AllTech
On this page
Field notes from the engineering team
Every week, staff at the organizations we support forward us an email with the same question: is this real? It is the right question. A fake “account locked” notice or an unexpected invoice only has to work once.
Most of these emails turn out to be junk. A few are not. This guide covers how to check a message, what to do with it, and why a message in quarantine should not be released until someone in IT has looked at it.
The short version
| Item | Detail |
|---|---|
| Check | Look at the sender address, the link destination, and whether the message pushes you to act fast. |
| Don’t | Click links or open attachments, reply, or use the “unsubscribe” link. |
| Report | Use the Report button in Outlook. CISA also says to delete the message once you have reported it. |
| Verify | If it might be real, contact the company or person another way, not through the message. |
| Quarantine | Do not release a quarantined message on your own. Ask IT to check it first. |
What CISA says to look for
CISA’s phishing guidance lists the common signs of a phishing message:
- Urgent or emotionally appealing language, especially a claim of serious consequences if you do not respond right away.
- Requests for personal or financial information.
- Untrusted shortened URLs.
- Incorrect email addresses or links, such as a domain with one letter swapped.
CISA also points out that poor spelling and grammar used to be a giveaway, but with AI tools some phishing emails now have perfect grammar. A clean message is not proof that it is safe. Check the other signs.
Common lures we see
These are the kinds of messages staff forward to our help desk most often:
- “Your account will be locked.” A notice that your password or mailbox is about to expire, with a button to “keep access”.
- Shared document links. A message saying someone shared a file with you, often from a sender you do not know or a real contact whose account was taken over.
- Invoices and payment changes. An unexpected invoice, or a note from a vendor with new bank details.
What they have in common is pressure to act quickly and a link or attachment to act on. If you did not expect it, treat it with suspicion.
What to do with a suspicious email
1. Stop and don’t click. Do not open the attachment, click the link, call a number in the message, or reply. That includes the “unsubscribe” link, which CISA specifically says to avoid.
2. Check the sender. Look at the actual email address, not just the display name. Hover over links to see where they really go. Look for swapped or extra letters in the domain.
3. Report it. In Microsoft 365, supported versions of Outlook have a built-in Report button. Microsoft’s documentation says users can use it to report phishing that reached the inbox, and to report good mail that was wrongly blocked. Administrators choose whether reports go to a reporting mailbox, to Microsoft, or both. If you do not see the button, tell IT. Microsoft lists conditions that have to be met for it to appear, including that user reporting is turned on.
4. Delete it. After you report it, delete the message. CISA’s advice is the same: do not reply and do not click anything in it.
5. Verify through another route if it could be real. CISA’s advice is not to click any link or call any number in the message. Instead, find the company’s contact details from its own website, or contact the person another way, such as a phone number you already have. This is the right step for an unexpected invoice or a bank detail change.
6. If you already clicked, tell IT right away. Say what you clicked and whether you typed a password. A quick report lets us reset the account and look for sign-in activity before anything else happens. Do not wait to see whether something goes wrong.
Quarantine: why we ask you not to release mail yourself
Microsoft 365 holds suspicious messages in quarantine. Microsoft’s documentation describes what users can do with them by default, and the answer depends on why the message was held:
- For spam, bulk mail, phishing and several anti-phishing detections, users can view, release or delete the message by default.
- For high confidence phishing, malware, and messages caught by mail flow rules, the default is that only administrators can see them. Users do not.
- Administrators can change these defaults with custom quarantine policies, so what you can do in your organization may differ.
- Messages are deleted from quarantine automatically after the date in the Expires column. Microsoft notes that messages that have expired from quarantine cannot be recovered.
Our advice: if a message is in quarantine because the filter flagged it as phishing, do not release it yourself. Forward the details to IT, and we will look at the headers and links and decide. If the message turns out to be legitimate, it can be released and the sender can be allowed in a controlled way. If it is not, it stays out of the inbox.
The expiry date also matters the other way. If you are waiting on a real message, tell IT soon so the message does not age out of quarantine.
What to do
1. Know where the Report button is. Make sure everyone can find it in Outlook on their computer, in the browser, and on their phone.
2. Agree on one place to send questions. Pick a help desk address or number for “is this real?” so staff do not guess or ask a coworker.
3. Tell staff that checking is welcome. A person who asks about a real invoice costs a few minutes. A person who is afraid to ask can cost an account.
4. Set a rule for payment and bank detail changes. Confirm by phone, using a number you already have, before any money moves.
5. Turn on multifactor authentication and keep it on. CISA lists it as one of its basic steps. A stolen password is far less useful to an attacker when a second factor is required.
6. Review your quarantine settings. Ask who can release what, how long messages are kept, and whether users get notifications.
How we help
Our email security service is built to stop phishing, business email compromise and malicious attachments before they reach your staff. We also review how quarantine is set up so you know who can release what. For organizations on Microsoft 365, we help with the reporting button, quarantine settings and sign-in protections as part of Microsoft 365 and cloud.
Our help desk takes “is this real?” questions, looks at what was forwarded, and tells you what to do next. If someone has already clicked, we can reset the account and check for further activity.
For law firms, healthcare practices and municipalities, one bad click can expose client, patient or resident records. If you want to know how your Microsoft 365 reporting and quarantine are set up today, contact us.
