Users are reporting legitimate quarantine notification emails as phishing. Can we make the alerts easier to recognize without teaching people to trust a convincing-looking fake?
How can we make Microsoft 365 quarantine alerts less confusing?
Asked by
!check+the~shoebox
Answers
Change the notification sender to an internal helpdesk address and consider excluding the legitimate alerts from external-message tagging. That may make them less surprising, though it won't stop every false report.
Keep the distinction clear: a familiar sender address or the absence of an external tag isn't proof that a message is safe.
Reply to this answer
I wouldn't make a logo, banner, or display name the test for whether an alert is legitimate. Those are easy things for an attacker to imitate.
Give users a bookmarked route to the Microsoft 365 quarantine portal and tell them to check there rather than follow links in the email. A few false reports are preferable to discouraging people from reporting a message they're unsure about.
Nella:
That also gives the helpdesk a simple response to an uncertain report: check quarantine through the bookmark, not the message.
Reply to this answer
Tell people what the notification is before they start receiving it. Send a simple example and explain what quarantine means, how to open it safely, and where to ask for help. Phishing simulations can reinforce the process, but don't expect an announcement to eliminate every mistaken report.
Reply to this answer
A notice on the alert saying it comes from a trusted source might make it look clearer, but that wording can be copied into a fake too. If you add one, treat it as an explanation of the process, not a security indicator users should rely on.
Reply to this answer
Add your answer
Answers are reviewed before publication.
oddly+unfolded_3:
Any exception to external tagging needs to identify the legitimate notifications reliably. A rule based only on a visible sender address could be misleading.