You're safe. No password was captured and nothing was harmed. Simulated test by Mullins IT · for H2O Professional Services

Security awareness · specimen review

You clicked a phishing email. Let's take it apart.

This one was a drill. A real attacker who sent it would now have your Microsoft 365 password. Below is the exact message you clicked, laid out on the table. The marked spots are the tells that gave it away, hover or tap any one to see what a real inbox would never do.

The message you received5 tells marked

[Action Required] Your password expires today3

Microsoft 365 Security Team

<account-security@microsoftonline-secure.com1>

to staff@h2oprofessionalservices.com

Dear User,2

Our records show the password for your account will expire within the next 3 hours3. To keep your email and files active, you must re-verify your account now. Failure to act will result in permanent loss of access.

Keep My Password 4

Thank you,
The Microsoft Account Team

Five things this message did that the real thing never would:

1The domain after the @ is fake

The display name says Microsoft, but the real address is microsoftonline-secure.com, a lookalike anyone can register. Microsoft sends from microsoft.com. Always read the part after the @, never the friendly name.

2"Dear User," not your name

Your real providers know your name and your company. A generic greeting on a message that claims to be about your account is a mass-send tell.

3A countdown to rush you

"Expires today," "within 3 hours," "permanent loss of access." Manufactured urgency exists to make you act before you think. Real password notices don't threaten you.

4The button hides its real address

The link text says the right thing; the destination doesn't. Hover it (shown here) and it points to microsoftonline-secure.com, not Microsoft. On a phone, press and hold to preview.

5Sloppy, coercive footer

"Corperation" is misspelled, and "you cannot unsubscribe" is a pressure line no real company writes. Small errors like these leak through phishing kits constantly.

What to do when a message pushes you to log in

Five habits that stop a real one cold.

RULE 01Reach the site yourselfType the address or use a bookmark. Never log in from a link an email handed you.

RULE 02Read the domain, not the nameThe friendly name is free to fake. The part after the @ is the truth.

RULE 03Hover before you clickYour browser shows the real destination in the corner. On mobile, press and hold.

RULE 04Turn on multi-factorWith MFA, a stolen password alone can't get anyone in.

RULE 05When unsure, just askA ten-second message to IT beats a compromised account every time.

Think a real one slipped through?

Don't click anything. Forward it to IT at it@h2oprofessionalservices.com and delete it. Reporting one email can protect everyone.