The invoice looked real. So did the email thread under it.

Microsoft caught more than a million fraudulent invoice emails in a three-day stretch this August. Nearly 88% of them landed in US inboxes.

Here's what made this batch different. The email appeared to come from the company's own president. Below his signature sat a forwarded thread — the president and a vendor, discussing the purchase and agreeing on terms. Below that, a clean invoice with the company's name on it. One ask: approve the ACH payment, just under $50,000.

None of it was real. Not the thread, not the invoice, not the sender's domain, which had been registered days earlier to look nearly identical to a real vendor's. Microsoft's researchers found signs the whole package was drafted with AI, which is why it read polished instead of clumsy.

Now think about who pays the bills at your practice. Usually one person, who trusts the doctor's name on an email and has a stack of vendor invoices to clear before Friday. That isn't carelessness. That's a normal Tuesday.

Two things help more than anything fancy. First, one rule with no exceptions: any new payment instruction or changed bank detail gets confirmed by phone, on a number you already had. Second, check that your email filtering and domain authentication are actually turned on and tuned — most tenants I open have them half-configured.

Fifty thousand dollars leaves the account in minutes. Getting it back takes months, if ever.

Worth a look before your next cyber renewal.