As a company providing managed IT services, we have received a lot of reports of email scams recently. However, these are becoming harder to spot. Especially when the email comes from one of your work colleagues real email accounts.

This style of email appears to be from one of your colleagues. If you click on the PDF attachment, it will send you to a web page requesting you to enter your One Drive email and password. However, this login is not actually One Drive. The scammers are harvesting passwords to One Drive accounts so as soon as you have ‘logged in’ to this fake account, they have your details. With these details, they have access to all your emails which could include customer contacts. Once they gain access, the same scam email is sent from your account. The issue with this scam is, it’s not a spoof email, it’s a genuine email as it has come from your account, therefore recipients wont suspect anything. There is also no virus in this email so it won’t get flagged and caught by SPAM filters. It doesn’t end there. The scammer then creates rules in your Outlook account, making sure that the email is deleted if anyone sends a reply. The scammer will also wait for large payments that your clients make to your company, then send them an email saying you have changed your bank details and payment should be sent to a new account. This of course is not the case and your clients end up paying the scammer large amounts of money because of an email sent from your account.