Your bookkeeper opens the inbox and sees an email from a regular vendor. The PDF invoice inside looks identical to the real ones that arrive every month. One click later the laptop that left with the last employee starts sending more messages to other vendors.

The Email That Reaches the Bookkeeper

Good IT already blocks these messages at the Microsoft 365 gateway. They watch for small changes in the sender address and scan every attachment before it lands in the inbox. The bookkeeper never sees the message because the filter catches the mismatch in the domain and the unusual request for updated payment details.

The tell that your IT company is not doing the work shows up when the same vendor name appears with a slightly different email address two or three times in a month. No one from the provider mentions it during the monthly check in. The office manager starts to notice that invoices keep arriving from addresses that look close but are not exact.

Protections That Should Already Be Active

Good IT keeps these controls running every day without the owner needing to ask.

  • Sender domain checks that stop look alike addresses
  • Attachment sandbox scans that open the PDF in a safe space first
  • Rules that flag any invoice sent outside normal business hours
  • Logging that shows which messages were blocked and why

When these are in place the bookkeeper only sees clean mail. When they are missing the fake invoice reaches the desk and someone in accounting has to decide whether it is real.

Signs Your Current Provider Has a Gap

The office manager starts asking why the same problem keeps happening. The IT company talks about the server but never brings up email filtering logs. The bookkeeper receives another odd invoice and no one from the provider has reviewed the Microsoft 365 quarantine in weeks. The laptop that left with the former employee still has access because no one reviewed sign ins after the departure.

The Work Bellwether Handles

What we do We monitor Microsoft 365 email filters and attachment rules so the fake invoice never reaches the bookkeeper.

We review the logs each week and adjust the rules when a new vendor pattern appears. We also check that former employee accounts are closed so an old laptop cannot be used to test new messages. The owner and the office manager see fewer odd invoices and spend less time sorting real mail from the rest.

If your current IT company is not stopping these before they reach the bookkeeper, it is time to reach out.