In summary
- The basic protection of Microsoft 365 blocks known spam and malware. It does not block a real email, from a real account, asking for a transfer.
- In 2025, the “fake CEO” fraud and the altered invoice accounted for 18% of the social engineering incidents reported to CERT.PT (CNCS).
- Three attacks frequently occur: the invoice with the changed IBAN, the fake Microsoft 365 login page, and the malicious attachment or QR code.
- Four measures close most of the door: multi-factor authentication, blocking of redirects, domain authentication (SPF, DKIM and DMARC), and a simple phone verification rule.
In this article
- What basic protection does — and what it cannot do
- Attack 1: the invoice with the changed IBAN
- Attack 2: the fake page of Microsoft 365
- Attack 3: the attachment or the QR code
- What triggers these attacks
- A real case: 50 mailboxes migrated to Microsoft 365
- Where to start tomorrow
- Frequently Asked Questions
- Diagnosis by email to Microsoft 365 within 5 working days
Email security in Microsoft 365 It comes from a legitimate source, but it was designed to catch what is clearly junk: spam, known viruses, links that have already been identified as dangerous. The attacks that cost Portuguese companies money today are different. They arrive in well-written emails, often from a legitimate mailbox, and ask for a banal thing — to pay a bill or “confirm your password.”.
According to data from the National Cybersecurity Center (CNCS) released in 2026, CERT.PT recorded 3,864 incidents in 2025, 40% more than the previous year. The email fraud that impersonates an administrator or vendor alone accounted for 18% of the reported social engineering incidents.
What basic protection does — and what it cannot do
The Microsoft 365 filter is good for what it was made for: it compares each message with what is already known to be dangerous. A known virus is kept out; a known spam server doesn't even reach the inbox.
What you can’t assess is the intent. An email sent from a provider’s real account saying “we’ve changed banks” passes all the technical tests: it has no viruses or suspicious links, and it comes from where it says it does.
Attack 1: the invoice with the changed IBAN
It is the most expensive and simplest attack: the criminal enters a supplier’s mailbox (or that of their own company), reads the conversations for weeks and waits for a large invoice. At that moment, they reply in the same conversation thread: “Attention, starting this month the payment must be made to the new IBAN attached.”
Common variant: a domain with a letter swapped. In a hurry, no one notices.
What triggers this attack is not sophisticated technology. It is a written rule: no change of bank details is accepted by email. It is always confirmed by phone, to a number that was already on the supplier's record — never to the one that appears in the message. We explained the entire process in the article about Email fraud and altered invoices.
Attack 2: the fake page of Microsoft 365
An email arrives saying that there is “a document shared with you” or that “your inbox is full”. The link opens a page similar to the Microsoft 365 inbox, with the correct logo and colors. The person types in the email and password. Done: The criminal has the account.
The next step is discreet: a rule in the mailbox that forwards messages with “invoice” or “payment” in the subject line, or hides them in a folder that no one opens. This is how Attack 1 was born, from within their own company.
Attack 3: the attachment or the QR code
As the filters become increasingly better at analyzing links, attackers have changed their format: a PDF with a QR code “to sign the document,” an image instead of text, a password-protected attachment that the filter cannot open.
The QR code leads the person to open the link on their personal mobile device, outside of the company’s security measures. The page that opens is almost always another version of the 2 attack.
What triggers these attacks
None of these measures require the purchase of a specific brand: they are Microsoft 365 configurations and internal rules.
| Measure | What attack is being thwarted | In simple language |
|---|---|---|
| Multi-factor authentication on all accounts | 2 and 3 | The stolen password stops coming in to get through. |
| Block automatic forwarding to outside | 1 and 2 | A compromised account cannot silently send its emails abroad. |
| SPF, DKIM and DMARC on your domain | 1 | Anyone who receives a fake email from “your company” can detect it and reject it. |
| Confirmation by phone of bank details | 1 | No IBAN changes by email. That's final. |
| Short and regular training | 1, 2 and 3 | People recognize the pattern: urgency, secrecy, link to “confirm”. |
Redirection: do not leave the decision to the system
In Microsoft 365, the policy that controls automatic forwarding to external addresses comes by default in “automatic, system-controlled” mode. Microsoft itself recommends explicitly setting it on or off, because the behavior can vary between organizations. For most SMEs, the correct answer is “off,” with exceptions approved on a case-by-case basis.
SPF, DKIM and DMARC, explained without jargon
There are three technical records in your domain that prove that an email from “your company” is actually from your company.
Microsoft is clear: using just part of these methods results in insufficient protection. It is done in stages: first inventorying all the services that send email on their behalf (billing, newsletter, CRM), then tightening the policy. Done in haste, DMARC can block your own invoices.
The foundation of everything is the multi-factor authentication on all accounts. And before buying anything, make sure that Security features are already included in your Microsoft 365 license.
A real case: 50 mailboxes migrated to Microsoft 365
The Union of the Freguesias of Massamá and Monte Abraão chose DataRoad, through a public tender, to Migrate about 50 mailboxes to Microsoft 365 (Exchange Online). The project included the complete transfer of emails, structure and data, and the reconfiguration of workstations and mobile devices, with validation at the end.
The lesson: migration is the right time to leave the security set up from scratch. Setting up 50 mailboxes once, with the right rules, costs much less than fixing them one by one after an incident.
Where to start tomorrow
Confirm that all accounts — including shared and administrative ones — have multi-factor authentication. Request the list of active forwarders: any rule for an external address that no one knows how to explain is a red flag. Check your domain's DMARC status, write the phone verification rule, and schedule a session. Train teams against phishing.
Frequently Asked Questions
Does Microsoft 365 no longer have email protection included?
It does, and it is good for known spam and malware. It does not block legitimate emails sent from compromised accounts or well-written payment requests. These flaws are closed with configuration (multi-factor authentication, re-directs, SPF, DKIM and DMARC) and internal rules.
Do I need to buy another email security tool?
Not always. In many SMEs, the biggest gain comes from properly configuring what the license already includes. Additional tools make sense after that foundation, depending on the risk and the industry.
How do I know if my domain has DMARC?
You can ask your IT provider to read the SPF, DKIM and DMARC records for the domain. If the DMARC does not exist or is only in observation mode, anyone can send emails that appear to come from your company with fewer obstacles.
A collaborator entered the password on a fake page. What to do?
Change the password immediately, terminate all active sessions, confirm that multi-factor authentication is active and review the mailbox rules and the re-directs created in recent days. Inform accounting to suspend payments with recent IBAN changes.
Diagnosis by email to Microsoft 365 within 5 working days
We verify multi-factor authentication, forwarders, mailbox rules and SPF, DKIM and DMARC, and deliver the fixes in order of priority. For businesses with more than 10 locations · contract support · remote and on-site support. Ongoing management is included in the plans. IT Unlimited Premium and on duty at Microsoft 365 for business, As part of our managed cybersecurity.
Diagnosis by email within 5 working days
Find out what the basic protection of your Microsoft 365 isn't covering.
Sources
- Renaissance — CNCS Alert: Fraud by the “fake CEO” accounted for 18% of the social engineering incidents reported to CERT.PT in 2025
- Lusa / DNoticias — CNCS data: 3,864 incidents recorded by CERT.PT in 2025 (+40%)
- Microsoft Learn — Email authentication in Microsoft 365 (SPF, DKIM, and DMARC)
- Microsoft Learn — Controlling external email forwarding in Microsoft 365
![mun[it] logo, a digital marketing agency — a DataRoad client](https://www.dataroad.pt/wp-content/uploads/2026/09/logo-cliente-munit.png){kind=logo}
