SEC-018

Suspicious Sign-In Email

Security / Phishing response / Account safety / Rev 1.0
1 / What happened

The user received a message asking them to sign in, verify an account, or act urgently.

Symptoms
Urgent message / unknown sender / login link
Applies to
Email, chat, or browser sign-in warnings
First rule
Do not click the link or enter credentials
2 / Why it happens

The message may be phishing, a compromised sender, or a real alert that must be checked through a trusted path.

3 / Diagnose

Does it show phishing signs?

  1. Inspect sender.Look for strange domains, misspellings, or an unexpected sender.
  2. Check the request.Password, MFA code, payment, or urgent threat is high risk.
  3. Check link text safely.Use preview or security tools only. Do not open the link.
  4. Ask what the user did.Confirm whether they clicked, entered a password, or approved MFA.
4 / Fix safely

Contain the phishing report

Never ask for passwords, MFA codes, or screenshots containing secrets.
  1. Tell user not to click, reply, or forward casually.
  2. Report via approved phishing process.
  3. Verify account from a trusted sign-in page.
  4. Quarantine or delete only if policy allows.
  5. Verify: no credentials or MFA approvals were given.
5 / Document it

Record user action, advice given, and escalation status.


  
Related cases
Candidate rows for deeper practice.
SEC-019MFA Prompt User Did Not RequestSecurityQueueSEC-021Browser Says Certificate WarningSecurityQueueSEC-022Malware Pop-Up ScareSecurityQueue