Phishing and Business Email Compromise: Stop, Verify, and Report
Phishing and Business Email Compromise: Stop, Verify, and Report
Phishing is a message designed to make you reveal information, open a harmful file, visit a fake sign-in page, or take an unsafe action. Business email compromise (BEC) is a targeted form of fraud in which an attacker impersonates, or takes over, the account of an executive, coworker, supplier, attorney, or other trusted contact. The message may look routine: “update our bank details,” “buy gift cards,” “send payroll records,” or “approve this urgent payment.” Microsoft notes that BEC often relies on research and social engineering rather than obvious malware, so a clean-looking message can still be dangerous.[1]
If the message is still unopened
- Do not click links, open attachments, scan QR codes, call numbers in the message, or reply. Hovering over a link may reveal a mismatch, but do not investigate further.
- Verify through a separate, trusted channel. Call the person or vendor using a number already saved in your contacts, listed in an approved directory, or printed on a prior legitimate statement. Do not use contact details supplied by the suspicious message.
- Report it to Zerolimit immediately using your normal support or security contact method. Include the sender, subject, time received, and what the message requested. Use your organization’s built-in “Report phishing” button if one is available, but still contact Zerolimit when money, credentials, sensitive data, or an executive/vendor identity is involved.
- Leave the message intact until Zerolimit advises otherwise. Do not forward it to coworkers as a warning; forwarding can spread dangerous links or files.
CISA emphasizes that phishing often creates urgency or uses an unexpected request to push the recipient into acting before checking.[2][3] Poor grammar is not a reliable test; modern scams may be polished and may appear inside a real email thread.
If the request involves money or sensitive changes
Pause any payment, wire, direct-deposit update, gift-card purchase, password reset, or release of tax, payroll, customer, or banking data. Follow the organization’s established approval process even if the sender claims the normal approver is unavailable. For bank-detail changes, use a known phone number and a second approver. A reply inside the same email thread is not independent verification because the mailbox or conversation may be compromised.
Watch for subtle warning signs: a look-alike domain, a changed reply-to address, an unusual writing style, secrecy, pressure to bypass procedure, a new payment destination, or a request that does not fit the sender’s role. Treat an unexpected document-share invitation or QR code as a link, not as proof of legitimacy.
If you clicked, replied, or sent information
Contact Zerolimit now. Do not wait for symptoms. Tell the technician exactly what happened: whether you clicked, entered a password, approved an MFA prompt, opened a file, sent data, or authorized a payment. Stop interacting with the message and do not try to test the link again.
If credentials were entered, Zerolimit may direct you to change the password from a known-good device, revoke sessions, and review account security. Do not change passwords on a device that is showing malware warnings unless Zerolimit instructs you to. If money was sent, notify Zerolimit and the organization’s finance leadership immediately; contact the financial institution using a trusted number and request its fraud or recall process. Speed matters.
Do not delete evidence, wipe the device, run unapproved cleanup tools, contact the suspected attacker, or publicly accuse the apparent sender. Zerolimit can preserve the information needed to determine scope and protect other users.
What to provide Zerolimit
Share the sender address, subject, date and time, requested action, and whether anyone else received it. State every action you took and any information disclosed. If safe, keep the message available in the original mailbox. Screenshots can help, but do not reopen a suspicious attachment merely to capture one.