Fake sign-in pages behind mailbox-full or shared-document emails steal office email passwords. Never sign in from an emailed link, turn on two-step verification, and if a password was entered, change it and check forwarding rules.

A message about your mailbox

The email says your mailbox is almost full, or a document has been shared with you, or your password expires today. It carries a button: sign in to fix it.

The page behind the button looks exactly like the sign-in page for your office email: the same logo, the same colours, sometimes your own address already filled in.

Someone types their password, the page reloads or shows an error, and they shrug and get on with the day.

The password now belongs to somebody else as well. It took no technical skill, only a convincing copy and a busy recipient.

The usual stories

The second works best, because sharing documents is ordinary work. When it comes from a real contact's account that has already been taken over, almost nothing about it looks wrong.

What the fake page looks like

Many fake pages show a padlock and an https address. Certificates are free now, and the padlock confirms only that the connection is private, not whose page it is.

The page usually sits on a hacked website or a free hosting address, under a long, odd domain that has nothing to do with your email service.

After the password is entered, it often passes the person on to a real document or the real sign-in page, so nothing seems to have gone wrong.

The habit that prevents it

Do not sign in through a link that arrived by email. If a message says something is wrong with your account, open the email service from a bookmark or by typing its address, and look there.

Before typing a password anywhere, read the address bar. The domain should be your email service's own, not a long address that merely includes its name.

A password manager helps here. It fills in passwords only on the real domain, so when it offers nothing on a sign-in page, that silence is a warning.

None of this is perfect: careful people still get caught on a busy afternoon.

What happens to a stolen password

Whoever has the password signs in and usually stays quiet.

They read the mailbox for anything useful: invoices, payment conversations, other passwords sent by email. Many set a rule that copies all incoming mail to an outside address, or hides replies in a folder nobody opens.

Then they use the trusted address: the same fake email goes to every contact, and sometimes a note about changed bank details goes to customers or suppliers.

They also try the same password on other services, which is how one reused password turns a single mistake into several.

A worked example

A strata management company with eight property managers looks after dozens of buildings, each with its own owners' council, contractors and monthly payments.

One manager received a message saying a council president she worked with had shared a document. She clicked, typed her password into a convincing sign-in page, and saw an error.

Over the next two days, the same message went out from her address to council members and contractors across her buildings. A few recognised it as odd and called the office, which is how it was found.

The cause was ordinary: a convincing page, a busy afternoon, and an account where the password alone opened everything.

That afternoon the office changed her password from another computer, signed out every session, and found a rule forwarding her incoming mail to an outside address.

It deleted the rule, checked her sent mail, and wrote to every contact the fake message had reached.

Within the week two-step verification was on for every account, and any change to banking details now has to be confirmed by phone.

Why two-step verification limits the damage

Two-step verification asks for something besides the password at sign-in: a code from an app on your phone, a text message, or a tap on a prompt.

A fake page can still capture a password, but a stolen password alone no longer opens the mailbox. The attacker would also need your phone.

It is not perfect: a code typed into a fake page can be misused within seconds. But it turns most of these attempts into a failed sign-in.

Most business email services include it at no extra cost. Turn it on for everyone, starting with whoever handles payments.

The first hour

Once a password has gone into a doubtful page, change it from a different, trusted computer, and sign out every other session. Check the mailbox settings for forwarding addresses and for rules that move, delete or forward messages.

Read the sent folder for anything the person did not send, and change the same password anywhere else it was used.

Then turn on two-step verification for that account before anything else happens in it.

Telling people

If messages went out from the account, tell the recipients, by separate email or phone, that it was not genuine and should be deleted.

If the mailbox holds invoices or payment details, call the customers and suppliers involved. Any emailed request to change bank details should be checked with a phone call to a number from your own records.

A short, honest note is far better than letting a contact discover the problem through their own bank.

The counter-case

Some offices carry less exposure than others.

A business with one mailbox, no payments discussed by email and two-step verification already on has done most of the work; for it, the address-bar habit is enough.

And no setting replaces judgement. Someone expecting a document from a colleague will sometimes click, so the aim is to make one mistake cheap, not to promise it never happens.

For everyone else: turn on two-step verification this week, and make never signing in from an emailed link a habit.

Before the next one arrives

  1. Turn on two-step verification for every mailbox.
  2. Start with whoever handles payments and banking.
  3. Bookmark the real sign-in page on every computer.
  4. Ignore sign-in links that arrive by email.
  5. Check for forwarding rules in every mailbox now.
  6. Confirm bank detail changes by phone.
  7. Write down the first-hour steps and share them.

Step five takes ten minutes and finds the problem that is otherwise invisible. A forwarding rule set months ago can still be copying every message out of the office today.

The other half of protecting an office, keeping its computers updated, is covered in the ransomware outbreak and the computers that missed an update.

Frequently asked questions

What do fake email sign-in pages look like?

Exact copies of your email service's sign-in page, sometimes with your address filled in and a padlock showing. The domain in the address bar is the giveaway.

Does a padlock mean the page is safe?

No. Certificates cost nothing now, and a padlock proves only that the link between browser and page is private. Who runs the page is another matter.

How does two-step verification help?

It asks for a code or a prompt on your phone as well as the password, so a password captured by a fake page is not enough on its own.

What if a password was already entered?

Change it from another computer, sign out all sessions, remove forwarding or inbox rules you did not create, check sent mail, and turn on two-step verification.

Why check for forwarding rules?

Attackers often set a rule copying all incoming mail to an outside address. It keeps working after the password changes, until someone finds and deletes it.

How do these attacks lead to fraud?

With access to a mailbox, an attacker can send customers or suppliers convincing requests to change bank details. Confirm any such change by phone, on a known number.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Office email without two-step verification?

We will turn it on for every mailbox, check for forwarding rules, and write a first-hour plan with you.

Start a Conversation