

On a Tuesday morning, the finance staff member of a distributor in Lampung receives an email from the "director." The message is short: there is an urgent payment to a new vendor, transfer it today, bank details attached. The sender address is almost identical to the real director's email — only one letter differs, easy to miss on a phone screen. He transfers Rp 87 million. That afternoon, the real director asks, "Transferred to where?"

Email is no longer just a communication tool. It is the main gateway into your entire business operations: invoices, contracts, passwords, customer data, transfer approvals. And because of that, it is also the attackers' main gateway. Email-based attacks require no deep technical skill, no server hacking, and no respect for working hours. One employee distracted for one second is all it takes for a single email to shake a company built over years.

This article is a practical email security guide for Indonesian businesses: why email is the primary target, the attack forms that happen most often, how to recognize fraudulent emails, the technical layers you can deploy — including SPF, DKIM, and DMARC — and what protecting your company's inbox costs.

Why Email Is the Primary Target

The following numbers explain why attackers love email. Verizon's annual data breach report consistently finds that the majority of breaches start with the human element, and email is the most common entry path. Meanwhile, the phishing tracking group APWG records millions of phishing attacks every year, with an upward trend.

In Indonesia, the National Cyber and Crypto Agency (BSSN) reports hundreds of millions of attempted cyber attacks every year, and most schemes begin with social engineering. DataReportal notes that a large majority of Indonesian internet users actively use email, both for work and digital services. Email is not a niche: it is the widest channel nearly everyone uses.

What makes email so attractive to attackers?

• Access to money. Email is where invoices, transfer approvals, and bank details move around. One convincing fake email can trigger a quiet transfer.
• Access to other systems. An employee's inbox often becomes a warehouse of passwords, password reset links, and application credentials. The FBI recorded business email compromise (BEC) losses of nearly US$ 2.9 billion in 2023 — and reported figures are always smaller than reality.
• The snowball effect. One compromised email account can be used to send fake emails to every contact: other employees, customers, suppliers. One victim becomes the trigger for the next.
• Domain reputation. When your domain is used to send spam or phishing, it lands on blocklists. Your legitimate business emails then end up in customers' spam folders — sales lost quietly.

The most expensive misconception is that email security is only the email provider's job. Gmail or Microsoft provide baseline protection, but most of the responsibility — policy, domain configuration, employee training, and access governance — sits with you.

The Most Common Email Attack Types

Mass Phishing

Fraudulent emails sent to thousands of addresses at once, imitating popular services: banks, e-wallets, couriers, tax authorities, or email providers. The goal is stealing credentials via fake login pages or spreading malware. Quality has improved: layouts mirror the originals, logos are correct, and there are even call centers (which forward to the scammers).

Spear Phishing

A customized version aimed at one person or one company. Attackers study the target's role, projects, and correspondence habits through social media and LinkedIn. The email appears to come from a "colleague" or "client" with the right name and relevant context. Because it is personal, it is far harder to recognize than mass phishing.

Business Email Compromise (BEC)

Attackers impersonate a director, finance manager, or supplier, then request a fund transfer, a change of payment account, or the purchase of vouchers. No malicious attachment, no suspicious link — just a request. These attacks are planned over weeks and are hard for automated filters to catch because they contain no malicious code.

Spoofing and Domain Impersonation

Attackers forge the sender address so it appears to come from your business domain, or register a lookalike domain (for example, kartech-site.com instead of kartech-site.co.id). Your employees, customers, and vendors receive emails that "look" official. This is why SPF, DKIM, and DMARC — covered later — are not just technical jargon.

Malware and Ransomware via Attachments

Ordinary-looking office attachments — a PDF invoice, an order spreadsheet, a ZIP "document" — hide malware. Once opened, the malware can steal data, lock files with ransomware, or install remote access. Ransomware attacks on small and medium businesses in Indonesia are rising, and email remains the primary vehicle.

Account Takeover

This is the escalation stage of phishing: attackers do not just send emails, they take over an employee's email account. From inside the account, they read conversations, impersonate the account owner, and change forwarding rules so every incoming email is copied to their own address. Many companies only realize it weeks later.

How to Recognize Fraudulent Emails

No single sign is always present, but a combination of the following almost certainly means the email deserves suspicion:

A simple rule: never act on an email demanding urgency, money, or credentials — verify through another channel. Contact the sender via a phone number you already know, not the one in the email. If the "director" asks for a transfer, call first. Ten minutes of confirmation costs far less than one misdirected transfer.

The Technical Foundation: SPF, DKIM, and DMARC

These three DNS records are the foundation of modern email security. They work together to ensure emails claiming to be from your domain actually come from your domain — and to reject the fakes.

SPF (Sender Policy Framework)

SPF is the official list of servers allowed to send email on behalf of your domain. Attackers trying to send fake email from other servers get rejected or flagged by recipients. Implementation is a single TXT record in DNS. Its weakness: clever attackers can work around SPF, and if you use third-party senders (such as email marketing services), all of their IPs must be on the list.

DKIM (DomainKeys Identified Mail)

DKIM signs every email with a cryptographic key. Recipients match the signature against a public key in your domain's DNS. Emails whose signature does not match — because they were forged or altered in transit — are rejected. DKIM also protects the integrity of the message content, not just its origin.

DMARC (Domain-based Message Authentication, Reporting, and Conformance)

DMARC tells recipients what to do when an email fails SPF and DKIM checks: send it to spam, reject it outright, or accept it (while reporting). It also produces reports showing who is sending email on behalf of your domain — the most effective way to detect spoofing before your customers become victims.

Practical steps:

1. Make sure all legitimate services sending email from your domain (Google Workspace, Microsoft 365, email marketing services) are registered in SPF and DKIM.
2. Start DMARC with a p=none policy while monitoring reports for a few weeks.
3. Progress gradually to p=quarantine, then p=reject once you are confident no legitimate email gets rejected.
4. Check your domain configuration periodically using tools like Google Admin Toolbox or an online DMARC checker.

Many Indonesian business owners have never heard of these three terms, even though the configuration can be completed in one afternoon with immediate impact. A domain without DMARC is an unlocked door: anyone can send email as your business.

The Second Layer: Filtering, Authentication, and Encryption

SPF, DKIM, and DMARC protect your domain's reputation. To protect employees' inboxes, add the following layers:

Email Gateway and Anti-Spam Filtering

Paid email services like Google Workspace and Microsoft 365 already include built-in spam filtering and phishing detection. For stricter protection, third-party email security gateways scan attachments in a sandbox, block malicious links in real time, and quarantine suspicious emails before they reach employees.

Mandatory Two-Factor Authentication (2FA)

This is the single highest-return step. Even if a password leaks through phishing, attackers still need the second factor. Enable 2FA on all email accounts, especially directors, finance, and HR. For critical accounts, consider physical security keys or authenticator apps instead of SMS — SIM swap remains an active theft method in Indonesia.

Encryption for Sensitive Emails

Ordinary email travels like a postcard: anyone along the path can read it. For documents containing personal or financial data, use encryption — Gmail's confidential mode, Microsoft 365 message protection, or encrypting files before attaching them. A simple policy: customer data is never sent as an unprotected attachment.

Control Forwarding and Access

Regularly check automatic forwarding rules on employee accounts — a favorite trick of attackers who have already breached an account. Limit email access to known devices, and revoke former employees' access immediately when they leave (see our guide on attendance and HRIS systems for a clean offboarding policy).

People: Training and Policy

Technology stops automated attacks; people stop targeted ones. Email security works when both are combined.

• Regular awareness training. One session a year is not enough. Show realistic phishing examples, in Indonesian and English, and have employees practice recognizing them. Internal phishing simulations — the company sending fake emails to its own staff to measure vigilance — are the most honest way to see which teams are most vulnerable.
• Transaction verification procedures. Set written rules: vendor account changes must be verified by phone; transfers above a threshold need a second approver; sudden requests from superiors still go through official channels. These rules are what block BEC, not technology.
• A safe reporting channel. Employees who click a wrong link must feel safe reporting it, not afraid of punishment. The faster an incident is reported, the smaller the damage.
• Email usage policy. Define what may and may not be sent: customer data, financial files, and credentials belong on the prohibited list for personal email.

Response Plan: When an Account Is Already Breached

Assume it happens — not out of pessimism, but because a response plan written while calm beats decisions made in panic.

1. Secure the account immediately. Change the password and force sign-out from all active sessions (Google and Microsoft both have "sign out of all devices"). Enable 2FA if it is not on yet.
2. Check forwarding. Remove forwarding rules and filters created by the attacker. Also check sent mail to see what was already sent from the account.
3. Notify affected contacts. Phishing emails sent from your account are a real risk to customers and business partners. Tell them so they do not click links or process requests from that account.
4. Report and request an audit. For incidents involving customer data, coordinate with your provider, security consultants, and — where personal data is involved — note reporting obligations under Indonesia's Personal Data Protection Law.
5. Find the entry path. Phishing, weak password, or infected device? An incident without root-cause evaluation is just waiting to repeat.

How Much Email Security Costs

Email security budgets do not have to be large. Here are realistic ranges in the Indonesian market:

For comparison: a single BEC incident in Indonesia — a misdirected transfer — is often worth tens to hundreds of millions of rupiah. One attack stopped by a verification procedure already pays for years of protection.

Common Mistakes That Leave Email Vulnerable

Beyond skipping the layers above, several habits quietly weaken email security:

• Using free email for business operations. A personal Gmail address as the official business email means domain reputation, account control, and recovery all depend on a personal account. Serious businesses use their own domain — and a domain of your own is exactly what SPF, DKIM, and DMARC can protect.
• Reusing passwords. The same password for business email, social media, and an online store account means one leak anywhere opens everything.
• Thinking 2FA is only for "important accounts." Attackers often enter through the lowest account — receptionist, intern, warehouse admin — then use it to climb to higher ones.
• Not archiving email. A breached or lost account without backup is evaporated customer contacts, deal histories, and transaction evidence. A separately managed email archive is also a lifesaver during audits or disputes.
• Deleting security alerts. Google and Microsoft send notifications about suspicious logins. Those notifications are often treated as spam and deleted unread — yet they may be the only early warning you get.
• Granting inbox access to third-party apps without checking. "Tools" that request full email access can read your entire inbox. Review the permissions they ask for, and revoke access for apps you no longer use.

Email Security in the Hybrid and Remote Work Era

Working from anywhere melts the office boundary, and email spreads to devices beyond company control. Some adjustments are needed:

• Personal devices. Establish a policy: work accounts should only be opened on company-managed devices, or at least on devices with an active screen lock and storage encryption.
• Public Wi-Fi. Cafés, airports, and hotel Wi-Fi are favorite interception spots. Employees opening work email on public networks should use a company VPN.
• Lost devices. Enable remote wipe on all devices connected to work accounts. One phone left on public transport can become a data leak if work email is open on it.
• Family devices. Work email opened on a tablet the kids use is a door that never made it onto the risk list. Separate work accounts from shared devices.
• Procedures stay the same. The rules for verifying transfers by phone, reporting suspicious emails, and never forwarding customer data apply wherever employees work — they matter even more, because direct oversight is gone.

Where to Start

Do not try everything at once. A sensible sequence:

1. This week: enable 2FA on all accounts, check forwarding settings, and establish a phone-verification rule for transfers.
2. This month: configure SPF, DKIM, and DMARC; move all email to a paid service if you still use free ones.
3. This quarter: run awareness training for all employees, including phishing simulations; audit your domain configuration.

Email security is not a one-time project; it is a maintained habit, just like website security and the rest of your digital infrastructure. If your internal team has never touched DNS configuration or security policy, this is the right time to consider IT consulting help — it costs far less than a single incident.

The Kartech. team in Bandar Lampung regularly helps businesses build this digital security foundation: from email audits and DMARC configuration to employee access policies, without confusing jargon. We start from your problem, not from a package — discuss your needs via our contact page or see the range of our services.

Back to the finance staff member at the start of this story: those Rp 87 million were nearly impossible to recover. The same email could have been stopped by one far cheaper habit — a ten-minute confirmation call. Email security, in the end, is the right technology combined with disciplined habits. Both can start this week.