What happened
A small physio clinic was hit with phishing emails every week: fake invoice requests, “your Microsoft 365 has expired” messages and more.
What we did
- Set up proper email filtering rules on the clinic's Office 365 tenant
- Configured SPF and DKIM records that had never been set up
- Ran a thirty-minute session for the two receptionists on what to do when something looks off
The outcome
Zero phishing emails have got through in the four months since.
“We've had zero phishing hits since. That's been four months.”
The lesson
Email authentication (SPF, DKIM and DMARC) plus a little staff training stops most phishing.