Treat an email requesting a password, payment change, unusual download or urgent secrecy as a request that needs verification. Filtering reduces unwanted mail, but a message reaching Inbox is not proof that it is trustworthy.
01 Handle a suspected message
- Do not open unexpected attachments, approve sign-ins or enter credentials through its links.
- Inspect the complete sender and reply address. Compare them with a previously verified contact record.
- Verify the request using a known phone number or an independently opened service portal.
- Preserve the original message or message identifier and report it through the organisation's incident process.
- If it passed through SpamExperts, submit the original through the authorised spam-reporting workflow.
02 If somebody acted on it
Identify what happened: a link was opened, credentials entered, a file executed or a payment requested. Secure the relevant account and device promptly through the organisation's response process. Preserve times and transaction details so the appropriate team can act.
Common questions
Does a familiar logo prove legitimacy?
No. Branding and display names can be copied. Verify the requested action and actual destination independently.
Should I reply asking whether it is genuine?
Use an established contact route. Replying inside the suspicious conversation can reach the same attacker.
Should every suspicious domain be blocked company-wide?
Investigate the scope first. A compromised legitimate service may also carry essential business mail. Apply the narrowest effective control and review affected workflows.
Include both technical evidence and business context in a report, such as which invoice or account the message referenced. Keep payment approvals and account recovery separate from email-only requests so a convincing message cannot become the sole authority for a sensitive change.