In plain words
A newly registered lookalike domain, a missing DMARC policy or a staff password in a breach database are each visible from outside before a forged request arrives.
Why it matters to a firm
Once a payment has gone, it is rarely recovered. The time between the preparation and the request is the time in which a firm can still act.
How anyone can check it
Check your DMARC record, search for lookalikes of your domain and check staff addresses in a breach database.