An email arrives just before you leave a job: a supplier has “updated their bank details”, or Microsoft supposedly needs you to confirm your password. The request may fit your working day closely enough to feel ordinary. That is a reason to verify it carefully.
Check the request as well as the sender
A familiar display name is not enough. Look at the full address and what the message asks you to do. Unexpected urgency, a changed payment destination or a request to enter credentials deserves a separate check.
Good spelling does not make an email safe. Nor does an existing conversation: a compromised account can send messages that appear to come from someone you know. The ACSC’s email security guidance explains impersonation and phishing risks.
Verify through a channel you already trust
For a changed invoice or payment request, call a contact using a number from your established records. Do not use the new number supplied in the suspicious message. For an account alert, open the service through your usual bookmark or app and check there.
For a small business, agree on this verification step in advance. A receptionist, apprentice or casual team member should feel able to pause a request without being pressured to “just get it done”.
Keep the process simple: identify the unusual request, confirm it independently, then record who checked it. Verification is useful even when the request turns out to be legitimate.
If you clicked but did not enter anything
Close the suspicious page. Do not continue downloading files, installing software or following its instructions. Tell your IT contact what happened, including whether a file downloaded or opened. Clicking a link does not establish that a device is infected, but the next actions and any downloads matter.
If a device starts behaving suspiciously or you ran an unexpected attachment, seek help promptly. Do not reset or wipe a business device before discussing the incident; useful evidence and important files may be lost.
If you gave away credentials or approved a login
Use a trusted device and the service’s genuine website to secure the account, and involve your administrator promptly. Changing the password is only one part of recovery. Review active sessions, recovery methods, unexpected forwarding rules and connected applications, as appropriate for the service.
Follow the ACSC’s compromised email recovery guidance. If money was transferred, contact your bank immediately using its official contact details. Warn affected colleagues or contacts through a trusted channel when necessary.
Make the next incident easier to handle
Write down who staff should contact and encourage quick reporting, even after a mistake. Review multifactor authentication and the new employee account checklist so security is part of everyday setup.
SouthlineIT can help with Microsoft 365 account settings, suspicious software and IT troubleshooting. Describe what happened and when, but do not include passwords or authentication codes in an enquiry.
Frequently asked questions
Can an email from a real supplier still be unsafe?
Yes. The sender’s account may be compromised, or the address may only look similar. Independently verify unusual requests, particularly changes to payment instructions.
Does changing my password fix a compromised mailbox?
It is an important step, but may not be sufficient. Sessions, recovery methods, forwarding rules and connected apps may also need review by the account owner or administrator.
Should I approve an MFA notification to make it stop?
No. Do not approve a sign-in you did not initiate. Contact your administrator or follow the service’s account security process from a trusted device.