Key takeaways
- Phishing attacks rely on deception: fake emails, links, phone calls, or QR codes are used to harvest login credentials and sensitive information.
- Typical red flags include a sense of urgency, suspicious senders, questionable links, and requests to enter data or initiate payments.
- Technical protection is provided by anti-phishing, Safe Links, and Safe Attachments in Microsoft Defender for Office 365 (Plan 1 is included in Business Premium), phishing-resistant MFA, as well as SPF, DKIM, and DMARC.
- Employees remain your most important line of defense: training, phishing simulations, and clear reporting procedures significantly reduce risk.
- If you have fallen for a phishing attempt, notify IT immediately, have your password reset and sessions terminated, and report the incident to antiphishing.ch.
- No protection is foolproof: proper configuration, regular audits, and a clear incident response plan are essential.
Phishing attacks target people, not technology: A convincing email, a fake link, and login credentials and information are in the hands of the attackers. The Federal Office for Cybersecurity (BACS) recorded numerous reports of phishing related to Microsoft 365 in the first half of 2026. This article shows how companies can detect phishing, which technical and organizational measures provide protection, and how employees and data can be secured with Microsoft Security.
Detecting phishing: Typical characteristics and forms of attack
Detecting phishing means paying attention to red flags before clicking a link or opening an attachment. Attackers often impersonate well-known senders, such as Microsoft, banks, suppliers, or your own management team.
Identifying the signs of a phishing email
- Time pressure or threats, such as an allegedly expiring login or an urgent payment
- A sender address that looks familiar but is slightly different
- Links whose destination does not match the alleged sender, visible by hovering over them with the mouse
- Unexpected attachments or requests to log in to a website
- Requests to enter login credentials, share codes, or change payment details
Spelling errors are no longer a reliable indicator. Messages created with AI are often linguistically convincing, so a flawless text is not proof that an email is genuine.
Overview of attack forms
Protection against phishing: Technical measures for emails and links
Technical protection is designed to intercept phishing emails before they reach employees and to limit the damage if one does get through. In Microsoft 365, several layers work together to achieve this.
Using Anti-Phishing, Safe Links, and Safe Attachments
Exchange Online Protection filters spam and malware in every Microsoft 365 tenant. Microsoft Defender for Office 365 provides additional protection: Safe Links checks links when clicked, Safe Attachments tests attachments in a secure environment before they are delivered, and anti-phishing policies detect impersonations of known senders. Safe Links and Safe Attachments also provide protection in Teams. According to Microsoft, Plan 1 is included in Microsoft 365 Business Premium but must be activated and configured. Plan 2 adds features such as automated investigation and attack simulations and is part of the Defender Suite for Business Premium. All these functions operate under the umbrella of Microsoft Defender.
Securing logins with phishing-resistant MFA
Even if login credentials are stolen, a second layer of authentication prevents unauthorized access. Phishing-resistant methods such as passkeys, FIDO2 security keys, or Windows Hello for Business are considered more secure. SMS and phone calls are less secure; Microsoft is discontinuing its self-provided SMS and voice verification in Entra ID on February 1, 2027With Conditional Access in Microsoft Entra you can further control who is allowed to access data and from where.
Protect your sender domain with SPF, DKIM, and DMARC
SPF, DKIM, and DMARC ensure that third parties cannot send emails on behalf of your domain without being detected. This protects customers and business partners from fake messages appearing to come from you. These methods do not prevent the takeover of a legitimate mailbox, where strong authentication remains critical. The records are configured in your domain's DNS.
Phishing protection in the company: Employees as the most important line of defense
Technology catches a lot, but not everything. For messages that make it through the filters, the final decision rests with the people in their inboxes. Effective protection therefore combines technology with awareness.
Conduct regular training and phishing simulations
With Attack Simulation Training in Defender for Office 365 Plan 2, you can simulate phishing attacks realistically and assign targeted training. This feature is not included in Plan 1. Additionally, you can use Security training in the daily workflow with Darktrace .
Establish reporting channels and clear rules
Employees need an easy way to report suspicious messages, such as via the report function in Outlook (Report Message add-in, included in Defender for Office 365). For payments and changes to account details, a firm rule helps: verify via a known channel and require approval from a second person, even if the request supposedly comes from management or a business partner. Such rules are part of the organizational measuresthat are just as important for security as technology, along with an emergency plan and regular training.
Phishing attack detected: How companies should respond correctly
If a link has been clicked or login credentials have been entered, speed is of the essence. These steps have proven effective:
- Inform IT immediately and stop using the affected account
- Reset the password and terminate active sessions
- Check the mailbox for forwarding rules and new settings that attackers might use to monitor communications
- Search for and remove the phishing email from all mailboxes
- Report the incident: send the website or link to antiphishing.ch, if necessary via the BACS online reporting form
If confidential information or personal data has been compromised, you must also check for any reporting obligations to the affected parties and authorities. If you do not have your own security department, you can cover monitoring and response with a partner, for example as part of Managed Services.
Configuration and data: Regularly check your protection
Even the best license only provides protection if policies are active and correctly configured. You can assess how well your existing configuration is set up with a Tenant Security Check check. And if access credentials are leaked despite these protections, sensitivity labels and data loss prevention in Microsoft Purview limit the damage by ensuring that sensitive data does not leave the company uncontrolled.
Conclusion
Phishing cannot be completely prevented, but it can be made significantly more difficult and its impact mitigated. An effective approach combines email and link filters, phishing-resistant authentication, trained employees, and a clear procedure for emergencies. You can determine which measures will be most effective for your company in a consultation based on your existing environment.
Frequently Asked Questions
How do I recognize a phishing email?
Watch out for time pressure, suspicious sender addresses, links that don't match the sender, unexpected attachments, and requests to enter login credentials. When in doubt, do not click; instead, verify the request through a known, trusted channel.
What should I do if I’ve clicked on a phishing link?
Notify IT immediately. If you have entered any data, your password and active sessions should be reset right away. Following this, the incident will be reported and we will check whether any other mailboxes have been affected.
Does Microsoft 365 automatically protect against phishing?
Microsoft 365 includes basic protection against spam and malware. More advanced features such as Safe Links, Safe Attachments, and anti-impersonation protection are part of Defender for Office 365. Plan 1 is included in Business Premium, but it must be activated and configured.
What is the difference between phishing and spear phishing?
Classic phishing is sent as a mass mailing to many recipients. Spear phishing is targeted and personalized, often leveraging specific knowledge about the individual and the company, which makes it appear more credible.
Where can I report phishing in Switzerland?
Suspicious websites and links can be reported to the Federal Office for Cybersecurity at antiphishing.ch. If you would like a response regarding your report, please use the BACS online reporting form.
Is employee training alone enough?
No. Training reduces risk, but it doesn't eliminate it. Effective protection combines training with technical filters, strong authentication, and clear reporting procedures.
You might also be interested in
