Week three of our October habits for staff. This one is for anyone who has ever asked IT to release an email from quarantine.
Why the filter holds good emails too
An email filter’s job is to hold anything it isn’t sure about. That means it sometimes holds genuine mail, and staff ask for it back.
Over the past year our clients sent us 88 of those release requests, from 17 businesses. Forty of them had subject lines about invoices, statements, payments, orders or bookings. That’s normal. Money-related email is exactly what scammers copy, so real invoices get caught in the same net as fake ones.
Eight more had subjects in the “someone shared a document with you” style. One asked the reader to update their payment details with a supplier.
On a subject line alone, the real ones and the fake ones look the same. That’s the whole point of a fake.
What to read before you ask
Most quarantine notices show the sender’s address and the subject. Before you request a release, look at both properly.
- Read the whole sender address, not just the display name. A supplier you deal with should be sending from their own business domain, not from a free email account or a string of random letters.
- Check the spelling of the domain. Scammers register addresses that are one letter off a real business.
- Ask whether you were expecting it. Were you waiting on this invoice, from this supplier, around now?
- Be extra careful with anything about changing bank details or signing in to see a document.
If you release it and open it in Outlook, Microsoft’s phishing guidance points to two more warning signs: a question mark where the sender’s picture should be, and a “via” tag showing the email really came from a different address.
When you’re not sure
Ring the sender on a number you already have, not one from the email, and ask if they sent it. If they did, request the release. If they didn’t, leave it where it is and tell IT.
A genuine invoice can wait an hour for a phone call. A fake one that gets paid can’t be taken back.
The one habit
Before requesting a release, read the sender’s full address and confirm you were expecting that email.
Next week, the last habit for October: what to do when a supplier’s bank details change.
If your team is asking for a lot of quarantine releases and you’d like to know why, talk to us.