Phishing & threats
Phishing, spoofing, business email compromise and malicious attachments: how they work and how to stop them.
Start here
More guides
AI phishing emails: what has changed and what still stops them
How generative AI changes phishing, from flawless grammar to cloned voices, according to the FBI and NCSC, and which defenses still stop AI-written attacks.
9 min read Phishing & threatsSigns your business email account has been compromised, and what to do
The warning signs of a hacked business mailbox, from hidden inbox rules to MFA prompts, and the step-by-step response for Microsoft 365 and Google Workspace.
10 min read Phishing & threatsEmail bombing and subscription bombing: what it is and how to respond
Email and subscription bombing floods an inbox to hide a fraud alert or set up a fake help-desk call. How it works, what to do, and how to defend your team.
9 min read Phishing & threatsMicrosoft 365 user restricted from sending (550 5.1.8): how do you investigate and unblock it?
Fix 550 5.1.8 Access denied, bad outbound sender: why Microsoft 365 restricts users, how to check for compromise, unblock on Restricted entities, prevent it.
9 min read Phishing & threatsHow does adversary-in-the-middle phishing bypass MFA, and what stops it?
How AiTM phishing kits steal session cookies to get past SMS, app code and push MFA, which methods are phishing-resistant, and how to lock down Microsoft 365.
10 min read Phishing & threatsAI voice cloning and deepfake BEC: how the attack works and how to verify requests
How criminals pair email with cloned voices and deepfake video calls to impersonate executives, what the FBI says, and the verification steps that stop it.
10 min read Phishing & threatsCalendar invite phishing: how fake meeting invites work and how to stop them
How fake meeting invites and .ics files put phishing links on your calendar, the Google Calendar and Outlook settings that help, and how to remove spam events.
8 min read Phishing & threatsCallback phishing: why fake invoice emails ask you to call
Callback phishing (TOAD) emails fake an antivirus, Geek Squad or PayPal charge and push you to call. Why filters miss them and what to do next.
9 min read Phishing & threatsCharity and disaster relief scam emails: how to give safely
How fake charity and disaster relief emails exploit tragedies, the FBI and FTC warning signs, how to verify a charity with the IRS, and safer workplace giving.
9 min read Phishing & threatsClickFix and fake CAPTCHA emails: how the paste-a-command trick works
ClickFix pages tell you to press Windows+R and paste a 'verification' command that installs malware. How the emails work, which policies help, what to do.
9 min read Phishing & threatsCrypto investment scam emails: pig butchering, fake platforms and recovery scams
How crypto investment and pig butchering scams use email, what the FBI's 2025 IC3 figures show, the red flags, and how recovery scams target victims again.
10 min read Phishing & threatsWhat to do when scammers impersonate your company to your customers
When criminals email your customers pretending to be you: enforce DMARC, watch for lookalike domains, get fake sites taken down and warn customers safely.
9 min read Phishing & threatsWhat is display name spoofing, and how do you stop it?
Why email showing your CEO's name from a free account passes every check, how it differs from domain spoofing, and the Microsoft 365 and Gmail settings to use.
9 min read Phishing & threatsDomain renewal scam emails: how to spot fake expiry notices
How to spot fake domain renewal and expiry emails, .cn brand registration scares, search engine invoices and slamming, and how to check your real expiry date.
9 min read Phishing & threatsWhat is email thread hijacking, and how do you spot it?
How attackers reply inside real email threads from a compromised partner mailbox, why SPF, DKIM and DMARC still pass, the red flags, and how to verify safely.
9 min read Phishing & threatsFake Amazon order confirmation emails: how to spot them and check safely
How fake Amazon order, charge and account-locked emails work, how to check your real orders and Message Center safely, and where to report Amazon scam emails.
8 min read Phishing & threatsFake bank alert emails: how to spot them and what to do
How fake bank fraud alerts, locked-account and confirm-this-transaction emails work, how banks really contact you, and what to do if you clicked or paid.
9 min read Phishing & threatsFake court notice and jury duty scam emails: how to tell and what to do
Emails saying you missed jury duty, owe a court fine or must appear at a hearing are usually scams. How courts really contact you and how to check a notice.
9 min read Phishing & threatsFake delivery notification emails: how to spot and report parcel scams
How fake USPS, UPS, FedEx and DHL delivery and customs fee emails work, how to check a parcel safely, and each carrier's real address for reporting scams.
9 min read Phishing & threatsFake DocuSign emails: how to spot e-signature phishing
How fake DocuSign and e-signature emails work, including abuse of real DocuSign accounts, how to check an envelope with its security code, and how to report it.
9 min read Phishing & threatsFake job offer emails: how recruitment scams work and how to stop them
How fake recruiter and job offer emails work, from equipment check scams to stolen IDs, the FTC's red flags, and what to do when scammers pose as your company.
9 min read Phishing & threatsFake Microsoft login pages: how to spot them and what to do
How fake Microsoft 365 and Outlook sign-in pages work, how to tell them from the real one, what to do if you typed your password, and admin controls that help.
10 min read Phishing & threatsFile-sharing notification phishing: how to check a shared file safely
How fake and real-but-abused OneDrive, SharePoint, Google Drive and Dropbox share notifications work, why they pass authentication, and how to check them safely.
9 min read Phishing & threatsHow to check if a link is safe before you click it
Check a link without clicking: preview it, find the real domain, spot subdomain and punycode tricks, read shortened and Safe Links URLs, and what not to do.
9 min read Phishing & threatsHTML attachment phishing and HTML smuggling: how they work and how to stop them
How .html, .shtml and .svg attachments open fake sign-in pages or build malware in the browser (HTML smuggling), why filters miss them, and how to block them.
9 min read Phishing & threatsIRS Publication 4557 and the WISP: the email controls tax professionals need
What IRS Publication 4557 and the WISP requirement expect from tax professionals' email: MFA, encrypted client files, phishing defenses, logging and a breach plan.
9 min read Phishing & threatsMailbox full and account suspended phishing: how to spot and stop it
How 'mailbox full', 'account suspended' and 'email upgrade' phishing works, and how to check real mailbox storage in Microsoft 365 and Google Workspace.
8 min read Phishing & threatsMicrosoft 365 Direct Send spoofing: how it works and how to block it
How attackers abuse Microsoft 365 Direct Send to spoof internal mail, what Set-OrganizationConfig -RejectDirectSend blocks, and what to check first.
9 min read Phishing & threatsMicrosoft Teams phishing: how fake help desk chats work and how to stop them
How attackers use external Teams chats to pose as your IT help desk, often after an email flood, and the Teams external access settings that shut them out.
9 min read Phishing & threatsWhat is OAuth consent phishing, and how do you stop it in Microsoft 365?
How illicit consent grants give attackers mailbox access without a password, how to restrict user consent in Entra ID, and how to review and revoke app grants.
9 min read Phishing & threatsWhy does Office block macros in files from the internet?
Why Office blocks VBA macros in files from the internet, what the SECURITY RISK banner means, how Mark of the Web works, and how admins allow trusted macros safely.
9 min read Phishing & threatsPassword-protected ZIP attachments: why they're risky and how to handle them
Why attackers send encrypted ZIP, 7z and RAR files with the password in the email, how containers dodge Mark of the Web, and how to quarantine them.
9 min read Phishing & threatsPayroll diversion scam emails: how to stop direct deposit fraud
How payroll diversion scams use fake 'change my direct deposit' emails to HR, the red flags to look for, and a verification procedure that keeps salaries safe.
9 min read Phishing & threatsPDF phishing attachments: how they work and how to stop them
How phishing PDFs carry links, QR codes, fake secure-document lures and scripts, why they pass filters, how users should handle them and which controls help.
9 min read Phishing & threatsHow does ransomware get in through email, and how do you stop it?
How ransomware arrives by email through phishing links, attachments, stolen passwords and fake IT calls, what CISA's #StopRansomware Guide advises, and next steps.
10 min read Phishing & threatsReal estate wire fraud: how fake closing instructions work and how to stop them
How criminals send fake closing and wiring instructions to home buyers, how to verify a wire safely, what title and escrow firms should do, and what to do fast.
9 min read Phishing & threatsSocial Security impersonation emails: how to spot and report them
Fake Social Security statement and suspended-SSN emails explained: what SSA will never do, how to check your real account, and how to report to the SSA OIG.
8 min read Phishing & threatsSpear phishing vs phishing vs whaling: what's the difference?
Phishing, spear phishing and whaling compared: official definitions, a side-by-side table, realistic examples, and the defenses that work against each type.
8 min read Phishing & threatsVoicemail phishing emails: how to spot fake missed call alerts
How fake voicemail and missed call emails use HTML, SVG and EML files to steal passwords or drop malware, red flags, and how to check your real phone system.
8 min read Phishing & threatsW-2 phishing scams: how to protect payroll data in tax season
How W-2 phishing scams trick HR into sending employee tax data, how fake IRS emails work, where to report them, and the steps to take if W-2s were already sent.
9 min read Phishing & threatsWhy am I getting bounce messages for emails I didn't send?
Getting bounce messages for email you never sent? That's backscatter. Learn why it happens, how SPF, DMARC and recipient validation reduce it, and what to do.
8 min read Phishing & threatsWhich email attachment types are dangerous, and what should you block?
Which email attachment types are dangerous, from .exe and scripts to macros, HTML, SVG, ISO and OneNote files, and which to block outright versus quarantine.
9 min read Phishing & threatsEmail security awareness training for small businesses: what works
What effective email security training looks like for a small business: CISA and NCSC guidance, phishing simulation caveats, and building a reporting culture.
9 min read Phishing & threatsEmail security for nonprofits: the risks and a practical setup
Email security for nonprofits: donation and BEC scams, volunteer and shared accounts, Microsoft and Google nonprofit programs, and a practical setup checklist.
9 min read Phishing & threatsFake invoice and payment emails: how to spot them
How to spot fake invoice emails: bogus renewal notices, domain and SEO bills, overdue invoices and refund call scams, plus an invoice check for staff.
9 min read Phishing & threatsGift card scam emails from your "boss"
Your 'CEO' wants gift cards and secrecy? How the boss gift card scam works, the FTC's advice, a verification policy for staff, and what to do if you paid.
8 min read Phishing & threatsHow to spot a phishing email
The warning signs of a phishing email, shown on three annotated examples (password resets, invoices, boss requests) and a 10-point check before you click.
9 min read Phishing & threatsWhat is lookalike domain phishing, and how do you stop it?
How lookalike, cousin and homoglyph (IDN) domains fool your staff, why DMARC can't stop them, and practical steps to detect, warn on and register them.
8 min read Phishing & threatsPhishing statistics for 2026, with sources
Sourced phishing and BEC statistics from the FBI IC3 2025 report, APWG Phishing Activity Trends and the Verizon 2026 DBIR, with year and source on each row.
8 min read Phishing & threatsWhat is QR code phishing (quishing), and how do you stop it?
How QR code phishing emails work, why link scanners can miss them, what the FBI, FTC, CISA and NCSC advise, and the training and controls that reduce the risk.
8 min read Phishing & threatsHow to report a phishing email
How to report phishing in Outlook and Microsoft 365, Gmail and Apple Mail, plus where to send it next: APWG, the FTC, CISA, the FBI's IC3 and the UK's NCSC.
9 min read Phishing & threatsSextortion scam emails: "I hacked your camera"
Got an email saying a hacker recorded you through your webcam and wants Bitcoin? Why it's a bulk scam, what the FBI and FTC advise, and the steps to take now.
8 min read Phishing & threatsSomeone is sending email from my address: spoofed or hacked?
Emails going out in your name? How to tell if your address is spoofed or your account was hacked, using Sent Items and headers, and what to do in each case.
9 min read Phishing & threatsHow to stop phishing emails in Microsoft 365
Set up Microsoft 365 anti-phishing policies, impersonation protection, external sender tags and user reporting, and decide when to add an email gateway.
9 min read Phishing & threatsHow to stop vendor invoice fraud and payment redirection
How vendor invoice fraud and payment redirection scams work, the red flags, a call-back procedure for bank detail changes, and what to do if money was sent.
9 min read Phishing & threatsWhat is email spoofing?
Email spoofing explained: display-name, exact-domain and lookalike spoofing with examples, what SPF, DKIM and DMARC catch, and how to spot a spoofed email.
9 min read Phishing & threatsWhat to do after clicking a phishing link
Clicked a phishing link or typed your password into a fake page? Steps for users and admins: reset, revoke sessions, add MFA, check mailbox rules and report it.
9 min readAbout these guides
Email attacks on businesses fall into a few families. Phishing tries to get someone to click a link or open a file. Spoofing and lookalike domains make a message appear to come from someone you trust. Business email compromise (BEC) and vendor invoice fraud often skip malware entirely and simply ask for a payment, usually to a changed bank account. QR-code phishing hides the link in an image, so it tends to be opened on a phone rather than on a protected work computer.
These guides explain how each one works, what the warning signs look like, and which controls actually help:
- Technical controls: inbound filtering at the MX, attachment-type rules, and DMARC enforcement on your own domain so attackers can't send as you.
- Process controls: confirming payment changes through a phone number you already have, and a short plan for what to do when someone clicks.
- Recovery: the first steps after a click, an approved MFA prompt or a suspected compromised account.
No single control stops everything. A filter reduces what reaches people, authentication protects your domain's name, and a payment-verification habit catches requests that look perfectly legitimate. If someone has just clicked a phishing link, go straight to what to do after clicking a phishing link. To see whether your own domain can be spoofed, check its policy with the free DMARC Checker.
Frequently asked questions
What is the difference between phishing and business email compromise?
Phishing usually wants a click: a link to a fake login page or a malicious file. Business email compromise usually wants an action, such as a payment or changed bank details, requested in a plain message from a spoofed, lookalike or genuinely compromised account. BEC often contains no link or attachment for a filter to catch.
How do I check whether a payment request email is genuine?
Don't rely on the email itself. Confirm any new payee or changed bank details by calling a phone number you already have on file, not one in the message. Watch for urgency, requests for secrecy and a Reply-To address that differs from the sender. Apply the same check to requests that appear to come from senior staff.
Where should employees report a suspicious email?
Use the Report or Report phishing button in Outlook or Gmail if your organization has it turned on, and tell whoever runs your IT. Don't forward the message to colleagues to ask about it, and don't reply to the sender. If anyone clicked a link or entered a password, report that straight away so the account can be secured.