Author: J. Mesa

By J. Mesa

The start of a new year is a good time to check your locks. Staff changed, you added software, a vendor came and went. Each change can leave a gap.

This checklist covers twenty items in five groups. Set aside an afternoon, work through it, and write down what you find.

Why review your security every year?

• People join and leave, and their access lingers
• Software reaches the end of its support
• New services get added without a security review
• Backups fail without anyone noticing
• Insurers and clients ask for proof

A yearly review catches what daily work misses.

Accounts and access

1. List every account and who can use it. Include email, banking, cloud storage, your website, your domain, and social media.

2. Remove access for former employees and vendors. Check shared mailboxes and shared passwords too.

3. Confirm multi-factor authentication is on for every account that offers it. Start with email, banking, and administrator accounts.

4. Check for shared or reused passwords. Give each person their own login and a password manager.

5. Review administrator rights. Few people should have them, and nobody should use an administrator account for daily work.

Devices and software

6. Inventory your devices. List every computer, phone, tablet, server, router, and printer.

7. Confirm automatic updates are on for operating systems, browsers, and applications.

8. Identify anything that no longer receives security updates and plan its replacement.

9. Check that security software is installed and current on every computer.

10. Confirm laptops and phones are encrypted and lock after a few minutes.

Network

11. Update your router and firewall, and change any default password.

12. Check your Wi-Fi. Use WPA2 or WPA3 with a strong password, and keep guests and smart devices on a separate network.

13. Review remote access. Close anything exposed to the internet that you don’t need, and require multi-factor authentication for the rest.

Data and backups

14. Know where your sensitive data lives. Customer records, employee files, and financial information.

15. Test a restore from backup. Time it. Confirm one copy sits offline or offsite.

16. Delete data you no longer need, and dispose of old devices and paper securely.

17. Review cloud sharing settings and remove public links.

People and plans

18. Train every employee on phishing and safe data handling, and record who attended.

19. Review your incident response plan. Update the names and phone numbers, and print a copy.

20. Review your vendors, your insurance, and your compliance duties. Confirm who holds your data, what your cyber policy requires, and which rules apply to you.

How long does the checklist take?

For a business with fewer than 25 people, plan on three to four hours for the first pass. It goes faster each year, because you keep the lists you made.

Who should do it?

Name one person to lead, often the owner or the office manager, and involve whoever handles IT. Ask your IT provider for the device and update reports. The person who leads does not need to be technical. They need to ask each question and write down the answer.

What should I do with the results?

Sort what you find into three groups:

1. Fix now. Missing multi-factor authentication, active accounts for former staff, failed backups.
2. Fix this quarter. Unsupported devices, missing training, an outdated plan.
3. Plan and budget. Larger replacements and projects.

Assign each item an owner and a date.

What are the most common problems this review finds?

• An email account without multi-factor authentication
• A former employee who can still log in
• A backup that stopped running months ago
• A router that has never been updated
• A shared password that everyone knows
• An incident plan with phone numbers for people who left

Any one of these is an open door.

How do I prove I did the review?

Keep a dated copy of the completed checklist, with notes on what you found and fixed. Insurers, clients, and auditors accept this kind of record as evidence of a security program.

Should I review more than once a year?

Some items deserve a shorter cycle.

• Monthly: confirm that updates and backups ran
• Quarterly: review who has access to what
• Yearly: the full checklist, training, and the plan
• After any change: a new system, a new vendor, or a departing employee

Is a checklist the same as a risk assessment?

No. A checklist confirms that basic controls are in place. A risk assessment looks at your specific business: what data you hold, what could go wrong, how likely it is, and what it would cost. The checklist is the starting point. An assessment tells you where to invest next.

What if I find something I can’t fix?

Write it down with the reason, and reduce the risk another way. An old system you can’t replace yet can be taken off the internet and restricted to the people who need it. A documented risk with a plan is far better than an unknown one.

Does this checklist cover compliance?

It covers the basics that most standards share. If you accept payment cards, handle health information, or provide financial services, you have added duties under PCI-DSS, HIPAA, or the FTC Safeguards Rule. Use this list as a foundation and check the specific requirements that apply to you.

Where do I start if I am short on time?

Do these five first. They take under an hour.

1. Turn on multi-factor authentication for email.
2. Disable accounts for former staff.
3. Check that your last backup succeeded.
4. Confirm automatic updates are on.
5. Print your emergency contact list.

How long does this checklist take?

Plan for one working day. Most owners finish the account review and the backup test before lunch, then spend the afternoon on updates and the phone call to the bank. Put the date on your calendar now and invite the person who handles your IT. A checklist you schedule gets done. A checklist you save for a slow week waits until after the breach.

Your next step

Put the review on your calendar this month and work through all twenty items. If you want an outside view, Cerberus Cybersecurity performs risk and compliance assessments that cover this checklist and go deeper into the risks specific to your business. Contact us to schedule yours.

By J. Mesa

A bookkeeper gets an email from a longtime vendor. The vendor has changed banks, the message says, and future payments should go to a new account. The email looks right. The bookkeeper updates the record and pays the next invoice. Weeks later the real vendor calls to ask about the overdue payment.

That is business email compromise. It needs no malware, and it costs businesses more than any other online crime reported to the FBI.

What is business email compromise?

Business email compromise (BEC) is a scam in which a criminal uses email to pose as someone you trust, such as an owner, an executive, a vendor, or an attorney, and asks an employee to send money or sensitive information.

The message may come from a look-alike address or from a real account the criminal has taken over.

How does a BEC scam work?

1. Research. The criminal studies your website and social media to learn who handles payments and who your vendors are.
2. Access or imitation. They break into an email account through phishing, or they register a domain one letter off from the real one.
3. Watching. Inside a mailbox, they read invoices and learn how people write.
4. The request. They send a payment request or a change in bank details at a believable moment.
5. The transfer. The money goes to an account they control and moves again within hours.

What are the common types of BEC?

• Vendor or invoice fraud. A fake notice that a supplier’s bank details have changed.
• CEO fraud. A message from “the owner” asking for an urgent wire.
• Payroll diversion. A request to change an employee’s direct deposit account.
• Gift card requests. “The boss” needs gift cards for clients right away.
• Attorney impersonation. A message about a confidential deal that requires a fast payment.
• Real estate fraud. Fake closing instructions sent to a buyer.
• Data theft. A request for employee W-2 forms or customer lists.

Why does BEC work?

• It uses trust in people you know
• It arrives during real transactions
• It contains no malicious link or attachment for a filter to catch
• It creates urgency and asks for secrecy
• Employees want to be helpful and fast

What are the warning signs?

• A change in bank account or payment details
• Pressure to act today
• A request to keep the matter confidential
• A sender address that differs by a letter or uses a different domain
• A reply-to address that differs from the sender
• A request outside the normal process
• Writing that sounds unlike the person
• A message that says the sender can’t take calls

How much does BEC cost?

The FBI’s Internet Crime Complaint Center reports losses from BEC in the billions of dollars each year, more than ransomware by a wide margin. A single incident at a small business can run from a few thousand dollars to several hundred thousand.

How do I prevent BEC?

Technology helps, and process stops it.

• Verify by phone. Confirm any new or changed payment details by calling a number you already have on file. Never use the number in the email.
• Require two people to approve wire transfers and new payees.
• Set a waiting period for payments to a new account.
• Turn on multi-factor authentication for all email accounts.
• Train your staff to recognize these requests, with real examples.
• Limit what you publish about who handles finance.
• Review mailbox rules. Attackers create forwarding rules to hide their activity.

What technical controls help?

• SPF, DKIM, and DMARC records on your domain, which make it harder to send email that appears to come from you
• External sender warnings that flag messages from outside your company
• Email filtering with impersonation protection
• Alerts for new forwarding rules and logins from unusual locations
• Registration of look-alike domains, so criminals can’t use them

What is the single most effective control?

The phone call. A two-minute call to a known number defeats almost every version of this scam. Write it into your payment procedure, and make it mandatory for every bank detail change, no matter who asks or how urgent it sounds.

What should I do if I sent money to a scammer?

Move fast. Recovery depends on hours.

1. Call your bank at once and ask for a recall of the wire or a reversal of the transfer.
2. File a complaint with the FBI at ic3.gov. Include the bank and account details of the recipient. The FBI can sometimes freeze funds when a report arrives soon after the transfer.
3. Change the passwords on the affected email accounts, and check for forwarding rules.
4. Notify your cyber insurer and your attorney.
5. Tell the vendor or person who was impersonated.
6. Keep the emails. Don’t delete evidence.

Can I get the money back?

Sometimes. The chance is best when you report within a day or two, before the money moves overseas. After that, recovery becomes unlikely. Speed is the reason every employee should know who to call.

Does cyber insurance cover BEC?

Some policies do, often under a “social engineering” or “funds transfer fraud” section with its own lower limit. Many require proof that you followed a verification procedure. Read your policy and ask your broker before you need it.

How do I protect my customers from criminals posing as me?

• Set up DMARC on your domain
• Tell customers that you will never change bank details by email alone
• Put that statement on your invoices
• Give customers a phone number to verify any request

How is BEC different from phishing?

Phishing casts a wide net and aims to steal credentials or install malware. BEC targets one person in one business with a request for money. Phishing often comes first: a stolen email password gives the criminal the mailbox they use for the BEC attempt.

How often should I train staff on BEC?

Train everyone who touches money at hire and at least once a year, and send a reminder before busy periods such as year end and tax season. Include the owner. Criminals impersonate the owner because staff hesitate to question the boss.

Your next step

Write one rule into your payment process today: every change in bank details gets a phone call to a known number. Cerberus Cybersecurity can train your finance staff and document your payment controls through our cybersecurity training and policy development. Contact us to protect your business from invoice fraud.

By J. Mesa

If I could convince every business owner to do one thing this week, it would be to turn on multi-factor authentication. It costs little or nothing, it takes minutes, and it stops the attack I see most often: someone logging in with a stolen password.

This guide explains what multi-factor authentication is, how the different types compare, and how to put it in place across a small business.

What is multi-factor authentication?

Multi-factor authentication (MFA) is a login method that asks for two or more proofs of identity. After you enter your password, you confirm it is you with a second step, such as a code from an app or a tap on your phone.

The proofs come from different categories:

• Something you know: a password or PIN
• Something you have: a phone, an authenticator app, or a security key
• Something you are: a fingerprint or your face

A login counts as multi-factor when it uses at least two categories.

What is the difference between MFA and 2FA?

Two-factor authentication (2FA) is MFA with exactly two factors. Most people use the terms to mean the same thing. Two-step verification is a close cousin that some services use for the same idea.

Why do I need MFA?

Passwords leak. They leak through data breaches, phishing emails, and malware, and people reuse them across sites. An attacker who buys a list of leaked passwords can try them against your email in seconds.

With MFA on, the password alone is not enough. The attacker also needs your phone or your security key. Microsoft has reported that MFA blocks the vast majority of automated account attacks.

How does MFA work?

1. You enter your username and password.
2. The service asks for a second proof.
3. You approve a prompt, enter a code, or touch a key.
4. The service lets you in.

Many services remember a trusted device, so you see the second step only on a new device or after a set period.

What are the types of MFA?

• Text message codes. The service sends a code to your phone number.
• Authenticator apps. An app such as Microsoft Authenticator or Google Authenticator generates a code that changes every 30 seconds.
• Push notifications. You approve a prompt on your phone, sometimes by matching a number shown on the login screen.
• Hardware security keys. A small device, such as a YubiKey, that you plug in or tap.
• Passkeys. A login stored on your device and unlocked with your fingerprint, your face, or a PIN.
• Biometrics. A fingerprint or face scan, often used to unlock one of the methods above.

Which type of MFA is the most secure?

From strongest to weakest:

1. Hardware security keys and passkeys. They check that you are on the real website, so a fake login page can’t capture them.
2. Authenticator apps and push prompts with number matching.
3. Text message and phone call codes. A criminal can intercept these by taking over your phone number, a fraud called SIM swapping.

Any MFA is far better than a password alone. Use the strongest option each service offers, and don’t wait for the perfect one.

Which accounts should I protect first?

1. Email. Password resets for every other account go there.
2. Banking and payroll.
3. Remote access, such as a VPN or remote desktop.
4. Administrator accounts for your computers, network, and cloud services.
5. Cloud file storage.
6. Your domain registrar and website.
7. Social media.

How do I set up MFA?

1. Open the security or account settings of the service.
2. Look for “two-step verification,” “two-factor authentication,” or “multi-factor authentication.”
3. Choose an authenticator app or a security key when available.
4. Scan the QR code with your app, or register your key.
5. Save the backup codes somewhere safe, away from your computer.
6. Add a second method, so one lost device does not lock you out.

What if I lose my phone?

Plan for it before it happens.

• Keep the backup codes each service gives you
• Register two methods, such as an app and a security key
• Use an authenticator app that backs up its accounts
• At work, name an administrator who can reset MFA for staff after confirming their identity

Can MFA be bypassed?

Yes, and it still stops most attacks. Know the tricks:

• MFA fatigue. An attacker who has your password sends prompt after prompt, hoping you approve one to make it stop. Deny any prompt you did not start, and change that password.
• Real-time phishing. A fake login page passes your password and code to the real site as you type them.
• SIM swapping. A criminal moves your phone number to their SIM and receives your text codes.
• Stolen session cookies. Malware copies the token that keeps you logged in.

Number matching, security keys, and passkeys defeat the first three.

How do I roll out MFA across my business?

1. Start with email and administrator accounts.
2. Tell staff what is coming and why.
3. Give them a short guide with screenshots.
4. Set a deadline, and help anyone who gets stuck.
5. Turn on enforcement, so MFA is required and not optional.
6. Check each month that new accounts have it.

Microsoft 365 and Google Workspace both let an administrator require MFA for every user.

How do I handle employees who resist?

Explain the reason in plain terms: one stolen password could expose every customer. Show how little time it takes. Let people choose between an app and a security key. Offer a key to anyone who does not want to use a personal phone.

Do insurers and regulations require MFA?

More and more, yes. Cyber insurers ask about MFA on applications and may decline coverage without it. PCI-DSS requires it for access to card data environments. The FTC Safeguards Rule requires it for covered financial businesses. Clients often ask for it in security questionnaires.

Does MFA cost money?

The MFA features in Microsoft 365, Google Workspace, and most online services are included. Authenticator apps are free. Hardware keys cost a modest one-time amount per person. The time to set it up is the main cost.

Your next step

Turn on MFA for your own email account today, then set a date to require it for everyone in your business. Cerberus Cybersecurity helps small businesses roll out MFA and write the policy that goes with it, as part of our policy and documentation development. Contact us to get started.

By J. Mesa

Anyone can send an email that claims to come from your business address. The original design of email never checked. Criminals use that gap to send fake invoices to your customers in your name. Three DNS records close it: SPF, DKIM, and DMARC. Since February 2024, Google and Yahoo have required them from bulk senders, and mail from domains without them lands in spam more often each month.

What is email spoofing?

Email spoofing is forging the “From” address of a message so that it appears to come from someone else. A spoofed message from your domain needs no access to your mailbox. The sender simply types your address into the From line.

What is SPF?

SPF, or Sender Policy Framework, is a DNS record that lists the servers allowed to send email for your domain. When a message arrives, the receiving server checks whether it came from a server on your list.

An SPF record for a business that sends through Microsoft 365 looks like this:

v=spf1 include:spf.protection.outlook.com -all

The ending matters. “-all” tells receivers to reject senders that are not listed. “~all” tells them to treat such mail as suspicious. A domain can have only one SPF record, and that record may trigger no more than ten DNS lookups, so adding every service you have ever tried will break it.

What is DKIM?

DKIM, or DomainKeys Identified Mail, adds a digital signature to each message you send. Your mail system signs the message with a private key. You publish the matching public key in DNS. The receiving server uses it to confirm that the message came from your domain and that nobody altered it on the way.

DKIM survives forwarding better than SPF does, which is one reason you need both.

What is DMARC?

DMARC, or Domain-based Message Authentication, Reporting, and Conformance, ties the other two together. It does three jobs.

• Alignment. It checks that the domain in the visible From address matches the domain that passed SPF or DKIM. Without this check, a criminal could pass SPF with their own domain while showing yours to the reader.
• Policy. It tells receiving servers what to do with mail that fails: nothing, quarantine it, or reject it.
• Reporting. It asks receivers to send you reports of who is sending mail in your domain’s name.

A starting DMARC record looks like this:

v=DMARC1; p=none; rua=mailto:[email protected]

What do the DMARC policies mean?

• p=none. Monitor only. Receivers deliver failing mail as usual and send you reports. This protects nobody, and it is the right place to begin.
• p=quarantine. Receivers send failing mail to the spam folder.
• p=reject. Receivers refuse failing mail outright. This is the goal.

What do Google and Yahoo require?

Since February 2024:

• All senders to Gmail and Yahoo addresses need SPF or DKIM.
• Bulk senders, which Google defines as those sending about 5,000 or more messages a day to Gmail accounts, need SPF, DKIM, and a DMARC record with a policy of at least p=none. Marketing messages need a one-click unsubscribe, and spam complaint rates must stay low.

A small business sending a few hundred messages a day is not a bulk sender. The direction is still clear. Unauthenticated mail is getting filtered, and your invoices and appointment reminders are not exempt.

How do I set up SPF, DKIM, and DMARC?

1. List every system that sends email as your domain. Your mail provider, your website’s contact form, your invoicing or accounting software, your newsletter service, your scheduling tool, your CRM, the office copier that scans to email.
2. Publish one SPF record that includes each legitimate sender.
3. Turn on DKIM in each sending service. Each one gives you DNS records to add. In Microsoft 365 and Google Workspace, DKIM for your own domain is off until you enable it.
4. Publish a DMARC record at p=none with a reporting address.
5. Read the reports for two to four weeks. They arrive as data files that are hard to read by hand. A DMARC reporting service, several of which offer free tiers, turns them into a chart of who is sending as you.
6. Fix what you find. Add the legitimate senders you forgot. Note the ones you do not recognize.
7. Move to p=quarantine, then watch for a few more weeks.
8. Move to p=reject.

You make these changes wherever your DNS is hosted: your domain registrar, your web host, or a DNS provider.

How do I check my domain?

Free lookup tools from MXToolbox, dmarcian, and others show your current records. You can also send a message to a Gmail account, open it, and choose “Show original.” Gmail displays a pass or fail result for SPF, DKIM, and DMARC.

What are the common mistakes?

• Staying at p=none forever. Monitoring mode stops no spoofed mail. Many businesses publish the record to satisfy a checklist and never move on.
• Two SPF records. That counts as an error, and SPF fails.
• Too many lookups in the SPF record.
• Ending SPF with “+all,” which authorizes the entire internet.
• Forgetting a sender. The invoicing system gets left out, and customer invoices go to spam once enforcement begins.
• Skipping DKIM on third-party services.
• Jumping to p=reject without reading the reports first.
• Ignoring domains you own and do not use for email. Criminals spoof those too. Publish “v=spf1 -all” and a DMARC record of p=reject on each parked domain.

Does DMARC stop all phishing?

No. DMARC stops exact spoofing of your domain. It does not stop:

• Look-alike domains, such as a version of your name with one letter changed
• Display name tricks, where the name shows your boss and the address belongs to a free mail account
• A hacked mailbox, which sends real, authenticated mail. See how to tell if your email has been hacked.

You still need mail filtering, multi-factor authentication, a payment verification procedure, and trained staff who can spot a phishing email.

Why should a small business bother?

• Protection for your customers and vendors. A fake invoice from your address damages your name even though you did nothing.
• Deliverability. Authenticated mail reaches the inbox more reliably.
• Compliance and insurance. PCI DSS version 4 calls for anti-phishing controls, and insurance applications ask about email authentication.
• Visibility. The reports show you every service sending mail as your company, including ones nobody remembers setting up.

How long does it take?

The DNS changes take an hour. Reaching p=reject safely takes four to eight weeks for most small businesses, because you need time to see all your legitimate senders in the reports.

What comes after DMARC?

Two optional additions. MTA-STS tells other servers to deliver mail to you only over an encrypted connection. BIMI displays your logo next to authenticated messages in some inboxes and requires a DMARC policy of quarantine or reject first. Both help. Neither matters until the first three records are in place and enforced.

Your next step

Look up your domain’s DMARC record today. If you find none, or you find p=none with no plan to move forward, start with step 1 above. Cerberus Cybersecurity checks email authentication as part of our risk and compliance assessments and guides small businesses to an enforced policy without losing legitimate mail. Contact us to get started.

By J. Mesa

A customer calls to ask why you sent a strange link. A password reset arrives for an account you did not touch. Messages you never read show up as opened. Any one of these can mean a stranger is inside your email. Act the same day, because your mailbox is the master key: nearly every other account you own sends its password reset there.

How do I know if my email has been hacked?

Watch for these signs.

• Contacts report messages from you that you did not send.
• Your Sent folder holds messages you did not write, or the folder has been emptied.
• You stop receiving mail you expect, such as replies from a customer or bank notices.
• Password reset emails arrive for other accounts.
• Your password no longer works.
• You receive sign-in alerts from places you have never been.
• You get multi-factor prompts you did not start.
• Your recovery phone number or backup email address has changed.
• You find rules or forwarding settings you did not create.
• Unread messages appear as read, or mail turns up in odd folders.

How do email accounts get hacked?

• Phishing. You typed your password into a fake sign-in page. See our guide to spotting a phishing email.
• Reused passwords. A breach at another website exposed a password you also use for email. Attackers test those in bulk, an attack called credential stuffing.
• Malware. An information-stealing program on your computer copied saved passwords and browser sessions.
• Session theft. A phishing page relayed your sign-in to the real site and captured the session token, which works even on accounts with basic multi-factor authentication.
• Malicious app permission. You approved an app that asked to read your mail.
• Weak or guessable passwords.
• A sign-in on a shared or infected computer.

What do hackers do with a hacked email account?

• Reset your other passwords. Banking, shopping, payroll, and social media all send reset links to email.
• Read your history. Old messages hold tax documents, ID scans, contracts, and invoices.
• Watch quietly. In a business account, an attacker may read mail for weeks to learn who pays whom and when.
• Redirect payments. The attacker replies inside a real email thread and tells your customer that your bank details have changed.
• Phish your contacts. A message from your real address gets opened and trusted.
• Hide the evidence. Inbox rules move replies and security alerts out of sight.

What should I do first?

Work from a device you trust. If you suspect malware on your computer, use a different one or your phone.

1. Change the password to a long one you have never used anywhere.
2. Sign out of all sessions. In Gmail, open your Google Account, then Security, then “Your devices.” In a Microsoft account, use “Sign out everywhere.” This ejects anyone already inside.
3. Turn on multi-factor authentication, or reset it if it was already on. Remove any phone number, authenticator, or security key you do not recognize.
4. Check your recovery options. Confirm that the backup email address and phone number are yours.
5. Remove forwarding and rules. See the next section.
6. Review connected apps and remove any you do not recognize or no longer use.
7. Scan your computer for malware before you sign in from it again.

How do I find hidden forwarding rules?

Attackers count on you skipping this step. A rule they created keeps working after you change the password.

• Gmail. Open Settings, then “See all settings.” Check “Forwarding and POP/IMAP” for a forwarding address, “Filters and Blocked Addresses” for filters you did not make, and “Accounts and Import” for unknown “Send mail as” addresses or delegates.
• Outlook and Microsoft 365. Open Settings, then Mail. Check “Rules” and “Forwarding.” Look for rules that move messages to RSS Feeds, Conversation History, or Deleted Items, or that mark mail as read. Rules that match words such as “invoice,” “payment,” or “wire” are a strong sign of payment fraud in progress.
• Yahoo and others. Look under mail settings for filters, forwarding, and connected accounts.

Check your signature and your automatic reply as well. Attackers sometimes plant a link or a phone number there.

What should I do after I regain control?

1. Change the passwords on your important accounts, starting with banking, payroll, and anything that uses the same password. Check each for changes to contact details.
2. Warn your contacts. Tell them to ignore recent messages and not to act on any payment instructions.
3. Read your Sent and Deleted folders to see what the attacker sent and to whom.
4. Check what your mailbox held. If it contained Social Security numbers, tax forms, or financial statements, freeze your credit.
5. Watch your accounts closely for the next few months.

What if I am locked out?

Use the provider’s official recovery process: Google’s account recovery page, Microsoft’s recovery form, or the equivalent for your provider. Answer from a device and a location you have used with that account before, which improves your odds. Recovery can take days.

Never pay a “recovery service” you found through a search or a social media comment. Those are scams that target people who are already locked out. The provider does not charge for recovery.

What if it is a business email account?

A hacked work mailbox is a security incident for the whole company. Bring in your IT provider at once, and add these steps.

1. Reset the password and revoke all sessions from the admin console.
2. Review sign-in logs for the account and for other accounts from the same addresses.
3. Search the audit log to learn which messages the attacker opened and sent.
4. Check every other mailbox for the same malicious rules.
5. Call your bank if invoices, wires, or payroll were discussed in the mailbox. Call customers and vendors by phone to confirm that no payment instructions have changed.
6. Call your cyber insurance carrier and your attorney. A mailbox that held customer, patient, or employee data can trigger breach notification laws.
7. Preserve the evidence. Do not delete the account or its logs.

Our guide to securing Microsoft 365 lists the settings that prevent most of these takeovers.

How do I prevent the next one?

• Use a unique, long password for email, stored in a password manager.
• Use strong multi-factor authentication. An authenticator app or a security key beats text message codes.
• Never approve a sign-in prompt you did not start.
• Keep your devices updated and avoid pirated software, a common source of password-stealing malware.
• Review your account security page twice a year: devices, recovery options, connected apps, and rules.
• Avoid signing in on shared computers.
• Reach your mail by typing the address or using a bookmark, not through a link in a message.

Should I just create a new email address?

Rarely. Once you remove the attacker and secure the account, the old address is safe to keep. Abandoning it creates new risks: other accounts still send resets there, and some providers recycle unused addresses. Clean it and lock it down.

Your next step

Open your email settings now and check two things: the forwarding address and the list of rules. It takes two minutes, and it is the check most people have never made. For help securing business email and training your team, see our cybersecurity training and services, or contact Cerberus Cybersecurity.