1. Your everyday email account should not hold the master keys

The account you use to email clients, review invoices, and argue about meeting times should not also administer your firm’s email system.

Have IT create separate, individually assigned administrator accounts that are used only for administrative work, without functioning email mailboxes. On platforms such as Microsoft 365, a login that looks like admin@myfirm.com can be an administrative identity without being an inbox. Give each administrator only the permissions their role requires. Microsoft Learn

Do not turn that example into one shared password for everyone in IT. Separate people should have separate administrative identities.

And protect those accounts with the strongest authentication your platform supports, preferably a phishing-resistant method. Administrator access deserves more protection, not a password everyone remembers because it is the firm’s name followed by an exclamation point. Microsoft Learn

Being the managing partner is not a technical reason to have administrator rights. It is a job title, not a cybersecurity exemption.

2. Update every device. Yes, that includes your phone.

Your office computer may be beautifully maintained. That does not help much if the phone accessing the same email account has been postponing security updates since the last office holiday party.

Keep the operating systems, browsers, and email applications on every device accessing work email up to date. That includes personal phones and tablets. Enable automatic updates where appropriate, complete required restarts, and replace devices that no longer receive security updates. Patches fix known weaknesses that attackers may otherwise exploit. CISA

“Remind me tomorrow” is a useful button. It is a terrible long-term security policy.

3. Give your login something stronger than a password and good intentions

Where passwords are used, make them long and unique, and require multifactor authentication, or MFA. That adds another way to verify your identity beyond the password.

Where supported, favor phishing-resistant authentication, such as passkeys or compatible hardware security keys. Text-message codes are better than no MFA, but they offer weaker protection than phishing-resistant alternatives. CISA

One useful distinction: a fingerprint is not itself a passkey. A passkey is a cryptographic credential stored on a device, in a passkey provider, or on a security key. Your fingerprint, face, or device PIN can authorize its use. The biometric check unlocks the credential; it is not the credential. FIDO Alliance

Your IT team should choose and configure an approach that protects both ordinary users and administrators. “We enabled MFA for most people” leaves an unfortunate amount of room in the word most.

4. When emails start disappearing, stop shrugging

Someone insists they sent you an email. It is not in your inbox, spam folder, or deleted items. Other messages seem to vanish. Perhaps people are replying to emails you never sent.

Those can be signs of a compromised account, including malicious rules that move or forward messages. They are not proof by themselves, but they deserve investigation. learn.microsoft.com

Contact IT immediately through a known phone number or another trusted channel. Do not rely on the potentially compromised mailbox to coordinate its own rescue.

You do not need to establish a case beyond reasonable doubt before calling the help desk. A false alarm is preferable to giving an intruder another afternoon with your correspondence.

Make sure everyone knows how to report concerns, including outside normal office hours. Reporting should be easy and encouraged, not treated as an admission of incompetence. CISA

5. Evict the intruder. A password change is only part of the job.

Your administrator should handle recovery using a known-clean device and the email provider’s official administration portal. If the phone or computer may be compromised, it should not be the device used to secure everything else. Federal Trade Commission

As containment begins, IT should preserve relevant logs, suspicious messages, and account settings. Do not start deleting evidence or factory-resetting devices before the response team has assessed what needs to be saved. Containment is urgent, but cleanup should not erase the explanation of what happened. Federal Trade Commission

The recovery process should include three essential checks:

• Cut off access. Temporarily block sign-ins or suspend the affected account while securing it. Reset its password and explicitly revoke all active sessions and relevant sign-in tokens. Do not assume changing the password automatically ends every existing connection. Some revocation actions take time or require additional steps for connected applications, so IT should verify that access has actually stopped. Google Workspace Help
• Look for spare keys. Review registered MFA methods, recovery addresses and phone numbers, app passwords, and applications authorized to access the account. Remove unauthorized access and reset authentication methods where necessary. An attacker’s recovery phone number is not a souvenir worth keeping. Microsoft Learn
• Check the mailbox plumbing. Inspect forwarding settings, inbox rules, and delegated mailbox access. Preserve suspicious configurations, then remove them. An attacker may have arranged for messages to disappear into another folder or for copies to reach an outside address. Microsoft Learn

Changing the front-door lock is useful. It is less useful when someone has installed a forwarding address and kept another way inside.

6. Find out what happened, not just whether the inbox works again

An inbox that opens normally is not proof that an incident is over.

IT should review sign-in records, email delivery logs, security events, and activity in connected services. Do not rely only on the Sent folder to establish which messages went out. The investigation should also assess whether files or other data were accessed through the same account. Google Workspace Help

Investigate the suspected entry point rather than treating the first theory as the final answer. An unpatched phone deserves attention, but so do compromised credentials and stolen session cookies, which can let an attacker reuse an existing sign-in. A compromised device may need remediation beyond installing its latest update before it is trusted again. CISA

The objective is not merely to get the employee back to work. It is to make sure the attacker does not return with them.

7. Warn the people who may be affected

If the account sent fraudulent messages, promptly warn the affected recipients through a verified, safe channel. Do not send the warning through the compromised account until IT has secured it.

Be specific about which messages to disregard and what recipients should do. Tell them not to open suspicious links or attachments, and to independently verify any payment instructions. Coordinate communications with the response team so the warning is accurate, useful, and consistent with what is actually known. Federal Trade Commission

If anyone sent money because of a fraudulent message, contact the financial institution immediately. In the United States, also report the incident to the FBI’s Internet Crime Complaint Center. This is not a “circle back next week” situation. FBI

If client, employee, or other sensitive information may have been exposed, involve legal counsel promptly to assess notification obligations. A password reset does not settle that question. Federal Trade Commission

8. Train people for the tricks they will actually encounter

“Your password expires today. Click here immediately.”

“Please review this confidential document.”

“We have changed our banking details.”

Train staff to question unexpected requests, particularly those demanding urgency, credentials, or money. For a password warning, open the service through a known bookmark or contact IT rather than following the message’s link. Verify unusual payment instructions using a phone number already on file, not one supplied in the suspicious email. CISA

The message does not become trustworthy just because it has a familiar logo and excellent punctuation.

Training should also distinguish public computers from public Wi-Fi.

Avoid checking work email on public or untrusted computers. They may contain software that records passwords or other activity. If someone has already used a shared computer, they should sign out fully, close the browser, and tell IT about any concerns. Logging out afterward does not undo information already captured by malicious software. Microsoft

On public or unfamiliar Wi-Fi, follow the firm’s remote-access policy and use its approved VPN where required. HTTPS already encrypts connections to websites; a VPN can protect traffic routed through its encrypted connection. Neither makes a fraudulent website trustworthy or repairs an infected device. Consumer Advice

A VPN is a security tool, not a force field.

Make your inbox an inconvenient place to commit a crime

Our client’s experience offers a useful lesson: the safeguards you put in place beforehand can matter enormously when something goes wrong.

Separate administrator accounts. Updated devices. Strong authentication. Employees who speak up. A recovery process that does more than change a password and hope for the best.

None of this requires a dramatic soundtrack. It does require attention before the emergency.

Want to know where your firm’s email security needs attention? Contact our team to learn more about protecting your accounts, securing the devices that access them, and preparing a response plan. Your inbox should work for you, not someone pretending to be you.