Phishing, spoofing and email security explained

Terms without the jargon

Phishing, spoofing and a stolen real account are different

Phishing is a message designed to trick you into an unsafe action, such as entering a password on a fake sign-in page, opening a harmful attachment or sending money. A message tailored to one person or organisation is often called spear phishing. The same approach can arrive by text, phone, QR code or a collaboration app, not just email.

Spoofing means making a message appear to come from someone else. The visible display name can be copied easily; attackers may also use a lookalike domain or attempt to forge a real domain. But an email from a genuine address can still be dangerous if that account has been compromised. An existing conversation thread is not automatic proof either.

Business email compromise often aims to redirect a payment, change bank details, obtain confidential files or persuade a colleague to break a normal process. The message may contain no malicious attachment or link. A fake invoice or a plausible request from a real supplier’s hacked mailbox can be enough. That is why important payment changes need an independent verification step, even when the message passes a spam filter.

If you have already acted

What to do after a click, password entry or payment

1. Report it promptly. Tell your IT team or trusted support contact what happened and when. Do not wait to see whether anything goes wrong. Use a known phone number or clean device if the suspect device or mailbox may be compromised.
2. Match the response to the action. Opening a page is different from entering a password, approving a multi-factor authentication prompt, running a downloaded file or sending money. Give the responder these details without sharing passwords or one-time codes.
3. Protect affected accounts and devices. If you entered credentials, change them from a trusted device and check any other account where the password was reused. An organisation’s administrator may need to revoke sessions, inspect sign-ins, forwarding rules and connected apps, and check whether other people received the message. If you ran a file or notice unusual device behaviour, stop using the device and ask for a security assessment before trusting it with new passwords.
4. Act quickly on financial or data exposure. If you paid or supplied banking details, contact your bank’s fraud team immediately and tell the affected organisation through a verified channel. A business should assess whether customer or staff data was accessed and obtain advice about its reporting duties.

Do not delete all evidence before your IT team has captured what it needs. For an account takeover, changing the password alone may not remove malicious forwarding rules or invalidate every session. See NCSC account-recovery advice and Microsoft’s mailbox-response guidance.

Layered protection

Why email security software matters

Your mail provider’s built-in spam and malware controls are a useful starting point. A suitable additional email-security service can inspect messages and attachments, check links, detect impersonation and unusual account behaviour, quarantine threats and help administrators investigate or remove messages after delivery. Some services work as a gateway in the mail path; others connect to cloud mail through an application programming interface (API). The choice affects mail routing, timing, scope, administration and cost.

A filter cannot guarantee that every fraudulent request is caught, particularly one sent from a genuine compromised account or containing only persuasive text. It should be combined with multi-factor authentication, device security, appropriate access, tested backups, simple reporting and an independent payment-verification process. Overly broad allow-lists can undo the benefit of filtering; quarantine releases and exceptions need careful review. Our business cyber-security page explains the wider layers.

JM Restart uses Trend Micro Email Security and has started introducing Bitdefender GravityZone Extended Email Security for some customers; wider use is planned rather than already complete. We aim to move most existing customers from Trend Micro products to suitable Bitdefender products over time, with each change assessed and agreed individually. We are also happy to continue offering Trend Micro products where a customer prefers them. Bitdefender’s current email service builds on Mesh Security technology and offers gateway and Microsoft 365 mailbox-level options. The older GravityZone Security for Email service is end-of-life, so the current product, deployment method and licence must be confirmed for each proposal.

JM Restart can also supply options such as TrustLayer Mail, Hornetsecurity, Proofpoint and Mimecast where they fit the customer’s needs. Availability to supply does not mean that we have deployed or manage every listed product. Features, integration, licensing and support scope vary and are agreed before work begins.

Choosing the right combination

Questions worth asking before buying another tool

• What does the current mail platform already filter, and which suspicious messages still reach users?
• Are we trying to protect a domain from forgery, stop malicious mail, detect a stolen mailbox, train staff, or all four?
• Will the service inspect external, internal and outbound mail, and how are threats found after delivery handled?
• Who will review alerts, release genuine messages from quarantine and maintain policies without unsafe blanket exceptions?
• How will training be run, how can staff report safely, and who has access to individual simulation results?
• How will the service fit with Microsoft 365 or Google Workspace, current licences, data-handling requirements and recovery plans?

The right answer may be improving an existing configuration before adding a new subscription. See our web, email and domain services and managed IT services for the broader support context.