Business Email Compromise doesn’t start with hacking. It starts with a single compromised mailbox.

Business Email Compromise doesn’t start with hacking. It starts with a single compromised mailbox.

phishing 101 to 102

How it happens:

  1. Initial Access: The attacker gains access to a mailbox protected only by a password, with no Multi-Factor Authentication (MFA).
  2. Reconnaissance: They monitor email threads to understand invoicing workflows, client relationships, and payment patterns.
  3. Impersonation: They register a deceptively similar domain to the compromised account.
  4. Execution: They impersonate the victim and instruct clients to remit payment to a new bank account controlled by a money mule. Alternatively, they impersonate the business owner to authorize an urgent, fraudulent transfer from the accounts department.

The Result:
The business attempts to recover payment, only to learn the client has already paid — to the attacker. Or, funds have already been wired to an untraceable account based on a seemingly legitimate internal request.

MFA is not an IT feature. It is your last line of defense.

Is Microsoft ditching SMS for Multi-Factor Authentication (MFA)?

Microsoft is discontinuing support for SMS in specific sign-in scenarios. This includes sign-ins from new devices and those that need multi-factor authentication (MFA).

The reason behind this move is to step up security and minimize the chances of unauthorized access.

Typically, the concern arises because employees might not want to use their personal mobile devices to verify their access.

Customers have the option to establish a conditional access policy to reduce the frequency of MFA prompts when they’re in trusted locations. To do this, you’ll need at least one Azure AD P1 (Microsoft Enterprise ID P1), Office 365 E3 Plan, or Office 365 Business Premium subscription.

Another choice is to get a FIDO2 key or a FIDO2-compliant pass for each user. If you encounter any difficulties while setting up MFA using these methods, feel free to reach out to us for assistance.