Pressure and urgency
“Pay this today,” “keep this between us,” or a tight deadline. Scammers rush people so they skip the usual checks.
Guide · Microsoft 365 email security
Is your Microsoft 365 email safe?
A plain-English guide for Clearwater and Tampa Bay business owners: how Microsoft 365 protects your email, the signs of a scam message, and six steps to tighten things up today.
By Richard Caldwell, Founder · October 24, 2026
The short answer
Microsoft 365 comes with solid built-in email filtering, and it stops a large share of spam and malware. Some scam email still reaches the inbox, especially messages that impersonate a boss, a vendor, or a bank. A few simple settings and a trained team close most of that gap.
Why it matters
Email is where most scams start.
$3.05B was lost to business email compromise in 2025, according to the FBI’s Internet Crime Report. These scams usually arrive as an ordinary-looking email asking someone to pay an invoice, change bank details, or sign in.
Source: FBI Internet Crime Report (2025).
Spot the scam
Five warning signs in an email.
Payment or bank changes
A request to update bank details, buy gift cards, or send a wire. Confirm by phone, using a number you already have.
Look-alike addresses
An email address with one letter swapped, like rnicrosoft.com in place of microsoft.com. Read the address slowly.
Reply-to mismatch
The reply goes somewhere different from the sender you see. Hover over the name or check the reply-to line.
Surprise links and attachments
A shared file or sign-in link that shows up out of the blue. Open the website yourself in place of clicking.
Tighten it up
Six steps to keep your Microsoft 365 email safe.
Turn on multifactor sign-in
Require a code or app approval on every account, so a stolen password alone stays useless to an attacker.
Set up SPF, DKIM and DMARC
These three domain settings prove your emails really come from you and make it harder for scammers to send mail as your business.
Block outside auto-forwarding
Stop mailboxes from quietly forwarding mail to outside addresses, a favorite trick after an account is taken over.
Review inbox rules and sign-ins
Check for strange inbox rules and sign-ins from unexpected places. Both are early signs of a hijacked mailbox.
Train your team
Short lessons and realistic phishing practice help everyone spot the warning signs above. See employee security training.
Add a second look after delivery
InboxGuard adds onto Microsoft 365 and re-checks every message that lands in the inbox against ten checks.
If it already happened
What to do if a business email account gets hacked.
Act quickly. Every hour counts when someone else controls a mailbox.
- Change the password and turn on multifactor sign-in
- Sign the account out everywhere from the Microsoft 365 admin center
- Check inbox rules and forwarding and remove anything unfamiliar
- Warn your contacts to ignore recent payment requests from that address
- Call us at (727) 340-3921 for help with cleanup
Want a second set of eyes on your email?
Talk with Online Securitys in Clearwater about your Microsoft 365 setup.