What is impersonation, and why does it slip through so often?
In an impersonation attack, someone poses as a person the recipient trusts: the director, a colleague or a regular supplier. That can happen in three ways. The display name is right, but the address is a random external address. The domain looks like the real domain, for example with an extra letter or a zero instead of an o. Or the sender address is forged entirely, so the email appears to come from your own domain.
This kind of email is hard to spot for a filter that looks for malicious links and attachments, because often there is only text: a payment request, a request for gift cards or a changed bank account number. That is why the anti-phishing policy looks not only at the content, but also at the sender and at who your employees normally email with.
What every tenant has by default
Every organisation with Exchange Online has Exchange Online Protection and a default anti-phishing policy. It includes spoof protection: email that claims to come from a domain but fails the SPF, DKIM and DMARC checks is detected as spoofing. How well that works depends heavily on your own email settings. So first make sure SPF, DKIM and DMARC are set up properly for your domains, with DMARC on quarantine or reject.
The default policy can also show a first contact safety tip: a notice above the email when the recipient has never received email from this address before. This tip is not always on. Turn it on, because a ‘director’ with an unknown address stands out with it. Combine it with an external email warning banner, so employees see straight away that an email comes from outside.
Impersonation protection for people
With Defender for Office 365 you add users you want to protect extra in the anti-phishing policy. Choose the people who are impersonated most often: the management team, the person responsible for finance, HR and perhaps an external accountant or adviser. If an email arrives with a name or address that closely resembles one of them, but from a different address, Microsoft 365 detects it as user impersonation. You can protect a limited number of people per policy, up to 350, so make a deliberate choice.
Keep the list up to date. A new director or controller should be added straight away, and people who leave can be removed. Include this in your joiner and leaver checklist.
Impersonation protection for domains
Domain impersonation is about domain names that look like the real domain, such as floorlct.nl instead of floorict.nl. Turn on the option to protect the domains you own in Microsoft 365, and also add the domains of parties you exchange a lot of money or data with: the bank, the accountant, large suppliers and customers. Those are exactly the domains that get copied in invoice fraud.
If a legitimate sender is flagged because it happens to resemble a protected domain, add it as a trusted sender or trusted domain in the policy. Do this specifically for that one address or domain, not by turning the protection off.
Mailbox intelligence and the right actions
Mailbox intelligence learns who each employee normally emails with. Email from a regular contact is then not wrongly treated as impersonation, while email posing as such a contact stands out. Turn on mailbox intelligence, and also the impersonation protection based on it. Then choose what happens for each type of detection. For user and domain impersonation, quarantine is usually the best choice; the email never reaches the employee and an admin can review it. Read how to keep that workable in our article on message quarantine.
Also turn on the safety tips for impersonation and for unusual characters. If an email does get through, the recipient sees a warning that the sender may not be who they appear to be. If you don’t want to tune everything yourself, you can use the Standard or Strict preset security policies. There you only add the people and domains to protect, and Microsoft manages the other settings.
Technology is not enough: a fixed call-back rule
No filter stops all impersonation, especially when a supplier’s real mailbox has been taken over. So agree that every request for an urgent payment, a new bank account number or sensitive data is checked by calling back on a known number, never the number in the email. Practise this in security awareness training, and have employees report suspicious email with the Report button in Outlook.
How Floor ICT handles this
Floor ICT first checks SPF, DKIM and DMARC and turns on the first contact safety tip. In tenants with Microsoft 365 Business Premium or Defender for Office 365 we set up the anti-phishing policy: together with you we draw up the list of people and domains to protect, turn on mailbox intelligence and choose the right action for each detection. We then watch what ends up in quarantine during the first weeks, so legitimate email doesn’t get stuck, and keep the lists up to date when people or suppliers change. That way a fake director stands out before any money is transferred.