In an email compromise we reviewed, an attacker used an employee’s Microsoft 365 account to send fraudulent requests for quotes. Replies came back.
That detail matters. Someone receiving one of those messages could check the sender’s address and find the company’s actual email address. The attacker was sending from the account itself.
We tell people to check who an email is coming from. They should. But this case shows where that check falls short.
A company email address comes with credibility. Customers, vendors, and colleagues recognize it. Once someone gets into that account, they have a way to approach those people under your company’s name.
The investigation established that fraudulent requests went out and people responded. A reply alone doesn’t tell us what happened afterward, but it does show that the conversation continued.
For a business owner, that’s worth thinking through. If someone used your account to contact your clients today, what could they reasonably ask for? What would your clients be used to receiving from you?
Then look at how your own team handles incoming requests.
If a vendor changes payment instructions or someone asks for an unusual purchase, call and confirm using a number you already have on file. Replying to the same email gives whoever controls that mailbox another opportunity to answer. The FBI recommends verifying payment and purchase requests directly.
Make that verification part of the normal process. Your team should be comfortable pausing a request, including one that appears to come from you.
The email address is one thing to check. What someone is asking you to do deserves just as much attention.