Can a phishing e-mail come from a colleague's real account?
Yes, and it is one of the most effective forms because every technical check passes: the address is real, the signature is real, and the message may even reply to an existing thread. It happens when the colleague's mailbox has been taken over, often through an earlier phishing login, and the attacker uses it to send new lures to everyone in the address book, internally as well as to customers and suppliers. The warning signs are in the content, not the sender: an unusual request, a shared document you did not expect, a tone that does not fit, or a message sent at an odd hour. If you suspect it, do not reply to the e-mail; contact the colleague another way and tell IT. IT should then treat the sender's account as compromised: reset it, revoke its sessions, check its inbox rules and find out who else received messages from it.
Read next
Related questions
- A supplier asks us to change their bank details. How do we check it is genuine?
- We paid a fraudulent invoice. What should we do now?
- A supplier's e-mail account was hacked and they wrote to us. What should we do?
- Why can't a network security tool stop invoice fraud?
- Someone is sending fake invoices in our company's name. What can we do?
← All 29 questions on Phishing and e-mail aftermathAll topics