---
title: "Discussion on \"Why One Email Gateway Is Not Enough Against Business Email Compromise\" | Hashnode"
description: "Discussion on \"Why One Email Gateway Is Not Enough Against Business Email Compromise\". The most dangerous phishing emails carry no attachment and no link. Sometimes they are a single polite sentence: \"Please wire the prepayment to this new account today.\" Such a message passes a convent"
url: "https://hashnode.com/posts/why-one-email-gateway-is-not-enough-against-business-email-compromise/6ad6b1f7187368478c529606"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Why One Email Gateway Is Not Enough Against Business Email Compromise](https://securityland.hashnode.dev/why-one-email-gateway-is-not-enough-against-business-email-compromise?utm_source=hashnode&utm_medium=feed)

The most dangerous phishing emails carry no attachment and no link. Sometimes they are a single polite sentence: "Please wire the prepayment to this new account today." Such a message passes a convent

Oct 20 · 3 min read · securityland.hashnode.dev  
Read the article

-   [#cybersecurity](https://hashnode.com/tag/cybersecurity)
-   [#email-security](https://hashnode.com/tag/email-security)
-   [#phishing](https://hashnode.com/tag/phishing)
-   [#networking](https://hashnode.com/tag/networking)

## Written by

[Kazem Mortazavi](https://hashnode.com/@kazem-mortazavi)

@kazem-mortazavi · Tehran, Iran

  
[View profile](https://hashnode.com/@kazem-mortazavi)

Founder @ Security Land · Cybersecurity & IT Strategy Consultant · Threat analysis, network security & data protection

Founder of Security Land and CEO of PRS, with 25+ years in ICT. I write practical, no-hype analysis of the latest vulnerabilities, zero-days and incidents — and what security and infrastructure teams should actually do next. Focus areas: network security, DLP, encryption/HSM, identity and threat intelligence. More at symantecland.com

## Responses 1

Markdown supported · ⌘↵ to post

[Furqan Ashraf](https://hashnode.com/@jfreaks)

[Oct 27](https://hashnode.com/posts/why-one-email-gateway-is-not-enough-against-business-email-compromise/6ad6b1f7187368478c529606/comment/6ae0528f85eb9be9d541188a)

"DMARC does not stop them" should be printed on every email admin's monitor.

On actually doing the lookalike monitoring, since that's where teams tend to stall: dnstwist on a schedule against your own domain is a fine free start. Where it gets thin is homoglyph variants and brand-plus-keyword names like `yourbrand-support`, which are exactly what BEC crews use for executive impersonation.

If you'd rather not run that yourself, [WhoisFreaks Brand Monitoring](https://whoisfreaks.com/products/brand-monitoring) scans new registrations twice a day for typos, homoglyphs, keyword combos and TLD swaps, and alerts by email or webhook. Disclosure: I work there. There's a one-brand trial on request.

Either way, the output slots nicely into your week-two gateway review as the list behind "domains that look like your own."