Voice phishing and a letter that sounds like yours
A letter no longer fails on a crooked logo. Neither does the voice on the phone. The working defense is a second channel, not a training called "do not open attachments".
A phishing letter used to give itself away by the translation, the font and urgency in all caps. Now the text is assembled from your site and your correspondence, and the voice in a messenger sounds familiar. An employee is not "stupid" for answering. They were put in a situation where the usual signs no longer work. Waiting for everyone to become an expert in tone is pointless.
What actually cuts the damage
- A payment and a change of bank details are confirmed on a second channel that was known in advance, not the one that arrived in the letter.
- The director's mail and the hosting are behind a second factor that is not SMS.
- The company has named a person you can tell "someone wrote as you" without punishment for a false alarm.
- The site does not help the impersonator: no stale bank details and no "pay to this card" page without context.
The technical part is still needed. Mail without proper authentication is easier to forge from your domain. An admin panel that opens with one password from a spreadsheet gives away both the site and the mailing list. That is no longer "staff awareness". It is a hole in access.
On these stories Lexora starts with an audit of the site and mail access, not with a lecture. If the letter already went out and someone sent money or handed over access, that is incident response: keep what arrived, and do not smash the traces with a homemade "cleanup". The basic audit is free for new clients.
Related Lexora services
Was there already a letter "from the director"?
We will look at access and mail. If something was already handed over, we will treat it as an incident, not as training.