Pause before acting
Urgent payment demands, unexpected password resets and changed bank details deserve independent checking. The displayed sender name can be misleading. Inspect the actual address and destination of links, while remembering that even a legitimate account can be compromised.
Verify using a known channel
Contact the organisation using a number or address you already trust, not the details in the suspicious message. Do not open unexpected attachments or approve sign-in requests. On a business account, report the message using your organisation's procedure.
If you already interacted
Tell your IT contact promptly what was opened or entered. If a password was exposed, secure the account through its official site and review sessions with the administrator. Preserve useful evidence; deleting the email alone does not reverse the action.
Sources and further reading
Options vary by product version, subscription and organisation policy. Refer to the vendor documentation before making changes.
Need help putting this into practice?
Describe your current setup and the issue. We will clarify the appropriate next step and scope of support.
Related service ↗