FAQ and troubleshooting
These are the questions new analysts ask most often. Select a question to see the answer.
Common questions
What if SPF, DKIM, and DMARC all pass? Is the email safe?
Not necessarily. A pass only proves that the sending domain authorized the message. Attackers register their own look-alike domains and set up authentication correctly. Always check which domain passed, and whether it actually belongs to the claimed sender.
The email came from a real coworker or vendor. Can I trust it?
Not automatically. The sender's real account may be compromised, or the attacker may have hijacked an existing email thread. Verify unusual requests through a known phone number, and escalate if you suspect a compromised account.
There is no link or attachment. Can I close it as harmless?
No. Business email compromise and callback phishing often contain only text or a phone number. Judge the request itself: payment changes, gift cards, and urgent transfers are high risk.
How do I know whether it's one of our own phishing simulations?
Ask your team how simulations are identified. Many simulation platforms add a special header or send from known domains. Don't tell the reporter it's a test until you're sure.
Should I reply to the sender to see what happens?
Never. Replying confirms that the mailbox is active and may alert the attacker.
Is it okay to upload the attachment to VirusTotal?
Search by file hash first. Uploading shares the file with the service's community, which can expose company data. Follow your organization's policy.
How long should triage take?
Most reports take 10 to 20 minutes. If you are past 30 minutes and still unsure, mark the email Suspicious, quarantine it, and ask for a second opinion.