Article · 3 min · For Owners
By the Micro-IT team · Published Jun 2026 · Updated Jul 2026

The "CEO needs gift cards" play

The original — and still the most common. The attacker scrapes your team page, finds the CEO's name, and sends a panicked note from a near-identical Gmail address asking the office manager to pick up Amazon cards "for a client gift." The tells: it always arrives between 4–6 PM, the sender domain is wrong, and there is always an excuse for why the CEO can't take a phone call. The fix: every wire and gift-card request gets a phone call to a known number. No exceptions.

The fake invoice from a real vendor

A vendor you actually use sends an invoice — except they don't. The attacker has compromised the vendor's email and sent a real-looking PDF with new bank routing details — the kind of impersonation a hardened email setup is built to flag. The tells: the routing number is different from last month, the email signature is slightly off, and there's urgency about a "new ACH system." The fix: any change to a vendor's payment details requires a call to a phone number you already have, not the one in the email.

The DocuSign / Microsoft login lure

A "shared document" notification that looks exactly like a real DocuSign or M365 message. Click the link and you're on a pixel-perfect login page that quietly captures your credentials — the moment where MFA earns its keep. The tells: the URL bar shows a suspicious domain, the sender is a vaguely familiar name with an unfamiliar address, and the document title is generic ("Q4 Plan.pdf"). The fix: never log in via an email link. Open Outlook, M365, or DocuSign in your browser directly.

The login lure — and where the chain breaks
Flow diagram of a credential-phishing attack: a shared-document notification arrives, it links to a pixel-perfect fake login page, credentials are quietly captured — and where the chain breaks, highlighted: MFA plus opening the app directly instead of the email link. 01 · THE LURE 02 · THE FAKE PAGE 03 · THE CAPTURE 04 · WHERE IT BREAKS SHARED-DOCUMENT NOTIFICATION LANDS PIXEL-PERFECT M365 OR DOCUSIGN LOGIN CREDENTIALS QUIETLY HARVESTED MFA + OPEN THE APP, NEVER THE LINK

Frequently asked questions

What should I do if an employee already clicked a phishing link?
Move fast: have the user disconnect the device from the network, reset the password from a different device, revoke active sessions in Microsoft 365 (Entra admin center → Users → Sign-ins → revoke), require MFA re-enrollment, scan the endpoint with EDR, and check the mailbox for new inbox rules an attacker may have created. Then audit sent items for the last 7 days. Document everything for the cyber-insurance carrier.
How often should we run phishing-simulation training?
Quarterly is the right baseline cadence: one annual full-length training, three quarterly simulated phishes, with click-rate metrics tracked. Some carriers want monthly for high-risk roles (finance, executives, IT admins). The metric to watch is whether click-rate trends down quarter over quarter, not the absolute number.
Who should I call first if I think I've been phished?
Your MSP or internal IT, immediately. Then your cyber-insurance carrier within the policy's notification window (often 24–72 hours). If money has moved, the bank's fraud line, in that order. Don't wait to "see if it was real" — the cost of a false alarm is one phone call; the cost of waiting is exponential.
Does MFA stop phishing?
Basic MFA stops most credential-stuffing and bulk attacks. Phishing-resistant MFA (hardware keys, passkeys, Windows Hello) also stops adversary-in-the-middle attacks that defeat code-based MFA. For finance, executives, and IT admins, phishing-resistant should be the default. See what MFA actually buys you.

Related reading

Your next step

Reading is the easy part — the gap closes when someone owns it. Book a free 20-minute call and we’ll walk through how this applies to your environment, in plain English.

Book a 20-min call →Take the free risk assessment →