In this article
The filters switched on by default in Microsoft 365 block spam, known malware and links already catalogued as dangerous. They do not block a legitimate message, sent from a real account, asking for an invoice to be paid to a new IBAN. Closing that door is a matter of configuration and internal rules — the core of the managed cybersecurity DataRoad applies to its clients' tenants.
The problem in numbers
- 3,864 incidents Recorded by CERT.PT in 2025, 40% more than the previous year, according to data from Portugal's National Cybersecurity Centre (CNCS) released in 2026.
- 18% The share of reported social engineering incidents that were "fake CEO" and altered invoice fraud.
- Three patterns An invoice with a changed IBAN, a fake Microsoft 365 sign-in page and a malicious attachment or QR code.
- Four measures Multi-factor authentication, blocking external forwarding, SPF/DKIM/DMARC and telephone confirmation of bank details remove most of the risk.
Why out-of-the-box protection is not enough
The Microsoft 365 filter compares each message against what is already known to be malicious. A catalogued virus is held back; a known spam server does not even get the message delivered.
What no filter assesses is intent. A message from a supplier's genuine account announcing "we have changed banks" has no infected attachment or suspicious link, and comes from who it says it comes from. It passes every technical test.
Fraud 1 — the IBAN that changes mid-conversation
The attacker compromises a supplier's mailbox (or the company's own), reads the conversations for weeks and waits for a large invoice. Then they reply in the same thread: "from this month, please pay to the new IBAN attached". A common variant uses a domain with one letter swapped, which nobody notices in a hurry.
The defence is a written rule, not a product: bank details are never changed by email. Confirmation is made by telephone, to the number already on the supplier's record. The full procedure is in our guide to altered invoices and email fraud.
Fraud 2 — the sign-in screen that is not Microsoft's
The message announces "a document has been shared with you" or "your mailbox is full". The link opens a perfect copy of the Microsoft 365 sign-in screen. The employee types their email and password and the attacker takes over the account.
Next comes a discreet mailbox rule: messages containing "invoice" or "payment" are forwarded outside or hidden in a forgotten folder. This is where fraud 1 is born — this time from your own company.
Put simply: multi-factor authentication is a second lock. With the stolen password, the attacker still needs the employee's phone. It is the single measure that most reduces account theft.
Fraud 3 — the QR code inside the PDF
As filters get better at analysing links, attackers have changed format: a PDF with a QR code "to sign", an image instead of text, a password-protected attachment the filter cannot open.
The QR code pushes the user onto their personal phone, outside the company's protections. What opens is almost always a new version of fraud 2.
DataRoad IT Unlimited
Talk to DataRoad. We assess your operation and propose the right plan.
The settings that stop all three frauds
None of this requires buying a specific brand. These are Microsoft 365 settings and internal rules.
| Measure | Frauds it stops | Practical effect |
|---|---|---|
| MFA on every account | 2 and 3 | A stolen password is no longer enough to get in. |
| External forwarding blocked | 1 and 2 | A compromised account cannot silently send your email outside. |
| SPF, DKIM and DMARC on the domain | 1 | Anyone receiving a fake email "from your company" can identify and reject it. |
| Telephone confirmation of bank details | 1 | No IBAN changes by email. |
| Short, regular training | 1, 2 and 3 | The team recognises the pattern: urgency, secrecy, a link "to confirm". |
Automatic forwarding: decide rather than leave it to the system
The policy controlling forwarding to external addresses comes, by default, in "automatic, system-controlled" mode. Microsoft recommends explicitly setting whether it is on or off, because behaviour can vary between organisations. For most SMEs the right answer is off, with exceptions approved one by one.
SPF, DKIM and DMARC without the jargon
They are three records on the domain that prove an email from the company really is from the company. SPF lists who may send on your behalf. DKIM is a seal showing the message was not altered in transit. DMARC tells the recipient what to do when something fails — reject, quarantine or simply report — and sends back reports on who is using your name.
Microsoft warns that applying only some of these methods leaves protection incomplete. The work is done in phases: inventory every service that sends email for the company (invoicing, newsletter, CRM) and only then tighten the policy. A rushed DMARC can block your own invoices.
Everything rests on multi-factor authentication on every account. Before buying any tool, check which security features your Microsoft 365 licence already includes.
Lesson from a project: security defined during migration
The União das Freguesias de Massamá e Monte Abraão chose DataRoad, through a public tender, to migrate around 50 mailboxes to Exchange Online. The project included full transfer of emails, structure and data, reconfiguration of workstations and mobile phones, and final validation.
A migration is the ideal moment to put security rules in place from scratch. Configuring 50 mailboxes once, properly, costs far less than fixing them one by one after an incident.
Checklist for this week
- MFA — confirm that every account, including shared and administrator accounts, has it switched on.
- Forwarding — ask for the list of active rules; any outbound rule nobody can explain is a red flag.
- DMARC — check which mode your domain's record is in.
- Banking rule — write up and share the telephone confirmation procedure.
- Training — book a session to prepare teams against phishing and deepfakes.
Frequently asked questions
Doesn't Microsoft 365 already include email protection?
It does, and it works well against known spam and malware. It does not stop legitimate messages from compromised accounts or convincing payment requests. Those gaps are closed with configuration and internal rules.
Do we need to buy another email security tool?
Not always. For many SMEs the biggest gain lies in properly configuring what the licence already provides. Additional tools make sense later, depending on risk and sector.
How do I know if my domain has DMARC?
Ask your IT partner to read your SPF, DKIM and DMARC records. If DMARC does not exist or is only in monitoring mode, it is easier for anyone to send emails that appear to come from your company.
An employee typed their password into a fake page. What now?
Change the password immediately, end all active sessions, confirm MFA is on and review rules and forwarding created in the last few days. Ask accounts to suspend payments with recent IBAN changes.
Next step: an email assessment in 5 working days
We analyse MFA, forwarding, mailbox rules and SPF, DKIM and DMARC, and deliver the fixes in order of priority, with no obligation. Ongoing management is part of the IT Unlimited Premium plan, our managed Microsoft 365 service and our managed cybersecurity for businesses.
More than 10 workstations · support contract · remote, on-site and telephone support
Sources
- Renascença — CNCS: "fake CEO" fraud accounted for 18% of social engineering incidents reported to CERT.PT in 2025
- Lusa / DNoticias — CNCS: 3,864 incidents recorded by CERT.PT in 2025 (+40%)
- Microsoft Learn — Email authentication in Microsoft 365 (SPF, DKIM and DMARC)
- Microsoft Learn — External email forwarding in Microsoft 365
