At a glance
- Phishing remains the most common entry point for attacks on companies: it relies on urgency, authority and distraction.
- Before clicking: check the real sender, hover over links and be wary of requests for credentials or payments.
- If you clicked or entered your credentials: change the password immediately, alert IT and do not delete the email.
- If you made a payment: contact your bank immediately and report it to the police.
How to spot a phishing email
- Sender: the display name may be a colleague or supplier, but the real address is different or has small variations in the domain.
- Urgency or fear: "account blocked", "payment due today", "final notice": designed to make you act without thinking.
- Links: hovering over the link reveals an address that does not match the expected site.
- Unexpected attachments: invoices, shared documents or compressed archives nobody was expecting.
- Unusual requests: entering your password, approving a sign-in, changing a supplier's bank details, buying gift cards.
The most common variants in companies
Fake Microsoft 365 sign-in page
A "shared document" or "mailbox full" email leads to a page identical to Microsoft's that steals username and password. The more advanced variants also intercept the MFA code, which is why phishing-resistant methods such as passkeys are needed.
Bank detail change and fake supplier
An email that appears to come from a supplier, sometimes from a genuinely compromised mailbox, announces new bank details. Every change of bank account must be verified by phoning a number you already know, never the one in the email.
QR codes and text messages
The link may be hidden in a QR code in an attachment or arrive by SMS or WhatsApp: the same rules apply, with extra care because the address is less visible on a smartphone.
Repeated MFA prompts
If unrequested sign-in approval notifications arrive, someone already knows the password: do not approve them and alert IT immediately.
What to do if you clicked
- Don't panic, but act at once: the first minutes matter.
- If you entered your credentials, change the password immediately from a safe device and alert IT so they revoke active sessions and check MFA.
- If you opened an attachment, disconnect the computer from the network and call IT without shutting it down.
- Do not delete the email: it is needed to analyse the attack and block the same message for colleagues.
- If you made a payment, contact your bank immediately to try to recall the transfer and report it to the police.
- Check your mailbox: forwarding rules or sent messages you do not recognise are signs of compromise.
Obligations not to forget
If the attack involved personal data, the company must assess notification to the Italian Data Protection Authority within 72 hours, as required by the GDPR. For companies subject to NIS2, a significant incident must be reported to CSIRT Italia with an early warning within 24 hours. That is why IT must be alerted at once: it takes time to understand what happened.
How to prevent it
- Short, regular training with realistic phishing simulations.
- Multi-factor authentication on all accounts, ideally phishing-resistant.
- Advanced email filtering and SPF, DKIM and DMARC records on the domain.
- A written procedure to verify bank detail changes and urgent payments.
- A simple channel to report suspicious emails to IT.
Read more in the guides Secure Microsoft 365 and SME cybersecurity checklist.
How ALAconnect works
ALAconnect protects company email with filters and secure configurations, runs training and phishing simulations for staff and responds to incidents to contain the attack and reconstruct what happened. Discover the Cybersecurity service or contact us.