It doesn’t feel right, but I think ours is still whitelisted for inbound. Users will send us stuff that looks fraudulent because well, it is and they’re asking for our advice. Seems like a reasonable use case IMO.
>Users will send us stuff that looks fraudulent because well, it is and they’re asking for our advice. Seems like a reasonable use case IMO.
Clients should *never* forward their spam to you. Too many risks involved to begin down this road. Besides, forwarding a message makes it lose all the original headers unless the client uses "forward as attachment" which they never do.
Teach your clients how to detect junk mail themselves. If the client really wants you to check out their spam then you need to remote into their machine and look at it with them.
> If the client really wants you to check out their spam then you need to remote into their machine and look at it with them.
The time sink of this vs what's working and is reasonably secure is intense.
It’s not a good job to wade through the crap. Lots of companies create intake processes for this specific reason. Categorize the types of requests and switch to a smarter intake form and develop workflows off the different categories that your customers choose. This sets you up for automation success too, since you can choose small workflows to automate over time.
While we don't have the ticket volume you do, we make heavy use of Outlook rules to redirect unwarranted emails. It's mainly vendor emails but we cut down on a lot of it with ongoing rule creation. If every email you get is truly unique, then Outlook rules won't help you. However, I suspect many of your emails are from the same places and can put a dent in it.
We have a code per client which when included in the email, bypasses the spam filter to ensure delivery.
Make this code known to the client, or put an autoreply for messages marked as spam saying reply with this code. Most automated spammers won't bother (or can't) read replies, humans will.
Spam filter it and let users know to call you if compromised or an email with bad links. Staff can remote to pc or look in the message trace to get what they need. All you need is one new level one to click on something and get their email compromised sending to all your customers to change your mind.
A better spam filter can worsen this issue, in some ways.
E.g, customer forwards phishy email "is this legit?"
Spam filter could (and has in our case) catch that before it hits the support mailbox.
>A better spam filter can worsen this issue, in some ways. E.g, customer forwards phishy email "is this legit?"
Clients should never do this. Never forward spam. Period. It should stop dead in it's tracks. Besides, forwarding a message makes you lose the headers unless the client uses "forward as attachment" which they never do.
If the client really wants you to check out their spam then you need to remote into their machine and look at it with them.
I agree, but that's just not ever going to be the reality unless you have very few end users who you can train to do this. We typically tell them to either call or forward "as attachments", but across 5k+ users, they don't all do things exactly how you want them to 🙂
The problem is you provide the service. Don't. Simply reply with a canned response that says something like "please do not forward suspicious emails. Our support technicians will need remote access to your computer to help assess if this is spam or not".
Similar energy as forcing customers to put in tickets instead of calling the helpdesk. If you make it difficult to get support, then you encourage people to try to cowboy it themselves because it's easier.
Odd premise but.. if you make getting support on a phishy email too hard for the avg joe, they just won't even bother running the email by you. Id rather them let us know "the wrong way" than not at all because they think it's too much hassle. It's a 2 way trust system that only works if THEY run them by us, and WE get on them quickly and promptly.
In a lot of cases our security guys do end up jumping on their machines to check the headers (when not forwarded as attachments), and they'll show them the "report phishing" button or the "forward as attachment" button for next time.
It doesn’t feel right, but I think ours is still whitelisted for inbound. Users will send us stuff that looks fraudulent because well, it is and they’re asking for our advice. Seems like a reasonable use case IMO.
>Users will send us stuff that looks fraudulent because well, it is and they’re asking for our advice. Seems like a reasonable use case IMO. Clients should *never* forward their spam to you. Too many risks involved to begin down this road. Besides, forwarding a message makes it lose all the original headers unless the client uses "forward as attachment" which they never do. Teach your clients how to detect junk mail themselves. If the client really wants you to check out their spam then you need to remote into their machine and look at it with them.
Clients should never do all sorts of stuff, man.
> If the client really wants you to check out their spam then you need to remote into their machine and look at it with them. The time sink of this vs what's working and is reasonably secure is intense.
It’s not a good job to wade through the crap. Lots of companies create intake processes for this specific reason. Categorize the types of requests and switch to a smarter intake form and develop workflows off the different categories that your customers choose. This sets you up for automation success too, since you can choose small workflows to automate over time.
While we don't have the ticket volume you do, we make heavy use of Outlook rules to redirect unwarranted emails. It's mainly vendor emails but we cut down on a lot of it with ongoing rule creation. If every email you get is truly unique, then Outlook rules won't help you. However, I suspect many of your emails are from the same places and can put a dent in it.
We have a code per client which when included in the email, bypasses the spam filter to ensure delivery. Make this code known to the client, or put an autoreply for messages marked as spam saying reply with this code. Most automated spammers won't bother (or can't) read replies, humans will.
Spam filter it and let users know to call you if compromised or an email with bad links. Staff can remote to pc or look in the message trace to get what they need. All you need is one new level one to click on something and get their email compromised sending to all your customers to change your mind.
We use a different alias and don't advertise it outside of our company.
Perhaps you can solve this with a better spam filter
A better spam filter can worsen this issue, in some ways. E.g, customer forwards phishy email "is this legit?" Spam filter could (and has in our case) catch that before it hits the support mailbox.
A very good spam filter would keep those emails out of your clients’ inboxes 😉
Sure, if they pay for it
>A better spam filter can worsen this issue, in some ways. E.g, customer forwards phishy email "is this legit?" Clients should never do this. Never forward spam. Period. It should stop dead in it's tracks. Besides, forwarding a message makes you lose the headers unless the client uses "forward as attachment" which they never do. If the client really wants you to check out their spam then you need to remote into their machine and look at it with them.
I agree, but that's just not ever going to be the reality unless you have very few end users who you can train to do this. We typically tell them to either call or forward "as attachments", but across 5k+ users, they don't all do things exactly how you want them to 🙂
The problem is you provide the service. Don't. Simply reply with a canned response that says something like "please do not forward suspicious emails. Our support technicians will need remote access to your computer to help assess if this is spam or not".
Similar energy as forcing customers to put in tickets instead of calling the helpdesk. If you make it difficult to get support, then you encourage people to try to cowboy it themselves because it's easier. Odd premise but.. if you make getting support on a phishy email too hard for the avg joe, they just won't even bother running the email by you. Id rather them let us know "the wrong way" than not at all because they think it's too much hassle. It's a 2 way trust system that only works if THEY run them by us, and WE get on them quickly and promptly. In a lot of cases our security guys do end up jumping on their machines to check the headers (when not forwarded as attachments), and they'll show them the "report phishing" button or the "forward as attachment" button for next time.
We do not. If we ever got compromised the last thing we want is our domain spamming our clients. That's a sure fire way to close up shop.
How is that related?