Microsoft 365 email takeover protection · Northeast Ohio
Two-factor is on. Your email can still be taken over.
A fake sign-in page can pass your password and code straight through to Microsoft and keep the signed-in session. If nobody is watching your Microsoft 365, a hijacked mailbox can sit unnoticed until someone approves a payment to the wrong bank account.
- Stops the fake sign-in pages that get past texted and app sign-in codes.
- Alerts on strange sign-ins and new inbox rules, and we check them.
- A hijacked account is shut down and cleaned up, not just reported.
- Works with the Microsoft 365 you already have. Nobody changes email address.
The offer
Microsoft 365 Takeover Protection
Monthly, per personquoted in writing after a look at your tenant
What you get
- Passkeys or security keys for the people who approve payments
- Alerts on strange sign-ins and new inbox rules, and we act on them
- A hijacked account shut down and cleaned up, not just reported
- A written payment-change process for whoever pays the bills
- A plain report each month: what was flagged and what was done
Works with the Microsoft 365 you already have. No long contract.
Optional · tap oneStep 1 · tap one
Which sounds most like you?
Think something is already wrong? Call now and you get Noah, not a queue. (330) 305-2750
The offer
Microsoft 365 Takeover Protection
Monthly, per personquoted in writing after a look at your tenant
What you get
- Passkeys or security keys for the people who approve payments
- Alerts on strange sign-ins and new inbox rules, and we act on them
- A hijacked account shut down and cleaned up, not just reported
- A written payment-change process for whoever pays the bills
- A plain report each month: what was flagged and what was done
Works with the Microsoft 365 you already have. No long contract.
30-second self-check
Would you notice a hijacked mailbox?
Five quick taps. It runs on this page and sends nothing unless you add it to your request.
Your result
0 / 5 covered
Tap an answer on each question. Nothing is sent until you press the button at the end.
What you walk away with
What the first look at your tenant finds.
Before any price, we look at how people sign in and what is already happening. Tap any row.
Microsoft 365 tenant findings
Example: Brookside Title & Escrow, 14 people (made up for this page)
Fix nowInbox rulesThe bookkeeper's mailbox moves anything mentioning "payment" to RSS Feeds
What it means
Nobody set this up on purpose. It is how a hijacker hides a vendor's replies.
The fix
Rule removed, sessions ended, password and sign-in methods reset, 30 days of sign-ins reviewed. You'd hear this one the same day.
Fix nowPayment approvers' sign-inThe owner and the bookkeeper use texted codes
What it means
A fake sign-in page can pass a texted code to Microsoft and keep the session.
The fix
Passkeys on their phones and laptops, with texted codes removed as a fallback.
Fix soonSign-in alertsMicrosoft's default alerts go to an admin mailbox nobody opens
What it means
The warnings exist. Nobody sees them.
The fix
Alerts routed to us and checked, with what was done written into the monthly report.
Fix soonAdmin accounts4 global admins, one of them a former contractor
What it means
Every admin account is a key to the whole tenant.
The fix
Two admins, both on passkeys. The contractor's account removed.
Fix soonDevice sign-in rulesAny device, anywhere, can sign in
What it means
A stolen session works from the attacker's laptop as well as yours.
The fix
Company-device-only sign-in for finance. That needs Business Premium on three licences, and we say so before you buy.
OKTwo-factor coverageAll 14 people enrolled
What it means
Good base to build on.
The fix
Keep it. Passkeys for the payment approvers come next.
Tap a row to open it. Sample only: the company and findings are made up.
The scope, in writing
What you get, and what you don't.
Protection is two parts: make the fake sign-in useless, and watch the tenant so anything that still gets in is caught before money moves.
Included
- A review of how everyone signs in today, and which accounts a fake sign-in page could take over
- Passkeys or security keys for the people who approve payments, and for every admin account
- Sign-in rules in Microsoft 365, including company-device-only sign-in where your licences support it
- Alerts on sign-ins from unfamiliar places or devices, new inbox and forwarding rules, and changed sign-in methods
- We check those alerts and act on them: end sessions, reset the account, remove hidden rules
- A short written payment-change process for whoever pays the bills, and a walk-through with them
- A plain report each month: what was flagged, what was done about it
Not included
- Reading your email. We look at sign-ins, rules and settings, never message content.
- A guarantee that no one is ever fooled. The aim is that a stolen session is useless or caught early, before a payment goes out.
- Getting money back after a payment has been sent. If that happens, call your bank first, then us, and report it to the FBI at ic3.gov.
- Microsoft's licence fees. Some protections need Microsoft 365 Business Premium, and we tell you which before you change anything.
How it happens
From one sign-in to a $40,000 payment.
This is called an adversary-in-the-middle attack. Every step below can happen with two-factor turned on.
1 · The link
An email that looks routine
A shared document, a voicemail, an invoice from a vendor you use. The link opens a Microsoft sign-in page that looks exactly right, because it is showing the real Microsoft page through the attacker's server.
2 · The sign-in
Password, then the code on the phone
Your bookkeeper types the password and approves the sign-in code. Microsoft sees a normal, successful sign-in. The fake page passes it all through and keeps a copy of the signed-in session.
3 · The session
They are in, and the code is already used
With that session the attacker opens the mailbox from their own computer. They never need the password or a new code, which is why two-factor did not stop it.
4 · The quiet part
An inbox rule, then waiting
A rule moves anything mentioning invoices or payments into a folder nobody opens. Then they read along for days or weeks, learning who pays whom, when, and how much.
5 · The payment
A real thread, new bank details
They reply inside a genuine email thread with a vendor or customer: new bank account, please use it for this invoice. Accounts payable sends $40,000 to the scammer's bank, and nothing looks wrong until the real vendor asks where their money is.
What stops it
Three things, together.
Any one of these helps. All three together mean a stolen session is either useless or caught before money moves.
Sign-ins that cannot be relayed
Passkeys and security keys only work on the real Microsoft site, so a fake page has nothing to pass along. On Microsoft 365 Business Premium we can also limit sign-ins to computers and phones your company owns, so a stolen session opened somewhere else is refused.
Someone watching the tenant
Alerts for sign-ins from unfamiliar places or devices, new inbox and forwarding rules, and changes to anyone's sign-in methods, and we check them. When something is wrong we end the sessions, reset the account and remove the rules that hide mail.
A payment-change rule that people follow
Any request to change bank details gets confirmed by a phone call to a number you already had on file, never one from the email. It costs nothing and it is the step that keeps the money in your account if everything else fails.
After you hit send
What happens next, step by step.
Step 1
You send the form or call
How many people, which Microsoft 365 plan, and who handles payments. I reply within one business day.
Step 2
A look at your tenant
How people sign in, what alerts exist today, and any inbox rules or sign-ins that already look wrong. Anything urgent you hear about right away.
Step 3
A written plan and price
What we would change, what it needs from your licences, and a monthly price in writing. Nothing changes until you approve it.
Step 4
Set up, then watched
Stronger sign-ins for the people who matter most first, then monitoring switched on and checked from then on.
Before you send it
The questions people actually ask.
We already have two-factor. Isn't that enough?
It stops someone who only has your password, and you should keep it. It does not stop a fake sign-in page that passes your code to Microsoft in real time and keeps the signed-in session. Passkeys and security keys do stop that, because they refuse to work on any site that is not really Microsoft.
Wouldn't we notice if someone was in our email?
Usually not. The attacker sets a rule that hides replies and payment emails, sends nothing from your account until the moment it matters, and reads quietly in the meantime. The first sign is often a vendor asking why they have not been paid.
We're a small company. Would anyone bother?
Small companies are the easy ones: one person approves payments and nobody double-checks. Business email compromise, an invoice quietly redirected by somebody reading your mail, is tracked by the FBI's Internet Crime Complaint Center as its own category because of how much money moves through it.
Do we need to change to a different email system?
No. This is set up inside the Microsoft 365 you already have. Some parts, like company-device-only sign-in, need Business Premium licences, and we tell you which before you buy anything.
Will this get in the way of my team?
A passkey is usually faster than typing a code: a fingerprint or face on the phone or laptop. The first setup takes a few minutes per person and we do it with them.
What does it cost?
A monthly price per person, written down after we have looked at your tenant, with no long contract. It is also part of our managed IT plans if you want everything looked after.
Reading, if you are not ready to talk yet
Find out if your Microsoft 365 is being watched.
Tell me how many people you have and who pays the bills. You get a written plan for stopping email takeover, and nothing changes until you say go.