Email Scams Got Better. Here's What They Look Like Now.

The advice most of us learned about phishing goes something like this: look for typos, check the sender’s address, don’t click strange links. That advice isn’t wrong. It just doesn’t catch what’s landing in inboxes now.

Over the last few months, the email scams we see aimed at small and mid-sized businesses on Long Island have gotten noticeably better. The messages come from real addresses of people you know. The sign-in pages look right because, in some cases, they are Microsoft’s real pages. And a lot of them get past the phone approval most people think of as their safety net.

Here’s what they look like, how they work, and what actually stops them.

What Business Email Compromise Is

Business email compromise (BEC) is the umbrella term for scams that use email to steal money or access from a business. Sometimes the attacker impersonates someone you trust. Increasingly, they don’t need to impersonate anyone: they take over a real mailbox and send from it.

Once an attacker is inside a mailbox, the business behind it becomes the bait for everyone it emails. That’s why one compromised account at a vendor turns into convincing scams at a dozen of its customers.

What the Lures Look Like

Requests for proposal or quotes. Someone asks you to bid on a project or price out an order. The details are in an attached PDF or a shared document, and opening it means signing in. The sender’s domain is often a near-perfect copy of a real company’s.

Invoices and statements. A “revised statement” or “updated invoice” arrives from a vendor you really do work with, at their real address, because the vendor’s own account was taken over first. It passes the sniff test and most email filters, because nothing about the sender is fake.

Contract proposals and shared files. A taken-over account sends “contract proposal” or “document shared with you” to everyone in its contacts. A familiar name does the rest.

How They Get In

None of these need malware. They all come down to getting you to sign in somewhere the attacker can use. Two methods are doing most of the damage right now.

Device code phishing

Microsoft has a sign-in method built for devices without a keyboard, like conference room screens. The device shows a short code, and you type it into microsoft.com/devicelogin from your phone or laptop.

Attackers use it like this: the email or PDF shows you a code and asks you to enter it at that address. The page is Microsoft’s real site, so everything looks legitimate. When you enter the code and finish signing in, you’ve signed the attacker’s session into your account. They never needed your password. Many go a step further and register a fake computer to the account, and a device registered that way can keep working after a password change.

Fake sign-in pages that pass your approval along

The second method uses a page that looks like Microsoft’s but sits between you and the real one. Everything you type goes straight through to Microsoft. You enter your password, Microsoft sends the usual prompt to your phone, you approve it, and you’re signed in. So is the attacker, because the page kept the signed-in session for itself.

This is the part that surprises people. Multifactor authentication (MFA) with a phone prompt stops someone who only has your password. It does not stop a page like this, because you’re the one signing in.

What Happens Once They’re In

Attackers move quickly, usually within minutes. A typical sequence:

• Read the mailbox to learn who pays whom, and how.
• Set up hidden inbox rules that file away or delete replies, so the real owner doesn’t see the conversation.
• Send fake payment requests or “updated bank details” to customers and vendors, from the real address.
• Send the next wave of lures to everyone in the contacts.

That last step is how it spreads: your contacts get an email from you, and they have every reason to trust it.

Habits That Stop Most of It

You don’t need to become a security analyst. A handful of habits close most of these doors.

1. Never enter a code at microsoft.com/devicelogin because an email, PDF, or text asked you to. That request only makes sense when you started it yourself, on a device in front of you.
2. Treat “sign in to view this document” as a reason to pause. If you weren’t expecting it, call the sender at a number you already have, not one from the email.
3. Confirm every change to bank details or payment instructions by phone. Every time, even with people you deal with every week.
4. Read the sender’s domain letter by letter when an email asks you to do something with money or credentials.
5. Don’t reply to a suspicious email or forward it to coworkers. Replying all to a phishing email is how it slips past the filter into everyone else’s inbox. Report it to your IT team instead.
6. If you entered a password or a code and something feels off, say so right away. The first hour matters far more than being sure.

What to Ask Your IT Team

Habits help. Settings help more, because they don’t depend on anyone being careful on a busy afternoon. If you’re in Microsoft 365, these are worth asking about:

• Is device code sign-in blocked? A Conditional Access policy in Microsoft Entra ID can turn it off for everyone who doesn’t need it. Almost nobody does.
• Does adding a device to an account require MFA? It should. A Conditional Access policy on the “Register or join devices” action is Microsoft’s recommended way to require it. Joining computers to your Microsoft Entra directory can also be limited to the few people who set up machines.
• Are we using phishing-resistant sign-in for the people who handle money? Passkeys (in the Microsoft Authenticator app) and hardware security keys won’t complete a sign-in on a fake page, which closes the gap a phone prompt leaves open.
• Are any mailboxes exempt from spam and phishing filtering? Exemptions get added for good reasons and then forgotten. They’re worth an audit.
• Is anyone watching sign-ins and inbox rules? Identity threat detection catches new inbox rules, unusual sign-ins, and new devices as they happen, rather than when a customer calls about a strange invoice.
• What happens if an account is compromised? A password reset alone is not the answer. The account should stay disabled until the password is reset, every session is revoked, and anything the attacker added is gone: devices registered to the account, sign-in methods like an authenticator app, passkey, or phone number, and inbox rules, forwarding, and app permissions. Only then should it be turned back on.
• Does our security awareness training include these lures? Simulated phishing that only uses the obvious stuff teaches people to catch the obvious stuff.

The Bottom Line

The people who fall for these scams aren’t careless. The emails come from real contacts, and sometimes the sign-in page really is Microsoft’s. The fix is a mix of a few good habits and settings that don’t rely on anyone being perfect.

We’ve been tightening all of the above for our managed clients. If you’d like a second set of eyes on your own Microsoft 365 or Google Workspace setup, get in touch. We’re happy to walk through it.