How Kimpa Stops Business Email Fraud for More Than 10,000 Businesses With Ollandi

Kimpa, a security-first, fraud-resistant, private distributed business email and workspace, uses Ollandi Identity Defense to stop business email fraud at the mailbox, before a fraudulent request reaches the person who approves the payment.

Most cyberattacks start in the corporate inbox

Three in four cyberattacks begin with a phishing email, according to the UAE Cyber Security Council. In the European Union, ENISA found phishing was the leading way attackers got in, behind 60% of the incidents it analysed. The corporate inbox is the front door to everything else a business runs: a password stolen there opens the network, the cloud and the payment systems.

Business email fraud is the most direct form of that attack. It rarely starts with the email that asks for money. It starts weeks earlier, with a password.

An employee in a finance team receives a message asking them to sign in and review a shared document. The sign-in page looks right. They enter their password. The attacker now has it.

The attacker does not act straight away. They sign in quietly, read the mailbox and learn how the business works: which suppliers it pays, when invoices fall due, who approves payments and how they write. Nothing they do looks unusual from the inside. The account is real. The address is real.

Then, at the right moment, they send one email from that genuine mailbox. It follows a real thread with a real supplier, uses the right names and asks for one small change: please pay this month's invoice into a new account.

The colleague who receives it has no reason to doubt it. It comes from someone they work with every day. The payment goes out. By the time anyone notices, the money has moved on.

A second version needs no stolen password at all. The attacker registers a domain one letter away from a real supplier's and writes from it. To a busy reader, the two addresses look the same.

This is why business email compromise is one of the costliest crimes businesses face. The FBI's Internet Crime Complaint Center recorded about $3.05 billion in reported business email compromise losses in 2025, out of $20.88 billion in total reported cybercrime losses.

Why the inbox alone cannot stop it

Most email security inspects the message. It looks for malicious links, infected attachments and forged senders.

A fraudulent request from a compromised mailbox has none of these. It is sent by the real account, from the real domain, in the real thread. Every check on the message passes. The only sign that something is wrong is the identity behind it: who signed in, from where, and what they did next.

How Kimpa stops it

Kimpa runs a custom fraud-resistance deployment of Ollandi Identity Defense for every mailbox. Identity Defense follows every sign-in, session and privilege change behind each Kimpa account, continuously.

Replay the same attack on Kimpa.

The attacker signs in with the stolen password. Ollandi sees it at once. The sign-in, and what follows it, does not fit the history of that mailbox. Ollandi weighs the evidence: is this the real employee, a colleague with delegated access, or someone using stolen credentials? As the evidence builds, the picture becomes clear.

Ollandi requires the user to authenticate again and revokes the suspicious session. The attacker loses access before they have learned the business, and long before they can send the request that would have moved the money. Each action is reversible, and runs within the limits Kimpa has set. Every observation, action and outcome is recorded for review.

The look-alike version is stopped at the inbox. When an address imitates a domain the recipient knows, Kimpa shows a warning above the message before they reply, pay or share a file. Genuine senders who carry Kimpa Verified show their reviewed organisation name and logo, so the difference between a real supplier and an impersonator is visible at a glance.

Together, these close both routes. A fraudulent request is stopped whether it comes from a look-alike domain or from a genuine mailbox in the wrong hands.

What changes for Kimpa's customers

More than ten thousand businesses run their email on Kimpa. For them, fraud resistance is not an extra product to buy and configure. It is part of every mailbox.

• Stolen passwords are contained before an attacker can turn them into a fraudulent payment request.
• Look-alike senders are exposed before anyone acts on them.
• Finance and operations teams can trust the requests that reach them, instead of second-guessing every message.
• Administrators can end sessions, suspend a compromised mailbox and review a complete record of what happened.
• Every message carries end-to-end protection by Ollandi, and business data stays private.

Deployment

• Product: Ollandi Identity Defense, in a custom fraud-resistance deployment for every Kimpa mailbox.
• Coverage: mailbox identities, sign-ins, sessions and privilege changes, with end-to-end protection by Ollandi.
• Operating control: Custom, set for mailbox fraud resistance.