What happened
A small legal practice received an email that appeared to come from its principal partner, requesting an urgent wire transfer to a “new client account”. Two staff almost processed it before the partner called to say he'd never sent it.
What we did
- Investigated how it got through: a spoofed internal address and no DMARC
- Reconfigured the practice's Microsoft 365 security settings
- Set up a verification process for any payment request over $5k
- Ran a forty-minute spear-phishing training session for all six staff
The outcome
The practice is now on an annual support contract.
“Best IT decision we've made.”
The lesson
Always verify payment requests by phone on a known number, even when the email looks like it's from your boss. DMARC stops your own domain being faked.