Scams and phishing
How phishing works when your email is in the cloud
Phishing used to mean a badly written email asking for bank details. Now it usually asks you to sign in, on a page that looks exactly like Microsoft's.
1 min readExplainer
The short version
A fake sign-in page, a hidden inbox rule, then invoices sent from your real mailbox.
What actually happens
It starts with a message that fits your day: a shared document, a voicemail, an invoice from a vendor you know. The link opens a sign-in page that passes everything you type to the real Microsoft, so the sign-in works and nothing seems wrong.
The attacker now has your signed-in session. They read your email quietly, looking for invoices and payments, and create an inbox rule that moves replies out of your sight.
Then they write from your real mailbox to the people who trust you: new bank details, an overdue invoice, a request to pay today. The email passes every check, because it really did come from your account.
What you can do today
- Confirm any change to payment details by phone, using a number you already have.
- Treat an unexpected sign-in page as a warning, even when it looks right.
- Report a suspicious message to IT instead of deleting it, so others can be warned.
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.