Phishing that uses your business identity can target employees, customers or suppliers. Look at the requested action, not just the logo or sender name: demands for credentials, changed payments or urgent secrecy deserve independent verification. A response should secure affected accounts, preserve useful evidence and give customers a trustworthy way to check messages.
01
Collect a focused evidence record
Record the sender address, domain, message time, suspicious link and the action requested. Let your security team handle potentially dangerous attachments and full technical headers. Do not forward an active malicious link to a broad customer list. Identify whether the message is a lookalike, a compromised genuine account or an unconfirmed report.
02
Verify through an established channel
For example, an apparent invoice update may request payment to a different account. Call the supplier using the number already in your records, not the message’s replacement number. If an employee entered credentials, use the official service to secure access and involve the responsible technical team. Report the abuse to the relevant platform or provider using factual evidence.
- Do not share verification codes with a person claiming to be support.
- Keep payment approval separate from the person requesting the change.
- Record which customer groups may actually have received the message.
03
Write a useful customer notice
A good notice identifies the type of false request, explains how customers can verify communications and provides a known support route. Avoid declaring that every suspicious message came from a particular attacker without evidence. Update the notice when the facts change, and review why the impersonation was convincing so future communications are easier to authenticate.
Frequently asked questions
Is a familiar display name enough to trust a message?
No. The visible name can differ from the actual sender or account control. Verify unusual requests through an independently established channel.
Should we ask customers to send passwords for checking?
Never. A legitimate investigation can use message details and account identifiers without collecting passwords or one-time access codes from customers.
Continue with your next step
Related guides on this topic
Sources and policies
Check the current policy before submitting a request.
You do not have to figure out the next step alone.
Share the URLs and explain your concern. We will review the context and explain which options are worth assessing.
Request a confidential reviewOr call (307) 429-2531Educational information, not legal advice. Outcomes depend on the facts and decisions made by third parties.