Monday morning, 08.43 am. The financial employee of a growing trading company receives an email that appears to be from Microsoft 365. The password expires that day and the employee has to log in again via a button. The email is neatly designed, uses the company logo and comes at a time when it is busy. This phishing attack case shows why technical security alone is not enough: attackers focus on normal work processes, time pressure and trust.
The employee clicks, enters username and password and continues with the work. Within minutes, an attacker logs in to the mailbox from abroad. He does not read all e-mails immediately, but observes first. Which suppliers are active? Who approves payments? Which invoices are about to expire? Two days later, a request follows that fits an existing supplier relationship. The bank account number is said to have changed.
This scenario is recognizable for many SME organizations. Not because employees are careless, but because phishing is becoming increasingly convincing. The attacker does not have to crack a system if one well-timed e-mail gives access to a business mailbox.
Phishing attack practical example: this is how fraud builds up
In this example, the attacker works in three phases. First, login details are captured via a fake login page. After that, the mailbox is used to collect information and credibly mimic communication. Finally, the attacker tries to obtain money, data, or additional access rights.
The original phishing email had some signs that stand out in retrospect. The sender address was similar to Microsoft’s, but used a different domain name. The button did not refer to the familiar Microsoft environment. The urgent wording – action required before 17:00 – was also intended to circumvent control. Separately, such signals are sometimes subtle. Together they should have been a reason not to click.
The attacker had also exploited a weakness in the existing security : multi-factor authentication was not mandatory everywhere. With only a password, the attacker could log in. In some environments, criminals still try to circumvent the second factor with a fake login page that also asks for a verification code, or with repeated notifications until someone presses ‘approve’ out of haste. Therefore, not only the presence of multifactor authentication makes a difference, but also the chosen method and design.
Once in the mailbox, the attacker set an inconspicuous rule. Messages from the real vendor were automatically moved to a hidden folder. As a result, the financial employee did not see a warning from the supplier that no account number change had been requested. The fraudster was then able to continue the correspondence from the real mailbox, with the correct signature, language, and previous email history.
Why this attack is so hard to spot
Many people think of phishing as bad Dutch, striking attachments or an unknown sender. Those variants still exist, but targeted attacks are more professional. They use public information, stolen email signatures, and existing conversations. Sometimes, even a legitimate vendor account is misused. A spelling check is then insufficient.
The biggest risk factor is context. A request to pay an invoice feels logical when the sender is a known contact and the invoice connects to ongoing work. Especially in organizations where one person prepares and approves payments, an attacker can abuse speed and limited counter-checking.
Even working methods that were once practical then become a risk. Think of bank account numbers that are allowed to change by e-mail, shared accounts or access that former employees still have. It’s not about distrusting employees, but about setting up processes in such a way that one mistake does not immediately lead to damage.
The moment when intervention makes the difference
In the example, a colleague discovers the fraud when a supplier calls about an outstanding invoice. The payment has already been made, but the money is in a foreign account. Immediate action is then decisive. The sooner the bank, IT partner and suppliers involved are informed, the greater the chance that a payment can still be stopped or investigated.
The first step is to immediately secure the affected account: revoke sessions, change the password, and re-register multifactor authentication. After that, it must be investigated whether the attacker had access to other accounts, set mailbox rules, downloaded files or sent emails on behalf of employees. Changing the password alone is insufficient if there is still an active session, forwarded mail or additional recovery method present.
Communication also deserves attention. Inform colleagues that suspicious emails may have been sent from an internal address. Warn suppliers and customers who may have been approached. Be factual: which mailbox has been affected, what period is affected and which request should recipients ignore? Clear communication prevents consequential damage and protects the relationship of trust.
Possible personal data or confidential business information also includes an assessment of the obligation to report and the contractual agreements with customers. That depends on what was accessible and whether data was actually viewed or exported. Therefore, record findings and measures taken from the start.
What measures had limited the damage?
No measure makes phishing impossible. The best protection consists of layers that complement each other. The right combination depends on the size of the organization, the systems used, and the sensitivity of the information.
Strong multi-factor authentication is an important foundation. Preferably, the organization uses a method that is more resistant to phishing than an SMS code or a simple approval notification. In addition, Conditional Access helps: a sign-in attempt from an unfamiliar location or unattended device can require additional authentication or be blocked. This does require careful design. Rules that are too strict frustrate employees who travel or work from home, while too broad exceptions reduce the effect.
Email protection can stop suspicious senders, malicious links, and unusual messages before they reach the inbox. But filters don’t capture everything. That is why it is wise to mark external emails recognizable, to properly manage domains that are allowed to email on behalf of the company and to monitor deviant mail behavior. Think of a new auto-forwarding rule, mass deletion of messages, or an unexpected login location.
At least as important is a payment process with independent control. For example, a supplier’s account number change is not only processed by email, but verified by phone via a previously known number. Payments above an agreed amount will be given a second agreement. Never use the phone number from the suspicious e-mail itself.
Awareness works best when it is in line with daily practice. A one-off presentation about phishing quickly fades into the background. Short, recurring exercises with recognizable situations help employees to make doubt normal. The desired reflex is not: I have to assess every e-mail myself technically. The desired reflex is: this request is different, I check it in a different way.
From incident to a better organized process
After a phishing incident, the focus is often on the person who clicked. This is understandable, but rarely productive. The better question is which combination of technology, process and guidance ensured that one click could have so much impact. Was multi-factor authentication active everywhere? Were reports about abnormal login attempts visible and followed up? Was one employee able to change an account number and prepare a payment?
A short evaluation often yields concrete improvements. Make it clear who to call if phishing is suspected, even outside office hours. Agree on who is authorized to block accounts and what information is needed by the bank or an external investigator. Then test whether this method also works when the regular contact person is absent.
For organizations without their own IT team, this is exactly where a committed management partner adds value. Nexer can help align security measures, Microsoft 365 management, monitoring, and work processes. Not with a standard list that disappears into a drawer, but with choices that fit the way your employees work and your company wants to grow.
A phishing email will sooner or later land in almost every organization. The question is not whether everyone recognizes every message perfectly, but whether your organization is set up in such a way that a questionable click moment does not jeopardize business continuity, customer trust or liquidity. That starts with a conversation about what needs to happen tomorrow if that one email is more convincing than expected.
