RemoteEmail filtering
A second check inside your mailboxes, after Microsoft's.
The email that costs a business money is rarely obvious spam. It is a real supplier's account, hijacked, sending an invoice with new bank details. We add Check Point's email security on top of Microsoft 365, including the email between your own staff, and back it with a payment process that does not trust email at all.
Included in every Real Bytes managed plan. Works with Microsoft 365 and Google Workspace.
- Checks internal email too
- Spots hijacked accounts
- Part of every managed plan
Reviewed by Blake Bath, General Manager, on 30 October 2026.
What stops a fake invoice
Five layers between a scam email and a paid invoice.
No single filter catches everything. These are the layers that, together, stop the money leaving.
A check before the inbox
Check Point sends each email to its ThreatCloud for analysis before it is delivered, and quarantines what is malicious. It sits on top of Microsoft's own filtering rather than replacing it.
- Connects to Microsoft 365 or Google Workspace
- No change to how your mail flows
- Watch first, then block
Internal email checked too
When a colleague's account is taken over, the scam comes from inside. Check Point inspects internal and outgoing mail, and Teams, OneDrive and SharePoint files, not just mail from outside.
- Internal mail inspected inline
- Shared files scanned for malware
- Outgoing mail checked for leaks
Hijacked accounts spotted
Attackers can watch a mailbox quietly before they strike. Check Point watches login and email patterns to flag a compromised account before damage is done.
- Unusual logins flagged
- Suspicious mail rules found
- Account blocked when confirmed
A payment process that does not trust email
ASD's guidance is a clear, consistent process to verify payments and account changes. Technology helps, but a phone call to a number you already had is what stops the transfer.
- Every bank detail change confirmed by phone
- Never use the number in the email
- Two people for large or unusual payments
Your own domain locked down
Filtering protects your inbox. DMARC protects your customers from emails pretending to be you. Both are needed.
- SPF, DKIM and DMARC set up in every plan
- Managed DMARC through Sendmarc as an upgrade
- Lookalike domains registered or monitored
Fake invoice readiness
Would a fake invoice get paid at your business?
Eight controls, most of them straight from ASD's business email compromise guidance. Tick what is true today. Copy the gaps for your finance team or for us.
Tick what is true at your business today. The gaps are the ways a fake invoice could get paid.
Where you stand
0of 8 controls in place
8 gaps to close.
- MFA on every mailboxASD's first key action against business email compromise.
- Bank detail changes confirmed by phoneASD asks for a clear, consistent process to verify payment and account changes.
- Filtering beyond Microsoft's defaultA fake invoice from a real supplier's hacked account passes most basic checks.
- Something watching for hijacked accountsAttackers can watch a mailbox quietly before they send the invoice.
- DMARC at enforcement on your domainWithout it, scammers can send email that looks like it comes from you.
- A one-click way to report suspicious emailOne report can pull the same email out of every other inbox.
- Staff know the warning signsASD lists these as the signs to train for.
- Finance contacts not publishedASD suggests protecting the contact details of the teams scammers target.
Engineer's take
Two layers we tune ourselves, not presets.
Blake Bath, our General Manager, runs Real Bytes' own email the way we recommend for clients: custom Microsoft Defender for Office 365 policies, plus Check Point on top.
He decided to keep Microsoft's preset security policies switched off on our tenant, so mail runs on our own tuned policies and Check Point rather than a third set of defaults layered in between.
The point is that someone owns the rules. A filter left on defaults catches the obvious and misses the targeted. Ours are tuned by the people who see what gets through.
From our jobs
What this looks like day to day.
- Moving a client onto Check Point
We are moving a client onto Check Point email security at the same time as a new endpoint protection platform, so their mail and devices are watched by the same team.
- Our own tenant
Real Bytes' mail runs on custom Defender for Office 365 policies plus Check Point, with Microsoft's presets off. We test changes on ourselves first.
- DMARC handled for most clients
Most of our clients have their email DNS managed through Sendmarc, which takes domains from monitoring through to enforcement.
- Pull it from every inbox
When one person reports a scam, the same email can be removed from every other mailbox after delivery, before anyone else clicks.
Cost
Included in every managed plan.
Email filtering and email authentication setup are part of every Real Bytes managed plan, from $150 per person a month ex GST. Managed DMARC through Sendmarc is an optional upgrade, quoted for your domains.
The Australian guidance
What ASD says to do about business email compromise.
From ASD's Protecting against business email compromise.
- Use MFA and strong passwordsOn every account that can reach business email.
- Verify payment and account changesA clear, consistent process, using contact details you have checked separately.
- Use email authenticationSPF and DMARC, so fake mail claiming to be you can be detected and blocked.
- Train staff to spot and reportChanged bank details, urgent payments, and unusual requests from someone senior.
- If you paid, act fastContact your bank immediately, report to ASD, change the email passwords and warn anyone affected.
Mistakes we see
Five ways fake invoices get paid.
- Trusting a known senderThe email really is from your supplier's address. Their account was hijacked.
- Changing bank details by emailThe reply goes to the scammer. Only a phone call to a known number confirms it.
- MFA on some mailboxes, not allShared and finance mailboxes are often the ones left out.
- DMARC published and left on monitorIt reports on spoofing but stops none of it.
- Nowhere to report a suspicious emailStaff delete it, and the same email sits in five other inboxes.
How we switch it on
From connection to protection in five steps.
- Step 1Connect
Check Point connects to Microsoft 365 or Google Workspace. Mail keeps flowing the same way.
- Step 2Watch
It runs in monitor mode first, so we see what would be caught before anything is held.
- Step 3Protect
Inline protection turned on, including internal mail.
- Step 4Tune
Our engineers review held mail, release what is genuine and adjust the rules.
- Step 5Respond
Reported scams pulled from every mailbox, and compromised accounts locked.
Related work
Email is one layer. These are the others.
Fake invoices are stopped by filtering, identity, domain protection and people, together.
- Stop people sending as youSPF, DKIM and DMARC taken to enforcement.
- Awareness trainingShort lessons and practice scam emails.
- Managed Microsoft 365The tenant your mail runs in, secured.
- Identity and accessPasskeys and MFA on every mailbox.
- Detection and response24/7 watch on devices and sign-ins.
- BEC survival guideWhat to do in the first hour.
Get help your way
Six ways to reach us. Pick whichever suits you.
Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.
- Call 07 3114 2808
An engineer answers Monday to Friday, 8am to 5pm AEST. After hours, weekends and public holidays, Chip, our AI agent, answers on the same number or on 07 3180 0965, logs it and escalates urgent incidents to the on-call engineer.
Call now - Email the helpdesk
Send it to helpdesk@realbytes.com.au and a ticket is logged straight away, with a reference number you can quote.
Email us - Client portal
Log and follow your tickets, see what we are working on and who has it.
Open the portal - Remote support
When an engineer asks to see your screen, start a secure session here. You start it, so nobody sees your screen until you do.
Start a session - Chat in Microsoft Teams
Clients can message Chip, our AI assistant, in Teams to log a request without leaving their desk.
How clients reach us - Service status
Check whether Microsoft 365 or another cloud service is down before you lose an hour troubleshooting.
See live status
Questions
What people ask about email filtering.
Doesn't Microsoft 365 already filter email?
It does, and it stops most bulk spam. A fake invoice sent from a real supplier's compromised account is much harder to catch. Check Point adds a second check after Microsoft's, before mail reaches the inbox, and it also checks email between your own staff.
What does Check Point actually check?
Per Check Point's documentation, each email is sent to its ThreatCloud for analysis before delivery, and malicious mail is quarantined. It also inspects internal and outgoing mail, files shared in OneDrive and SharePoint, and Teams messages, and it watches login and email patterns to spot a compromised account.
Will we lose real emails?
We start by watching, so we can see what would be blocked before anything is. When we switch to blocking, held emails can be released quickly, and we tune the rules as we go.
Does it work with Google Workspace?
Yes. Check Point supports Gmail and Google Drive as well as Microsoft 365.
We think we paid a fake invoice. What now?
Call your bank straight away. Then report it to ASD, change the passwords on any email accounts involved, and warn anyone affected. Call us on 07 3114 2808 and we will lock down the mailbox and find out how it happened.
Is this the same as DMARC?
No. Filtering protects the email coming in to your staff. DMARC stops scammers sending email that looks like it comes from your domain. You need both, and our plans include email authentication setup, with managed DMARC through Sendmarc as an upgrade.
Next step
Worried about what is getting through?
Tell us how your mail is set up today. An engineer will tell you what is missing and what we would switch on first.
Keep reading
- Stop people sending email as you DMARC and domain protection.
- Business email compromise survival guide The first hour after a fake invoice.
- Spotting scam emails A guide to share with your team.
- Managed Microsoft 365 The tenant your mail runs in.
Reviewed by Blake Bath, General Manager, on 30 October 2026. Check Point behaviour from Check Point's documentation. Business email compromise actions from ASD. Real Bytes' own email setup from Blake Bath. Check Point is a trademark of Check Point Software Technologies Ltd. ASD, Protecting against business email compromise; Check Point, Email Security admin guide; Check Point, inline protection for internal email