Turn on and tune the fraud shield
Set sensitivity, protect executive names, notify administrators and review allowed and blocked senders.
The fraud shield checks every new message against who your workspace normally deals with: look-alike domains, people pretending to be colleagues, replies that go elsewhere, failed authentication and changed bank details. Suspicious messages get a warning banner in Mail. It never deletes, moves or blocks mail on its own.
If the tab says it is not switched on for this workspace, ask your provider.
Configure it
In Admin, open Fraud shield.
- Shield statistics show Flagged, Danger, Reported as fraud and Payment checks waiting.
- Sensitivity: Low (only clear cases), Normal or High (flag anything unusual). Normal suits most teams. It saves as soon as you pick it and applies to mail that arrives afterwards.
- Notify administrators about dangerous messages: administrators also get a notification when any mailbox receives a message rated danger. They see the sender, subject and reasons, not the message.
- Extra names to protect: one name per line, such as your CEO or finance lead. Mail from an unfamiliar address using one of these names is flagged. Administrators are protected automatically. Choose Save names.
- Allowed and blocked senders: built from people's decisions. Removing an entry with the bin icon puts that sender back to normal checks.
It learns who you normally work with, so it gets more accurate over the first couple of weeks.
What it looks for
Reasons shown on a flagged message include look-alike domains, mixed alphabets in a domain, someone pretending to be an executive or colleague, a replies-go-elsewhere address, failed authentication, a new sender asking about money, gift cards, changed payment details, risky attachments and reported senders.
How people use it
People open Shield to see flagged messages and choose This is fine or Report as fraud. A bank-detail change creates a payment check that needs two different people to confirm out of band. The course PGB 301 covers this in detail.
Tips
- Add the names of anyone a fraudster would pretend to be.
- Ask finance to use the payment checks for every supplier change.
More guides in Workspace administration
A tour of Admin for workspace administrators
What each Admin tab does, how usage and limits are shown on Overview, and where to start with a new workspace.
Create and manage users and mailboxes
Create mailboxes, add aliases and shared mailboxes, reset passwords, pause sending, suspend or delete, and understand what counts toward your plan.
Plan, billing, storage and add-ons
Read your limits, change plan, pay a term from the wallet, add storage or add-ons, and ask for a higher limit.
Set the workspace security policy
Require two-factor, control public links and outside sharing, allow self-service password reset, and review who has set up protection.
Set up single sign-on with your identity provider
Connect OpenID Connect or SAML, test it, turn it on, require it, and keep break-glass administrators.
Export workspace data
Download a full copy of mail, files, documents and more as ZIP parts, and what to do with it.