You Have Mail, And Some Of It Is Not From Who It Says

The message that costs a business money almost never looks like an attack. It looks like an invoice, or the owner asking a quick favor. Open the five below and see how you do.

Five messages, and not all of them are real

Open each one and decide before you read the answer. These are patterns that arrive at real businesses every week.

• Accounts, at a supplier you use Invoice 4471 attached, updated bank details 9:14 AM

  Not real

  The supplier is real and the invoice is not. The account details are new, the amount is close to what you normally pay, and the sending address reads correctly at a glance because a single letter has been swapped. Changed bank details are worth a phone call to a number you already had, every single time.

• Microsoft 365 Your password expires today 9:41 AM

  Not real

  The sign in page it leads to is a perfect copy. The only thing wrong with it is the address at the top of the browser, which is the one part nobody reads. This is the message multi-factor authentication exists for.

• Your managing director Are you at your desk? 10:02 AM

  Not real

  It's short and friendly, and it asks for nothing at all. That's the design. The request arrives in the second message, once somebody has replied and the conversation has started to feel normal. Check the address rather than the display name.

• A colleague, two desks away Here is that file you asked for 11:20 AM

  Real

  This one is genuine, and so are almost all of them. That is exactly what makes the other four work: nobody can stay suspicious of two hundred messages a day, which is why the filtering has to do most of the job before a person ever sees it.

• IT Support We are migrating your mailbox tonight 2:35 PM

  Not real

  Your IT provider has a name, and your staff should know it well enough to notice a message that does not use it. A provider your people can recognize turns out to be a security control, which isn't how most people think about knowing who answers the phone.

What we put between your staff and the inbox

• Filtering that removes most of it before anybody has to make a judgment call at all.
• Multi-factor authentication on every mailbox, so a password on its own stops being enough.
• A rule that marks mail claiming to come from inside the company but arriving from outside it.
• Somebody to forward the strange ones to, who answers without making anybody feel foolish for asking.

How this goes

1. We look at what's arriving

We check what reached your mailboxes last month and what got past the filters.

2. The unglamorous things get switched on

Multi-factor authentication and external sender marking get turned on, and the filtering gets tuned to your mail.