Website, IT & Security Services

At most galleries, the website and the database belong to the gallery assistant, alongside greeting visitors, processing photography, and monitoring the supply cupboard. That arrangement covers the content. It leaves out everything underneath it: the machines, the accounts, the backups, the email configuration that determines whether an invoice sent from your address can be forged. Those sit with nobody, which is fine until the morning it isn't.

A sale gets worked out over email, and the invoice goes out as a PDF. That is also, precisely, the attack. A documented run of cases across London and New York followed the same shape: someone gets into the correspondence, waits for the negotiation to finish, and changes the bank details before the invoice is sent. In one case the exchange ran through a domain one character off the real one. Nothing about it looks wrong at the time. The gallery finds out when the collector asks when the work is arriving.

What this looks like in practice

Nobody is going to ask you to change how the gallery works. The machines get set up so they back themselves up. The email gets configured so your address cannot be forged, and the lookalike domains get registered before someone else does. Payment instructions get a verification step that takes one phone call. Someone answers when the printer stops talking to the network the morning of an install. Most of it you will never think about again, which is the point.

Security

• Email authentication
• Lookalike domain registration
• Payment verification
• Phishing-resistant sign-in