# Phishing and e-mail aftermath (FAQ)

> 29 questions on Phishing and e-mail aftermath, in plain language: what to check, what NetSenX shows and what a sensor cannot see.

Source page: https://netsenx.com/en/faq/phishing

## What is phishing?

Phishing is a message that pretends to come from someone you trust so that you click a link, open a file, type a password or send money. It arrives mostly by e-mail, but also by text message, phone call, chat and QR code. The goal is usually one of three things: your login details, a foothold on your computer, or a payment to the wrong account. Phishing works because it borrows real context: a parcel you are expecting, a shared document, an unpaid invoice, a message from the boss. It remains one of the most common first steps in breaches, which is why the defence comes in layers: e-mail filtering, multi-factor authentication (MFA), staff who report suspicious messages quickly, and payment rules that do not depend on an e-mail alone. A network sensor does not read your mail; it helps later, if a click leads to unusual traffic from the device.

https://netsenx.com/en/faq/what-is-phishing

## How can you tell that an e-mail is phishing?

Look less at spelling mistakes, which modern phishing rarely has, and more at what the message asks you to do. Warning signs: pressure to act now, a request to log in, pay, change bank details or open an unexpected file, a sender address that differs slightly from the real one, a reply-to address that goes somewhere else, and a link whose real destination, shown when you hover over it, does not match the company it claims to be. A message from a known colleague can still be phishing if their mailbox was taken over, so an unusual request is a reason to check through another channel, such as a phone call to a number you already have. If in doubt, do not click: report the message to IT and let them look. Reporting a false alarm costs a minute; ignoring a real one can cost far more.

https://netsenx.com/en/faq/how-to-spot-a-phishing-email

## I clicked a phishing link. What should I do now?

Tell IT straight away, even if nothing seemed to happen; speed matters more than embarrassment. Then, with IT: if you typed a password on the page that opened, change that password from a different, trusted device and end all active sessions for the account. If a file downloaded or opened, disconnect the computer from the network, by unplugging the cable or turning off Wi-Fi, but leave it switched on so it can be examined. Note the time, the message and the link so IT can block it for everyone and check who else received it. If you only opened the page and entered nothing, the risk is lower, but IT should still check the device with its security tools. Over the following days, watch for unexpected login prompts, MFA requests you did not start, or replies to e-mails you never sent.

https://netsenx.com/en/faq/i-clicked-a-phishing-link-what-now

## I entered my work password on a phishing page. What now?

Treat the account as compromised and act within a few minutes. Change the password from a trusted device, and if you used the same password anywhere else, change it there too. Ask IT to sign the account out of all sessions and revoke its access tokens, because many phishing kits steal the logged-in session itself, so a new password alone may not lock the attacker out. IT should then check the sign-in log for logins from unfamiliar places, review the MFA methods for a new phone or app the attacker may have added, and look for new inbox rules that forward or hide mail. If the account has administrator rights or access to finance systems, raise the priority accordingly. Identity steps come first here. Network monitoring helps afterwards, by watching for the follow-on activity a stolen login often leads to, such as remote access to internal servers.

https://netsenx.com/en/faq/i-entered-my-work-password-on-a-phishing-page

## An employee entered their password on a phishing page. What should we check on the network?

Do the identity work first: reset the password, revoke sessions, check the sign-in log and the MFA methods. Then look at the network for signs that the login was used to go further. Useful questions: did the employee's device or account connect to servers it never normally uses, such as file servers, the domain controller or finance systems? Did remote-desktop or remote-management sessions start from an unusual machine? Did any device begin regular, timed connections to an unfamiliar outside address, which can mean a remote-control channel? Did unusually large amounts of data leave the network? In NetSenX, the alert history and the network map show these patterns on every plan: beaconing, internal scanning, lateral movement and unusual outbound data volumes. If none appear in the days after the click, that is reassuring but not proof, because cloud mailboxes and SaaS apps are reached over the internet and that activity never crosses your network.

https://netsenx.com/en/faq/employee-entered-password-what-to-check-on-the-network

## How do you clean a computer after a phishing click?

A network tool cannot clean a device; that is the job of your endpoint protection and, when in doubt, a reinstall. A practical order: disconnect the device from the network but keep it powered on, so IT can capture evidence if needed. Run a full scan with your endpoint detection and response (EDR) or antivirus tool, and check for new programs, browser extensions, scheduled tasks and startup items. If anything suspicious ran, or the device belongs to an administrator or someone in finance, the safer choice is to wipe it and reinstall from a known-good image, then restore files from backup, rather than trust a cleanup. Before reconnecting, change the user's passwords from another device. Once it is back, keep an eye on its network behaviour for a few weeks: NetSenX can show whether it starts regular outbound connections or unusual traffic again.

https://netsenx.com/en/faq/how-to-clean-a-device-after-a-phishing-click

## After a phishing click, how do attackers get from one laptop to the rest of the network?

Usually in a few predictable steps. The malicious file or link gives them a remote-control channel back to their own server, which shows up as regular outbound connections. They then look around: which servers, shares and accounts exist, often by scanning the internal network or querying the directory. Next they collect more credentials, from the laptop's memory, saved browser passwords or other systems, and use them to log in to other machines with normal admin tools such as remote desktop, remote PowerShell or file shares. From there they aim for the domain controller, the backups and the data stores. Each step leaves a network trace: new connections between internal machines that rarely talk, scanning, admin protocols coming from an ordinary laptop, and data moving to unusual places. Those traces are what network detection and response (NDR) watches for, and why a phishing click does not have to end in a full breach.

https://netsenx.com/en/faq/how-attackers-move-from-a-phished-laptop-to-the-network

## Should employees report a phishing e-mail even if they did not click it?

Yes. A reported message lets IT remove the same e-mail from every other mailbox, block the sender and the link, and warn the colleague who might have clicked it tomorrow. Phishing usually goes to many people in the same company at once, so one early report can protect dozens. Make reporting easy: a report button in the mail client or a single forwarding address, and a quick thank-you every time, including for false alarms. Never punish a report, even when the person admits to clicking: fear of blame is what turns a five-minute fix into a three-week incident. Measure success by how many people report and how quickly, not only by how few click. Reports also show IT which lures are reaching staff, which helps tune the mail filters and the training.

https://netsenx.com/en/faq/should-employees-report-phishing-they-did-not-click

## Does security awareness training stop phishing?

It reduces the damage but does not stop phishing on its own, and it should not be your only defence. Good training shows people what current lures look like, makes reporting a habit and makes clear that a mistake reported early is a good outcome. Short, regular sessions work better than one long annual course. Phishing simulations can help if they are used to practise, not to shame: share results as team trends, follow a click with a two-minute lesson rather than a reprimand, and tell staff in advance that simulations happen. Some people will always click, because good lures are designed to look like ordinary work. So pair training with controls that do not depend on perfect judgment: mail filtering, multi-factor authentication that resists phishing, payment verification by phone, and monitoring that notices when a compromised device starts behaving differently.

https://netsenx.com/en/faq/does-security-awareness-training-stop-phishing

## What is spear phishing?

Spear phishing is phishing aimed at one person or a small group, written with details that make it believable: their name, role, current projects, suppliers or colleagues. Attackers collect those details from the company website, LinkedIn, press releases, earlier data breaches or a mailbox they already control. A message to an accounts clerk might mention a real supplier and a real invoice number; one to an IT administrator might look like an alert from a tool the company actually uses. When the target is a senior executive, it is sometimes called whaling. Because these messages are tailored, filters catch fewer of them and staff find them harder to spot. The best defences are process ones: verify unusual requests through a second channel, limit what you publish about internal roles and payment processes, and give the people with access to money or admin rights phishing-resistant MFA first.

https://netsenx.com/en/faq/what-is-spear-phishing

## What are smishing and vishing?

They are phishing by other channels. Smishing uses text messages, often about parcels, banks, tax refunds or a blocked account, with a link to a fake login page. Vishing uses voice calls: someone poses as IT support, the bank, a supplier or a manager and talks the person into reading out a code, installing a remote-support tool or approving a payment. Vishing has become a common way into companies because a convincing caller can get past controls that stop e-mail, for example by asking the help desk to reset an employee's password or register a new MFA device. Useful defences: a rule that IT never asks for passwords or codes by phone, a help-desk procedure that verifies identity before any reset, and the habit of calling back on a known number. A network sensor cannot hear calls, but it does show the new outside services a device starts talking to afterwards.

https://netsenx.com/en/faq/what-is-smishing-and-vishing

## What is QR code phishing?

QR code phishing, sometimes called quishing, hides the malicious link in a QR code: in an e-mail attachment, on a printed letter, on a parking meter or on a fake notice in the office. It works for two reasons. Mail filters check links but often cannot read a link inside an image, and people scan the code with their phone, which is usually outside company protection and shows only a short preview of the address. The page that opens typically asks for a Microsoft 365 or other work login, or for card details. Treat a QR code that asks you to sign in like any other link: check the address before entering anything, and if a message urges you to scan a code to keep your account active or to read a document, ask IT first. For companies, phishing-resistant MFA limits the damage when a password is typed into a phone.

https://netsenx.com/en/faq/what-is-qr-code-phishing

## What is business e-mail compromise (BEC)?

Business e-mail compromise is fraud in which criminals use e-mail to trick a company into paying them or handing over sensitive data. They either break into a real mailbox, often after a phishing login, or imitate one with a lookalike address. Typical variants: the fake CEO asking for an urgent confidential transfer, the supplier whose bank details suddenly change, the request to redirect an employee's salary to a new account, and the lawyer handling a secret deal. BEC often uses no malware and no link, only a convincing message at the right moment, which is why technical filters miss so much of it. It is one of the costliest forms of cybercrime: the FBI's Internet Crime Complaint Center reported about 2.8 billion US dollars of BEC losses for 2024. The strongest defence is a payment process that requires verification by phone, on a known number, before any change of bank details or unusual transfer.

https://netsenx.com/en/faq/what-is-business-email-compromise

## Can network monitoring stop CEO fraud?

Mostly no, and it is better to know that up front. In CEO fraud, an e-mail, call or chat message that seems to come from a senior manager persuades an employee to make a payment. The messages travel through your mail provider's cloud and the payment goes through online banking, both of which look entirely normal on the network. A network detection tool such as NetSenX does not read e-mail content and cannot tell a genuine payment instruction from a fake one. What stops CEO fraud is process: a rule that no payment is made on the strength of a message alone, a call-back to a number from your own records, dual approval for transfers above a set amount, and explicit permission for staff to delay any request that claims to be urgent and secret. Network monitoring does help in one case: when the fraud starts with a hacked mailbox and the attacker also reaches company systems.

https://netsenx.com/en/faq/can-network-monitoring-stop-ceo-fraud

## Can a phishing e-mail come from a colleague's real account?

Yes, and it is one of the most effective forms because every technical check passes: the address is real, the signature is real, and the message may even reply to an existing thread. It happens when the colleague's mailbox has been taken over, often through an earlier phishing login, and the attacker uses it to send new lures to everyone in the address book, internally as well as to customers and suppliers. The warning signs are in the content, not the sender: an unusual request, a shared document you did not expect, a tone that does not fit, or a message sent at an odd hour. If you suspect it, do not reply to the e-mail; contact the colleague another way and tell IT. IT should then treat the sender's account as compromised: reset it, revoke its sessions, check its inbox rules and find out who else received messages from it.

https://netsenx.com/en/faq/can-phishing-come-from-a-colleagues-real-account

## A supplier asks us to change their bank details. How do we check it is genuine?

Verify it through a channel the request did not come from. Call the supplier on a phone number you already have on file, from a contract or an earlier invoice, never one given in the new message, and confirm the change with someone you know there. Many companies also require a second approver in finance before the supplier's master data is changed, and they flag the first payment to the new account for an extra check. Be particularly careful when the request comes with urgency, a new contact person, a bank in another country, or an explanation such as an audit or a change of bank. This fraud works even when the e-mail really comes from the supplier's address, because their mailbox may have been taken over. Network monitoring cannot judge such a request; the call-back is the control that does.

https://netsenx.com/en/faq/supplier-asks-to-change-bank-details

## We paid a fraudulent invoice. What should we do now?

Call your bank immediately, by phone, and ask for a recall of the transfer; ask them to contact the receiving bank so it can freeze the funds. Speed decides the outcome: money that has not yet been moved on can sometimes be stopped in the first hours or days, much less often after that. Then report the fraud to the police, keep every e-mail with its full headers, and inform your cyber insurer if you have one, since many policies cover this kind of fraud only under specific conditions and deadlines. Find out how the fraudster knew the details: a lookalike domain, your own mailbox, or the supplier's mailbox? If one of your accounts was used, treat it as an incident: reset it, revoke its sessions, check its inbox rules and who else was contacted. Finally, tell the real supplier, because they may be the compromised party, and tighten the call-back rule for bank detail changes.

https://netsenx.com/en/faq/we-paid-a-fraudulent-invoice-what-now

## A supplier's e-mail account was hacked and they wrote to us. What should we do?

Assume that every recent message from that supplier could be fake until confirmed. Put payments to them on hold briefly and confirm the bank details by phone, on a number you already have. Warn finance and anyone who deals with the supplier, and ask IT to search your mailboxes for messages from that address in the period concerned, especially those with links, attachments or payment instructions, and to remove or quarantine them. If anyone clicked a link or entered a password, follow your phishing response steps. Ask the supplier when the compromise began and what they know, and keep a short record: supply-chain security is one of the risk-management measures NIS2 expects covered companies to handle. Check whether any of your staff replied with sensitive data. On the network side, look at whether the devices of people who opened those messages show new outbound connections or unusual activity.

https://netsenx.com/en/faq/supplier-email-was-hacked-what-should-we-do

## Why can't a network security tool stop invoice fraud?

Because invoice fraud happens in conversations and decisions, not in network traffic. The fake invoice arrives as an ordinary e-mail in a cloud mailbox; the person who pays it uses online banking as on any other day; and no malware has to run anywhere. From the network's point of view, everything is normal. A network detection and response (NDR) tool watches how devices behave: which machines talk to which, regular check-ins with outside servers, internal scanning, unusual data volumes. It does not read e-mail text, and it cannot know that an account number is wrong. That is not a weakness to hide but a boundary to plan for. Invoice fraud is stopped by payment controls, by e-mail authentication on your own domain, and by people who are allowed to pause and call back. NDR becomes relevant only when the fraud starts with an intrusion, for example a hacked mailbox used to get into other systems.

https://netsenx.com/en/faq/why-cant-a-network-tool-stop-invoice-fraud

## Someone is sending fake invoices in our company's name. What can we do?

First find out how they do it, because the response differs. If the messages carry your own domain without passing through your mail servers, you need e-mail authentication: SPF, DKIM and a strict DMARC policy, so that receiving servers reject the forgeries. If they come from a lookalike domain, with one letter changed for example, you can file an abuse complaint with the registrar and the hosting provider, and consider registering the most obvious variants yourself. If they come from your real mailbox, it has been compromised and you have an incident to handle: reset it, revoke its sessions, check its inbox rules. In every case, warn your customers through a channel they trust, telling them that your bank details never change by e-mail and how to verify; report the fraud to the police; and keep the samples with full headers. Your customers' finance teams will be grateful for a clear warning.

https://netsenx.com/en/faq/someone-sends-fake-invoices-in-our-name

## How do we stop criminals sending e-mail that pretends to come from our domain?

Publish three DNS records that let receiving mail servers check your mail. SPF lists the servers that are allowed to send for your domain. DKIM adds a cryptographic signature to each outgoing message. DMARC tells receivers what to do when a message fails those checks, and sends you reports on who is sending in your name. Start DMARC with the policy none, which only reports, and read the reports for a few weeks to find every legitimate sender: your mail provider, newsletter tool, invoicing system and CRM. Add them to SPF and DKIM, then move to quarantine and finally to reject. Since 2024, Google and Yahoo have required DMARC from bulk senders, so this also protects your deliverability. It stops exact forgeries of your domain, not lookalike domains, which need monitoring and takedown requests instead.

https://netsenx.com/en/faq/how-to-stop-someone-spoofing-our-email-domain

## What is DMARC?

DMARC, short for Domain-based Message Authentication, Reporting and Conformance, is a published rule that tells other mail servers how to treat messages claiming to come from your domain. It builds on two older checks: SPF, which says which servers may send for the domain, and DKIM, which signs messages. A message passes DMARC when at least one of these checks succeeds and matches the domain in the From line, which is what the reader actually sees. The policy can be none (just report), quarantine (send failures to spam) or reject (refuse them). DMARC also sends you aggregate reports listing every source that sent mail in your name, which is often the first time a company sees all its forgotten senders. On its own it does not stop phishing in general, because attackers simply use a different, similar-looking domain. But it closes the easiest door: exact impersonation of your own address.

https://netsenx.com/en/faq/what-is-dmarc

## What is MFA fatigue?

MFA fatigue, also called push bombing, is an attack on accounts that use push notifications for multi-factor authentication. The attacker already has the password, often from phishing or a leak, and triggers login attempts over and over, so that the user's phone keeps asking for approval, sometimes late at night. Eventually the person taps approve to make it stop, or a caller posing as IT talks them into it. Defences: switch push approvals to number matching, where the user must type a number shown on the login screen, which Microsoft Authenticator now applies by default; limit the number of prompts per period; let users report unexpected prompts with one tap; and move high-risk accounts to phishing-resistant methods such as security keys or passkeys. Tell staff plainly that an MFA request they did not start means someone has their password, and that they should deny it and call IT.

https://netsenx.com/en/faq/what-is-mfa-fatigue

## Can phishing get past multi-factor authentication?

Yes, some kinds of MFA can be bypassed, which is why the type matters. In an adversary-in-the-middle attack, the phishing page sits between you and the real login page: it passes your password and your one-time code or push approval to the real service in real time, then keeps the session cookie the service sends back. With that cookie the attacker is logged in without needing your password or MFA again. SMS codes, authenticator app codes and simple push approvals are all exposed to this. Phishing-resistant MFA, meaning FIDO2 security keys and passkeys, is not, because the key checks the web address and refuses to answer a fake site. MFA of any kind is still far better than none. Practical steps: give passkeys or security keys to administrators and finance first, enable sign-in policies that flag unfamiliar devices and locations, and revoke sessions, not only passwords, after any phishing incident.

https://netsenx.com/en/faq/can-phishing-bypass-multi-factor-authentication

## Does a password reset end a mailbox takeover?

Not always. Attackers who take over a mailbox often set up ways to stay in that survive a new password. Check and remove all of these: active sessions and refresh tokens, which must be revoked explicitly; MFA methods the attacker registered, such as a new phone number or authenticator app; inbox rules that forward mail to an outside address, move messages about invoices or security to an obscure folder, or delete replies; automatic forwarding set in the mailbox settings; app passwords and connected third-party apps with mail access; and delegated access granted to another account. Then look at what was done while they were in: messages sent, files shared, contacts exported. In Microsoft 365 and Google Workspace, the audit log shows these changes with timestamps. Write down what you find, because it determines who has to be warned and whether the incident must be reported.

https://netsenx.com/en/faq/does-a-password-reset-end-a-mailbox-takeover

## What are deepfake CEO calls, and how do we protect against them?

Criminals now use AI-generated voice, and sometimes video, to impersonate a senior manager on a phone or video call and ask for an urgent payment or confidential data. A few minutes of public audio, from a conference talk or a podcast, can be enough to clone a voice. In a widely reported 2024 case in Hong Kong, an employee transferred about 25 million US dollars after a video call in which every other participant was a deepfake. You cannot rely on spotting the fake, because the quality keeps improving. Protect the process instead: no payment or data release on the strength of a call alone, a call-back to a number from your own records, a second approver for transfers above a set amount, and perhaps an agreed verification question for requests from executives. Make it explicitly acceptable for staff to hang up and call back, even when the caller sounds exactly like the CEO. Network monitoring plays no part in stopping this.

https://netsenx.com/en/faq/what-are-deepfake-ceo-calls

## What is a fake CAPTCHA or ClickFix attack?

It is a trick that gets the victim to run the attacker's command themselves. A compromised or fake website shows what looks like a CAPTCHA or an error message, with instructions to prove you are human or fix the problem: press a key combination that opens a command or run window, paste, and press Enter. The page has already copied a malicious command to the clipboard, so the person is in fact launching a script that downloads malware, often an information stealer or a remote-access tool. Because the user runs it, many browser and mail protections never see a file to block. Security researchers, Microsoft among them, have reported a sharp rise in this technique since 2024. Defences: tell staff that no real website ever asks them to paste commands, restrict who can run scripts on ordinary workstations, and keep endpoint protection current. If it happens, treat the device as compromised; on the network, watch for new regular outbound connections from it.

https://netsenx.com/en/faq/what-is-a-fake-captcha-clickfix-attack

## Are e-mail attachments still dangerous?

Yes, though the dangerous types have shifted. Since 2022, Microsoft Office blocks macros by default in files downloaded from the internet, which closed the old route of the infected Word document for most companies. Attackers moved to other formats: compressed archives with a password given in the message text, disk image files, shortcut files, HTML attachments that build a fake login page or download a file when opened, and PDFs that contain only a link or a QR code. A rule of thumb for staff: an unexpected attachment that asks you to enable content, enter a password, scan a code or open another file is a reason to stop and ask. For IT: block uncommon attachment types at the mail gateway, keep the macro block in place, and make sure endpoint protection inspects files opened from archives. If someone opened something suspicious, follow the same steps as after a phishing click.

https://netsenx.com/en/faq/are-email-attachments-still-dangerous

## What does NetSenX see after someone clicks a phishing link?

NetSenX sees what the device does on the network afterwards, not the e-mail or the click itself. It does not read mail content and it does not decrypt traffic. What it can show, on every plan: a device that starts regular, timed connections to an outside server it never used before (beaconing); a device that starts scanning other machines; connections between internal hosts that point to lateral movement; and unusual volumes of data leaving the network. Where the agent captures packets, on Linux or through a mirror (SPAN) port, plans from Starter also show TLS fingerprints, which help pick out tools that do not match the device's usual software. Alerts name the MITRE ATT&CK technique, and from Starter they come with response recommendations. If the phishing only steals a cloud login that is then used from the attacker's own computer, none of that traffic touches your network, and your identity provider's sign-in logs are the place to look.

https://netsenx.com/en/faq/what-does-netsenx-see-after-a-phishing-click

FAQ: https://netsenx.com/en/faq