Challenges
Protecting staff from phishing and fraud
Most attacks arrive by email and rely on one busy person clicking. Filter the inbox, protect the accounts and devices, train people for the rest, and never change a supplier's bank details on the strength of an email.
The challenge
An email from a known supplier asks you to update their bank details. A contact says they have left you a voicemail and you need to sign in to hear it. It is late on a Friday, the inbox is full and someone is chasing month-end. Phishing now copies the way your business writes and works, and it only takes one person to hand over a password or pay the wrong account.
If it is left
The first click is rarely the loss. A stolen password gives an attacker a mailbox to read for weeks, a forwarding rule to keep reading after the password changes, and the next genuine invoice to alter before it is sent on. Authorised push payment fraud works because the payment is made willingly, to an account that looks right, by a person doing their job, and banks do not always refund it. One such payment can exceed a year's IT budget.
What good looks like
A second-channel check on every change to a supplier's bank details, so the fraud fails even when the email gets through; Check Point Harmony Email in front of the mailboxes catching most of them before delivery; multi-factor authentication on every account and Microsoft 365 sign-ins watched for a stolen password in use; and staff who recognise the lure at 16:42 on a Friday because they have seen it in a simulation, with reports showing who improved.
What to do first
Before you call anyone
Change the payment process today
No change to a supplier's bank details, and no new payee, on the strength of an email alone. Ring the supplier on a number you already hold, not one in the email. This single rule stops most invoice fraud and costs nothing.
Switch on multi-factor authentication
For every Microsoft 365 user, today, not only administrators. A stolen password without the second factor is far less useful to an attacker.
Check the mailboxes for forwarding rules
Attackers set rules that forward or hide mail. A quick check of every mailbox's rules, especially finance and directors, often finds a compromise nobody knew about.
Tell staff what to do with a suspicious email
Not to click, and where to send it. If there is no reporting route, people delete it and the next person gets the same email.
Look at what the finance team receives
The supplier change requests, the urgent director requests, the voicemail links. The attacks that matter target those people; the training should too.
What we would do first
-
Baseline your risk
One targeted simulated phishing email shows who would have been caught, so training starts where it is needed.
-
Stop it before the inbox
Check Point Harmony Email in front of your mailboxes, quarantining phishing, malware attachments and links before delivery.
-
Protect accounts and devices
Multi-factor authentication, Microsoft 365 sign-ins monitored for account takeover, and a strong, unique password for every account.
-
Train for the risky moments
Short lessons and regular simulations around finance approvals and supplier changes, with reports on who improved and which lures still work.
How we approach it
-
Baseline
One targeted simulated phishing email, sent without warning, shows who would have been caught and which lure works on your team, and a review of what Microsoft 365 is already catching and what your staff are reporting.
-
Filter
Check Point Harmony Email and Collaboration connected in front of every mailbox, with impersonation rules for your directors, your domains and your regular suppliers, and the same scanning across Teams, SharePoint and OneDrive.
-
Harden the accounts
Multi-factor authentication for every user through Entra Conditional Access, legacy sign-in protocols blocked, Keeper giving every account a strong unique password, and Huntress identity monitoring watching Microsoft 365 sign-ins for a stolen password in use.
-
Train the people
Huntress security awareness training: short lessons on a schedule and regular simulations built around finance approvals, supplier changes and HR notifications, with anyone who clicks guided straight into the relevant lesson.
-
Report and tighten
A short report after each round: who improved, which lures still bite and where process should change, with the evidence ready for an insurer or a customer's questionnaire.
The services that apply
-
Security awareness training
The lures that get through the filter are the cleverest ones; the baseline, the lessons and the simulations are what give staff the reflex to stop and check.
-
Email filtering and cloud protection
Most phishing never reaches an inbox with a dedicated layer in front of it, including the impersonation of your own directors and suppliers that starts invoice fraud.
-
Endpoint and identity protection
For the day someone does click: Huntress identity monitoring catches a stolen password in use, and the endpoint protection catches what the link installed.
-
Password management
A password stolen from one site is tried against your Microsoft 365; Keeper makes every password unique so one leak stays one leak.
How you would buy it
Every hour we work falls under one of four engagement models. These are the ones that fit this situation; How we work compares all four.
-
01
Consumed
Ad hoc work, no commitment
If an email has already done its damage, incident work for a business without a retainer is charged for the time spent, approved as it unfolds; see the security incident page.
-
02
Fixed price
A defined piece of work or project
The baseline, the filtering roll-out and multi-factor authentication for every user are a short project priced as a fixed sum before we start.
-
03
Retainer
The way most of our clients work with us
The per-user tool charges are billed monthly; tuning, reviews and the follow-up with a team by our engineers are pre-authorised within your retained hours alongside the rest of your IT.
Who you would work with
A tech consultant
Runs the baseline, reads the results with you and sets the filtering and sign-in policies.
Our engineers
Connect the filtering, enforce multi-factor authentication and deploy the password manager, as Odyssey employees.
The service desk
Releases a genuine email held in quarantine within three rings, and takes the report when a member of staff sees something odd.
Further reading
-
Guide
APP fraud is surging: how to protect your business now
Authorised push payment fraud is growing fast. Three steps that make your business a much harder target.
Read the guide →
Questions people ask
What is the single most effective thing we can do?
Never change a supplier's bank details, or add a new payee, on the strength of an email. Ring the supplier on a number you already hold. It costs nothing and stops most invoice fraud even when the email is perfect.
Does Microsoft 365 not filter email already?
It filters some. Check Point Harmony Email adds a dedicated layer that inspects every message, attachment and link and catches more phishing, malware and impersonation before it reaches staff, and extends to Teams, SharePoint and OneDrive.
Why send staff simulated phishing emails?
They show who would have been caught in a real attack and which lures work on your team, so training can focus where it is needed and you can see the improvement in the next round. Anyone who clicks gets a short lesson, not a reprimand.
What happens to a genuine email that gets stopped?
It is held in quarantine, not deleted, and can be released straight away by the user or by our service desk.
What if a password is stolen anyway?
Multi-factor authentication is required at sign-in, so the password alone is not enough, and Microsoft 365 sign-ins are monitored for signs of account takeover, such as a login from somewhere nobody is or a session token reused, so it is spotted and the account secured.
How do we know the training is working?
You get reports on completion, who improved and which lures still work, so the next round focuses on the risks that remain, and the numbers are the evidence an insurer or customer asks for.
Will our insurer care?
Increasingly, yes. Multi-factor authentication on every account, email filtering, endpoint detection and staff training are the controls cyber insurers ask about, and the reports show them. Check the exact wording of your own policy with your insurer.
We think it has already happened. What now?
Call us: a person answers within three rings. Change the suspected account's password from a different device, tell finance to hold any payment or bank-detail change, and see our security incident page for the first hour.
Talk to a human about phishing and fraud
Call and we answer within three rings. Or tell us what you need and we will call you back at any time.