The pattern is consistent. An attacker gains access to one mailbox, usually through a reused password with no second factor. They read for weeks. When a genuine invoice is due, they send a message from the real account, or a look-alike domain, asking for payment to a new account. The finance person sees a familiar thread and pays.
The UAE is a high-value target because payments are large, international and fast. Once funds leave for an overseas account, recovery is rare.
Four controls stop almost all of it. Multi-factor authentication on every mailbox, which blocks the initial access. Email authentication (SPF, DKIM and DMARC at p=reject) so your domain cannot be spoofed and look-alike sends are flagged. Impersonation protection in the email filter, which catches display-name tricks. And a finance rule with no exceptions: any change to supplier bank details is confirmed by phone, to a number already on file, before payment.
We configure the first three under the Cybersecurity service and help you write the fourth into your payment procedure. None of it is expensive. All of it is cheaper than one wrong transfer.