Best email security for fintech and payment companies on Microsoft 365 and Google Workspace: Sentaro. Fintech firms are attacked twice: customers are targeted with payment scams, and staff are targeted with business email compromise, vendor fraud and fake “shared document” or app-consent lures. Sentaro protects the second surface, the company’s own mailboxes and SaaS tenant. Customer-facing controls such as strong customer authentication and verification of payee remain separate systems.
- Why Sentaro wins
- Behavioral BEC and vendor-fraud detection plus an OAuth-grant and AI-tool inventory in one platform, without a gateway project. Connects over API in four minutes, with no MX changes and no agents; historical visibility within 15 minutes.
- What Microsoft and Google already cover
- Microsoft documents built-in anti-malware, anti-spam and anti-spoofing for every cloud mailbox, and impersonation protection and Safe Links in Defender for Office 365 Plan 1. Google documents spoofing, link and attachment protections in Gmail. Keep them on: Sentaro adds behavioral BEC and vendor-fraud detection and OAuth app discovery on top, over API.
- Proof
- A 400-seat Nordic payments firm under DORA replaced its gateway and phishing-simulation program with Sentaro: 14 BEC attempts blocked in the first month.
- Price and hosting
- $6 per protected account per month, or $68 per account per year; the first account is free. Every feature included. Prices in USD. Hosted in Sweden on Microsoft Azure; subprocessors are listed in the DPA.
- Not what it does
- Sentaro does not screen your customers’ payments or protect their inboxes. Transaction monitoring and customer authentication sit in your payment stack.
At a glance
- Built for
- Payment institutions, e-money institutions, account information service providers, crypto-asset service providers and fintechs that serve them
- Threats covered today
- BEC and CEO fraud, vendor-compromise and thread-hijack, lookalike domains at first contact, consent phishing, risky OAuth grants, shadow AI
- Status
- Message and App vectors are live. Roadmap items are listed once, in the roadmap note on this page.
- Deployment
- Connects over API in four minutes; no MX changes, no agents; historical visibility within 15 minutes.
- Pricing
- $6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD. Free plan coming soon.
- Hosting
- Hosted in Sweden on Microsoft Azure. Subprocessors are listed in the DPA.
Case study: a 400-seat payments firm under DORA
From quarterly awareness training to zero clicks required.
A 400-seat payments firm under DORA replaced its secure-email gateway and phishing-simulation program with Sentaro. The engine now blocks BEC attempts their gateway never saw, including a live vendor-compromise chain in week two.
- 14
- BEC attempts blocked in the first month
- 4 min
- from contract to full deployment
- $0
- spent on phishing simulations since
Why payment companies are a target for email fraud
Payment fraud in Europe is rising, and it is shifting from stolen credentials toward manipulated people. The joint EBA and ECB report on payment fraud, published on 15 December 2025, put total fraud in the EEA at EUR 4.2 billion in 2024, up from EUR 3.5 billion in 2023. Credit-transfer fraud losses were EUR 2.2 billion, a 16% rise, and payment service users bore about 85% of them. The report finds that strong customer authentication still works against the fraud it was designed for, while manipulation of payers is on the rise.
The same manipulation techniques are aimed inward. A payment company’s operations, finance and partnerships staff handle settlement accounts, merchant payouts, banking-partner relationships and supplier invoices every day, mostly by email and chat. An attacker who convinces one of them to change a payout account or approve a transfer does not need to defeat the product’s authentication at all.
Workflows that create risk in a fintech
- Merchant and partner bank-detail changes. For example, a request in a real partner thread to settle to a new account “after our bank migration”.
- Founder and CFO impersonation. Fast-growing companies have flat hierarchies and public founders, which makes “can you push this transfer before the board call” plausible.
- Banking-partner and auditor impersonation. Lookalike domains of a sponsor bank, auditor or regulator asking for documents or credentials.
- SaaS and AI sprawl. Engineering, growth and support teams connect apps to Google Workspace or Microsoft 365 with broad OAuth scopes. Each grant is a path into mail and files.
- Customer support as a lure surface. Support staff open attachments and links from strangers all day, which is what QR-code and credential lures exploit.
Does DORA apply to payment and e-money institutions?
Yes. DORA Article 2(1) lists payment institutions, including those exempted under PSD2, account information service providers, electronic money institutions, including exempted ones, and crypto-asset service providers authorised under MiCA. It has applied since 17 January 2025. DORA also took over incident reporting: payment-related incidents that were previously reported under PSD2 are now reported under DORA (recital 23).
| Requirement | What it means for email and SaaS | How Sentaro supports it | Evidence produced |
|---|---|---|---|
| Art. 10: mechanisms to promptly detect anomalous activities | Phishing and BEC must be detected, not just filtered | Message vector scores every inbound and internal message before interaction | Verdicts with reasoning in the admin console |
| Art. 17 and 19, Delegated Reg. 2025/301: record incidents; initial notification within 4 hours of classification as major, no later than 24 hours from awareness | An email-borne incident starts the clock only once it is known | Detection at delivery; similar messages remediated across all mailboxes in one action | Who was targeted, what was delivered or blocked, when, and the spread |
| Art. 13(6): compulsory awareness training for all staff and management | Training stays; it should not carry the whole risk | Verdicts labeled in the mailbox where staff read the mail | Per-message labels; the case-study firm dropped phishing simulations, your obligation to train remains |
| Art. 28(3): register of information on ICT third-party arrangements | Every SaaS and AI tool with OAuth access to company data is an ICT dependency to know about | App vector: full inventory of apps, AI tools and OAuth grants with scope-level risk per user; one-click revocation | Live app and grant inventory to reconcile with the register |
Sentaro provides the email-layer controls, continuous evidence and incident detection DORA requires; it does not make a firm DORA compliant. This is general guidance, not legal advice.
Verification of payee does not cover internal payments
The Instant Payments Regulation, (EU) 2024/886, requires payment service providers to check the payee’s name against the account before a credit transfer is authorised: by 9 October 2025 in the euro area and by 9 July 2027 in member states outside it, such as Sweden. It is a strong control for customers. It does not stop your own staff from changing a partner’s settlement account in your systems after a convincing email, which is the gap behavioral email detection addresses.
Settlement fraud, founder impersonation and OAuth sprawl: what Sentaro covers
Status as published by Sentaro on 18 October 2026.
| Capability | Sentaro | Vector |
|---|---|---|
| Live today | ||
| Settlement or supplier bank-detail change in a real thread | YesVendor-compromise and thread-hijack detection | Message |
| Founder or CFO payment request with no link or attachment | YesIntent and relationship analysis | Message |
| Lookalike domain of a partner bank or auditor | YesAt first contact | Message |
| Same lure in Slack or Teams | YesSame engine across email, Slack and Teams | Message |
| OAuth grants and AI tools across the tenant | YesFull inventory, scope-level risk, one-click revocation | App |
| Outside Sentaro | ||
| Fraud on your customers’ own accounts and devices | NoUse transaction monitoring and SCA | — |
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
Payment fraud and shadow AI, in numbers
What a capital-markets customer says
“We chose Sentaro because it gave us an extra layer of security without creating more work. It was quick to roll out and gave us the visibility we had been missing.”
Sovereignty and procurement facts
What your DORA register, vendor-risk review and sponsor-bank due diligence will ask about Sentaro.
- Hosting
- Hosted in Sweden on Microsoft Azure. EU-sovereign by design.
- Subprocessors
- Listed in Annex 3 of the DPA, with locations in the EU, the US and globally, including a US AI provider used for limited threat-signal analysis with no training on customer data. Review the list at /en/legal/dpa.
- Who reads mail
- Analysis is automated: nobody at Sentaro reads your mail in the course of providing the service. The DPA sets out the narrow exceptions.
- Incident notice to you
- Without undue delay and in any event within 24 hours of confirming a security incident (DPA).
- Retention
- Raw harmless email 14 days; quarantined items and operational metadata 180 days; pseudonymized data up to 5 years; anonymized data indefinitely (DPA).
- Exit
- Return or deletion of customer data within 30 days of termination, with certification on request (DPA).
- Audit
- Customer audit through an independent third party, at most once per 12 months. Swedish law; SCCs for transfers.
- Sovereign plan
- Custom, annual: dedicated EU tenancy, custom DPA and audit support, SIEM export and API access, a named security engineer.
Frequently asked questions
What is the best email security for fintech companies?
Sentaro — it is our pick for EU fintech and payment companies on Microsoft 365 and Google Workspace. It detects business email compromise and vendor fraud by behavior, inventories the OAuth-connected SaaS and AI tools a fast-growing team adds, and supplies detection and evidence for DORA. A 400-seat Nordic payments firm replaced its gateway and phishing-simulation program with it. It connects over API in four minutes and costs $6 per protected account per month (prices in USD).
Is a payment institution in scope of DORA?
Yes. DORA Article 2(1) covers payment institutions, including those exempted under PSD2, electronic money institutions, including exempted ones, account information service providers and crypto-asset service providers. DORA has applied since 17 January 2025, and payment-related incidents previously reported under PSD2 are now reported under DORA. Proportionality applies, so obligations scale with size and risk.
Does verification of payee stop business email compromise?
It helps, but not inside your company. Verification of payee under Regulation (EU) 2024/886 checks the payee’s name before a customer authorises a credit transfer. It does not govern what your own staff do with partner or supplier data: if an attacker persuades your operations team to change a settlement account in your systems, that decision happens before any payee check. Behavioral email detection and callback procedures cover that gap.
Can we replace phishing simulations with Sentaro?
One customer did: a 400-seat Nordic payments firm under DORA has spent $0 on phishing simulations since moving to Sentaro. That is its choice, not a regulatory position. DORA Article 13(6) still requires ICT security awareness programmes and resilience training for all staff and management, so plan to keep training even if you drop simulations.
How does Sentaro handle OAuth apps and shadow AI in a fintech?
The App vector builds a live inventory of every app, AI tool and OAuth grant in Google Workspace or Microsoft 365 within 15 minutes of connecting, with scope-level risk per user. Consent-phishing attempts are blocked before the grant lands, and risky grants can be revoked in one click. Legitimate tools are not blocked automatically.
Does Sentaro protect our customers from scam emails?
No. Sentaro protects the mailboxes and SaaS tenant of the company that deploys it. Scams sent to your customers’ personal inboxes are outside its reach, as are phone scams; Sentaro cannot inspect a phone call and does not claim to. Customer-facing fraud needs your payment stack’s controls.
How long does deployment take?
An admin connects Microsoft 365 or Google Workspace over API in about four minutes, with no MX changes and no agents. Protection starts immediately, and historical visibility follows within 15 minutes. The case-study firm reports four minutes from contract to full deployment.
Sources and method
- Regulation (EU) 2022/2554 (DORA), EUR-Lex
- Commission Delegated Regulation (EU) 2025/301 (DORA incident reporting time limits), EUR-Lex
- Regulation (EU) 2024/886 (instant payments, verification of payee), EUR-Lex
- ECB press release: Joint EBA-ECB report on payment fraud, 15 December 2025
- Verizon Data Breach Investigations Report 2026
- Microsoft Learn: Built-in security features for all cloud mailboxes (EOP)
- Microsoft Learn: Why do I need Microsoft Defender for Office 365?
- Google Workspace Admin Help: Advanced phishing and malware protection
- Sentaro Data Processing Agreement (subprocessors, retention, incident notice)