Phishing email
The email copies the look of a familiar service and leads to a fake sign in page. The login and password go to the attacker while the employee sees a familiar form.
Check the full sender address and the link domain before clicking.
Online security
Most leaks start with an ordinary email or phone call, not with a broken system. This page collects what actually protects a company account and its money.
Why this concerns everyone
It is easier for an attacker to talk an employee into something than to break technical protection. Each of these tricks relies on haste and trust, not on a weak system.
- A call pretending to be the bank
- An invoice from a familiar counterparty
- A copy of the sign in page
How attackers operate
Six scenarios company employees run into most often.
A call from the security team
The caller claims to be the bank or the IT team, rushes you and asks for the code from a message. A real security team never asks for codes or passwords.
Hang up and call back using the number from the official website.
Substituted payment details
An invoice is swapped inside the thread: the email arrives from a lookalike domain and reads as a continuation of the discussion. The money goes to someone else account.
Confirm any change of payment details by phone, not in the thread.
Infected attachment
A document with macros or an archive with an executable starts an encryption program. Files on the computer and in the shared folder become unavailable.
Never enable macros in documents from external emails.
Someone else device
Signing in from a personal or shared computer leaves an active session behind. The next person at that computer gets access to the data.
End the session explicitly instead of just closing the tab.
A message from an executive
Someone messages you in a chat app claiming to be the director or the CFO: the account is new or just shares the name, the tone is urgent, and they ask you to transfer money or send documents right away. It relies on staff being afraid to double check with management.
Confirm any urgent transfer request by calling a known number.
Rules that actually work
A short list worth passing on to every employee.
A separate password for work systems
The work account password must not be reused anywhere. A leak on a third party site should not open the company documents.
A second factor wherever it exists
One password is not enough. A second factor stops a sign in even with the correct password if it has leaked.
Electronic signature instead of scans
A signed document cannot be altered unnoticed. A scanned signature in an email confirms nothing.
Minimal rights
An employee gets access only to the data required for the job. When they leave, access is revoked in one place.
Updates without delay
Most mass infections exploit vulnerabilities that were closed months ago. A postponed update is an open door.
A check before payment
A change of bank details is confirmed by voice on a known number. That is one minute against a lost payment.
What the platform does
Part of the protection should not depend on how attentive an employee is. It is built into the products.
- A single A3.ID account: access is granted and revoked in one place for every product.
- Our own certificate authority: a document signature is validated on the platform side.
- An action log: it is visible who opened and changed a document, and when.
- Separation by organisation: an employee does not see the data of a neighbouring legal entity.
- A public status page: we report an outage instead of an employee discovering it through downtime.
If something has already happened
What to do when you suspect a compromise.
- 1
Change the password
Start with the work account, then the mailbox. If the password was reused, change it on the other services too.
- 2
End other sessions
In the account settings close every active session except the current one. That throws the attacker out of the system.
- 3
Tell the company
Warn the IT team and the accounting department. The sooner they know, the higher the chance of stopping a payment.
- 4
Write to us
If the suspicion concerns A3 products, write to the support address. We will check the logs and help close the access.
Shall we review the protection in your company?
We will look at how access to systems is arranged today and suggest what to close first.