IDX·October 25, 2026·2 min read
Attackers rarely break in through clever technical exploits. They send an email that looks like it comes from a supplier, a bank, a delivery company or your own manager, and wait for someone to click.
The common forms
- Fake login pages: "Your mailbox is full, sign in to keep receiving mail." The link leads to a copy of a real login page.
- Invoice and payment fraud: a "supplier" announces new bank details, or "the CEO" urgently asks for a transfer.
- Malicious attachments: documents that ask you to enable macros, or archives containing programs.
- Fake renewal notices: for your domain, hosting or software, from companies you have never used.
Five habits that stop most attacks
- Check the sender's real address, not just the display name. Look for lookalike domains.
- Hover before you click. If the link does not go where it claims, do not open it.
- Never enter a password from an email link. Open the service directly in your browser instead.
- Verify payment changes by phone, using a number you already have, never one from the email.
- Report, do not delete. A quick message to IT protects colleagues who received the same email.
Technical controls that help
- Two-factor authentication, so a stolen password alone is not enough.
- SPF, DKIM and DMARC on your own domain, so attackers cannot easily send as you.
- Spam and malware filtering on every mailbox.
- Up-to-date software on every device.
Make it normal to ask
People click when they feel rushed or afraid of looking foolish. Make it clear that checking with IT or a manager is always welcome, and never punish someone for reporting a mistake.
At IDX
IDX business email includes antispam and malware filtering, and our team can help you set up DMARC on your domain. Read also multi-factor authentication everywhere.
IDX on digital infrastructure
Back to blog →