Cybersecurity · 3 min read
Phishing: how to spot a fraudulent e-mail
How to spot a phishing e-mail: the warning signs, recent variants (QR codes, fake MFA requests) and the right way to react when you work in an SME.
Phishing means posing as a trusted sender to obtain a password, a payment or the opening of a booby-trapped file. It is one of the most common ways into an SME, because it targets a person rather than a technical flaw.
Filters block a large share of these messages, but not all of them. Taking a few seconds to check before you click remains the best protection.
Signs to check before you click
- From
- Microsoft 365 <security@micros0ft-support.com> 1
- Subject
- Action required: your mailbox will be deactivated today 2
Hello,
We have detected unusual activity on your account. Unless you verify it within 2 hours, your mailbox will be permanently deactivated. 3
Verify my account 4
The warning signs
- 1 The display name looks official, but the real address imitates a known domain (a zero instead of the o).
- 2 The subject creates urgency to push you to act without thinking.
- 3 A threat and a very short deadline, with no verifiable detail about your account.
- 4 The button leads to a fake sign-in page. Hover over it to read the destination address.
- Urgency or pressure: a locked account, an unpaid invoice, a 'confidential' request from management.
- The sender's real address, not just the display name, and domains that imitate a real one (one letter changed, a hyphen added).
- Links: hover over them to read the destination address before clicking.
- Unexpected attachments: archives, HTML files, documents that ask you to enable content.
- A Microsoft 365 sign-in page reached through a link received by e-mail.
- An unusual request: new bank details, gift cards, login credentials.
Recent variants
- A QR code in an e-mail or a PDF, which leads to a fake sign-in page and slips past some filters.
- A fake document-sharing notification (SharePoint, OneDrive, electronic signature).
- MFA fatigue: repeated approval requests, in the hope that someone eventually accepts.
- A call from fake IT support, asking you to install a remote access tool.
- A text or instant message, which bypasses e-mail filtering.
When in doubt
- Do not reply and do not click.
- Check through another channel, using a number you already know.
- Report the message according to your company's procedure (report button or support).
- Delete it once reported.
If someone has clicked
The most important thing is to raise the alarm straight away, without fear of blame. A few minutes' head start makes a real difference: the password can be changed from another device, open sessions revoked and recent sign-ins checked.
If credentials were entered, also check the mailbox rules: attackers often create an automatic forwarding or deletion rule to monitor conversations without being seen.
What reduces the risk
- E-mail filtering that is configured and monitored.
- Multi-factor authentication on every account, with phishing-resistant methods for sensitive accounts.
- SPF, DKIM and DMARC on your domain, to limit spoofing of your own address.
- Regular awareness training for staff, with simulations measured per team and never by name.
Further reading
-
Cybersecurity · 2 min read
Multi-factor authentication (MFA) for SMEs
Multi-factor authentication protects your Microsoft 365 accounts. Which methods to choose, and how to roll out MFA in an SME without locking your teams out.
-
Cybersecurity · 2 min read
Fake IBAN fraud: protecting your payments
Payment fraud via a fake supplier, a fake CEO or a hacked mailbox: how fake IBAN fraud works and the simple rules that protect an SME's outgoing payments.
-
Cybersecurity · 3 min read
Ransomware: what to do in the first hour
Files encrypted, ransom note on screen: what to do and what to avoid in the first hour of a ransomware attack, and how to prepare for one ahead of time.