In plain words
A newly registered look-alike domain, a missing DMARC policy or a firm address in a breach database can each be seen from outside before a forged request arrives.
Why it matters to a firm
Once a payment has gone it is rarely recovered. The time before the request is the time in which a firm can still act.
The check behind the finding
Check your DMARC record, look for look-alikes of your domain and check your firm’s addresses in a breach database.