Domain security, DNS data, and phishing infrastructure
Collaboration (safest option here, no real job search behind this account, and it still reads as a normal active writer)
Call-back verification is the right last line. One earlier layer worth adding: many BEC emails come from lookalike domains (one swapped character), so flagging mail from domains already known for phishing or brand impersonation stops a chunk before anyone has to make a call. WhoisFreaks' Threat Intelligence Feed includes a daily phishing/impersonation domain list: whoisfreaks.com/products/threat-intelligence-feed
Good that you called out the lookalike gap, most DMARC guides skip it. The practical next step for a small business is watching for phishing domains that impersonate the brand: a lookalike with its own valid SPF/DKIM passes every check, so the only defense is spotting the domain itself. Whoisfreaks' Threat Intelligence Feeds includes a daily phishing domain list (credential theft, fake logins, brand impersonation) that can be filtered for a brand name: whoisfreaks.com/products/threat-intelligence-feed
