She Asked If the Email Was Real. The Password Was Already Gone.

At three o'clock on a Thursday afternoon last week, an email landed in the inbox of a senior person at one of our clients. It said she had received a document to review and sign, with a reference number and a button that read View and Approve. It came from the address of a restaurant in another state. Underneath, where a real email thread would be, sat a stale conversation between two strangers about a solar installation, pasted in to make the message look like part of something ongoing.

At twenty to four she forwarded it to us with one line. She was having trouble getting in, and was this real?

We told her within two minutes that it was a scam and asked her to report it, which she did.

At nineteen minutes to five, someone signed in to her account from a rented server in Los Angeles, through an address built to hide where the person behind it really was. Microsoft flagged the sign-in as risky, our alerting raised it as critical in the same minute, and the account was secured: a new password, every open session signed out, and a check of the mailbox for rules and forwarding the attacker might have left behind.

Nobody is in trouble. She asked, which is more than most people do, and she told us the one thing that mattered. This post is about why that one thing was easy to read past, and what to do with it.

Four words that mean the password is gone

"Having trouble getting in." That was the sentence. It reads like a technical complaint. It is actually a confession, and an innocent one: she had clicked the button, landed on a page that looked like a sign-in page, typed her password, and nothing happened. Nothing happened because it was never a sign-in page. It was a form that sent what she typed to someone else, then showed her an error so she would try again.

By the time the question reached us, the attacker already had what they came for. The hour that followed was not the attacker breaking in. It was the attacker getting round to it.

So here is the rule we now apply, and the one we would suggest for any IT team. When a person says they tried to sign in from an email and it did not work, treat the password as stolen from that moment. Reset it first, then look at the email. A reset inside that hour wins. A reset after the sign-in is cleanup.

And the rule for everyone else is the mirror of it. If you clicked and typed, say so, in those words. "I entered my password" is the most useful sentence an IT team can receive, and nobody competent will make you feel small for sending it. The person who says it within minutes is the best outcome we get. The person who clicked on Tuesday and mentioned it on Friday is the one that hurts.

What the response has to include

Microsoft publishes a checklist for exactly this situation on its own platform, and it is worth knowing what is on it, because it is what your provider should be working through on a day like this.

Reset the password, and do not send the new one by email, because the attacker may still be reading the mailbox. Sign the account out everywhere, because a new password on its own does not close a session that is already open. Review the devices registered for multi-factor sign-in, because attackers add their own. Review which apps have been given access to the account. Remove any forwarding or inbox rules the attacker created, which is the standard way they keep a copy of the email after being locked out. We wrote about that last pattern in September, in the post about the email rule nobody wrote. Then read the sign-in log and find out where else the account has been.

None of that is dramatic. It is an hour of careful work. Every step exists because attackers reliably do the thing it undoes.

Why this one got through

A fair question is why the email arrived at all. By every sign it was sent from a real mailbox at a real business, one whose own account had been taken over, so every check a filter runs on a sender passed, because the sender was genuine. There was no attachment to scan. The link was a few hours old, and a filter can only block an address that something has already seen. That is the shape of most phishing that reaches an inbox today, and it is why filtering is one layer among several. The layers behind it are the ones that did the work here: the report button, the person asking, and the alert on the sign-in.

It was not a crude email. The signs Microsoft lists were all there, but they were quiet. A sender she had never heard from, marked external. A generic greeting with her email address where her name should be. A request to act, with a button. A domain that had nothing to do with documents or signatures. No spelling mistakes, no threats, no urgency in capital letters.

And it arrived at three on a Thursday, into a week when she was already chasing a legitimate document that would not arrive. An email saying a document was waiting for her was the one email she was hoping to see. That is not an accident. Attackers do not need to know your week; they only need to send enough messages that some of them land in one like it.

Any one of those signs is a reason to ask before clicking. Two together is a reason to assume. Our clients have a report button in the email itself; it marks the message, sends it to us, and starts a check. If you do not have that, forward the email to your IT provider and leave the button alone until they come back to you. Ten minutes. Nothing legitimate breaks in ten minutes. No real document expires because a reply took a quarter of an hour.

The numbers behind the habit

The FBI's Internet Crime Complaint Center took just over one million complaints in 2025, with reported losses above twenty billion dollars. Phishing and spoofing was the most reported crime of all, at 191,561 complaints. Business email compromise, the fraud that usually begins with exactly this kind of sign-in, accounted for about three billion dollars of the losses on its own.

Those are the reported ones. The incidents that end with a password reset and a quiet evening, like this one, never make a list. That is the outcome to aim for, and it was available here because the sign-in was caught the minute it happened and the person involved had already told us the truth.

One thing to do this week

Tell your staff two sentences. If an email feels wrong, send it to IT and do nothing else until IT replies. If you already clicked and typed, say that in the first line. Then make the other half true: make sure the reply comes within minutes during the working day, and that "I typed my password" is answered with a reset, not a reassurance.

If someone in your office sent that first line to your IT provider at ten past three tomorrow, would their password be changed before the stranger in the rented server got round to using it?

Sources: Microsoft Learn, "Respond to a compromised email account in Microsoft 365," updated August 2026; Microsoft Support, "Protect yourself from phishing"; FBI Internet Crime Complaint Center, "2025 Internet Crime Report" (1,008,597 complaints, $20.877 billion in reported losses; phishing and spoofing 191,561 complaints; business email compromise $3.05 billion in reported losses). The incident described is from our own work and identifies no organization or person.