Tech N TonerSimplifying IT. Amplifying Success.

Security Guidance

Pause, verify and report.

Simple actions can prevent a suspicious email, unexpected prompt or unusual device behavior from becoming a larger security incident.

01Recognize Threats02Email & Payments03Account & Device04Files & Remote Work

Recognize threats

Trust the request only after verification.

Modern scams may use accurate names, branding, writing style and copied email threads. A professional appearance is not proof that a request is legitimate.

PHISHRecognize a phishing message
  • Unexpected urgency, secrecy, threats or pressure to bypass the normal process.
  • A sender address or Reply-To domain that differs from the displayed name.
  • Links whose destination does not match the visible text or expected service.
  • Unexpected attachments, QR codes, shared-file notices or document-signing requests.
  • Requests for passwords, verification codes, MFA approvals, gift cards, payment or bank changes.

Attackers increasingly use polished, personalized messages. Treat an unusual request as suspicious even when spelling and branding look perfect.

CISA Secure Our World guidance ↗
LINKInspect a link without opening it
  1. On a computer, hover over the link without clicking and read the destination shown by the browser or Outlook.
  2. On a phone, press and hold the link to preview it—do not open it.
  3. Read the domain from right to left and look for misspellings, added words or an unexpected country domain.
  4. If the message claims to be from Microsoft, a bank or a vendor, open your normal bookmark or type the known address yourself.

Do not paste a confidential link into a public link-checking website. Send the original message to TnT through the approved reporting process.

QRTreat QR codes like links
  • Do not scan an unexpected QR code in an email, invoice, delivery notice or sign-in page.
  • A QR code can hide the destination and move the attack to a phone outside normal email protections.
  • If scanning is genuinely required, verify the request through a known contact and examine the destination before continuing.
  • Never use a QR code to “revalidate” MFA or prevent an account from expiring unless TnT confirmed the procedure.
CALLRecognize social engineering by phone or text
  • Unexpected claims that your account, computer or payment is in immediate danger.
  • A caller asking you to install software, visit a website, share a screen or read a security code.
  • A text from an executive or coworker using a new number and requesting secrecy or urgent action.
  • Caller ID is not proof of identity; it can be spoofed.

End the interaction and call the person or TnT through a number you already know—not a number supplied in the suspicious message.

Email & financial requests

Verify outside the message thread.

Business email compromise uses impersonation or a compromised mailbox to redirect payments, obtain sensitive information or convince staff to change normal procedures.

REPORTReport phishing in Outlook
  1. Select the suspicious message without clicking its links or attachments.
  2. Choose Report → Phishing. On mobile, use the message menu and select Report Junk → Phishing.
  3. If your organization uses an additional reporting button, follow that process as well.
  4. For urgent or targeted messages, submit a TnT ticket and identify the sender, subject and time received.

Do not forward the message normally. Forwarding can remove useful security information and may expose another person to the malicious content.

Microsoft reporting instructions ↗
BECVerify payment and bank-change requests
  1. Stop before processing any unexpected invoice, wire, ACH, payroll or banking change.
  2. Call the requester or vendor using a previously verified telephone number.
  3. Require the organization’s normal secondary approval—even when the message appears to come from an owner or executive.
  4. Check the complete sender and Reply-To addresses, not only the display name.
  5. Report mismatches, urgency, secrecy or a changed payment destination to TnT.

Never verify a payment change by replying to the same email thread. The mailbox or thread may already be controlled by an attacker.

Microsoft BEC overview ↗
SHAREEvaluate an unexpected shared-file notice
  • Confirm that you expected the file and recognize the sender.
  • Open OneDrive, SharePoint, Dropbox, Adobe Sign or DocuSign from your normal bookmark instead of the email link.
  • Be suspicious if the page asks for credentials after you are already signed in or requests an unrelated email provider.
  • Do not enable macros, editing or content in an unexpected Office document.
REPLYIf a trusted contact sends something suspicious
  1. Do not assume the contact intentionally sent it; their mailbox may be compromised.
  2. Contact them using a separate known channel.
  3. Report the original message as phishing.
  4. Tell TnT if the message reached multiple employees or appears to come from inside your organization.

Account & device response

What to do after an interaction.

Fast, accurate reporting matters more than embarrassment. Tell TnT what happened so the correct containment steps can begin immediately.

CLICKYou clicked a suspicious link
  1. Stop interacting with the page and close the browser tab.
  2. Do not download, open or run anything offered by the page.
  3. Contact TnT and provide the message, approximate time and what the page displayed.
  4. If you entered credentials or approved MFA, say so explicitly—those facts change the response.

A click does not always mean the device is compromised, but concealing it delays the investigation.

CREDYou entered a password or security code
  1. From a known safe device, contact TnT immediately.
  2. Change the affected password if TnT directs you to do so.
  3. Deny unexpected MFA requests and do not provide codes to anyone.
  4. TnT can revoke sessions, review sign-ins and check mailbox rules or forwarding.
  5. If that password was reused anywhere else, replace every reused instance with a unique password.
MFAYou received an unexpected MFA prompt
  1. Select Deny or No, it’s not me.
  2. Do not approve it to make repeated prompts stop.
  3. Contact TnT immediately; repeated prompts may indicate that the password is already known.
  4. Record the approximate time, application, number and displayed location if available.
MALA file was opened or software was installed
  1. Stop using the device.
  2. If ransomware, encryption, rapid file changes or an active attack is visible, disconnect the network cable or turn off Wi-Fi—but leave the device powered on unless TnT instructs otherwise.
  3. Call TnT from another device and describe what was opened or installed.
  4. Do not run random cleanup tools, delete evidence or reconnect the device.

For a suspected active incident, call TnT at (909) 758-5400. Do not rely only on email from the affected account.

LOSTA work device is lost or stolen
  1. Call TnT and your manager immediately.
  2. Provide the device type, assigned user, last known location and approximate time.
  3. Do not attempt an in-person recovery that could place anyone at risk.
  4. TnT can review sessions and initiate device-protection actions when supported.
  5. Report the theft to law enforcement when required by company policy.

Files, devices & remote work

Keep business information in approved systems.

Security protections are strongest when company data remains on managed devices and in organization-approved Microsoft 365 locations.

DATAShare sensitive files safely
  • Store work files in the approved OneDrive or SharePoint location—not personal email, personal cloud storage or USB media.
  • Use Specific people sharing when available and grant the minimum required access.
  • Confirm the recipient and whether editing is necessary before sending.
  • Never upload confidential client, financial, legal or personnel information to an unapproved AI or file-sharing service.
USBHandle USB devices and removable media
  • Do not connect an unknown, found or promotional USB device.
  • Use only company-approved encrypted media when removable storage is necessary.
  • Do not copy business data to a personal drive.
  • If an unknown device was connected, leave it disconnected and notify TnT.
REMOTEWork securely away from the office
  • Use the company-managed computer, approved VPN or secure-access method and Microsoft 365 apps.
  • Avoid public or shared computers. Do not let a browser save work credentials on another person’s device.
  • Use a trusted hotspot when possible and lock the screen whenever you step away.
  • Protect screens and conversations from people nearby.
  • Do not bypass a location, device-compliance or MFA restriction; contact TnT.
UPDRespond to update and security warnings
  1. Install updates through Windows Update, Microsoft Company Portal or the application’s normal update function.
  2. Do not install a “required update” offered by an unexpected website or pop-up.
  3. If Microsoft Defender, SmartScreen or the browser blocks a file or page, do not bypass the warning.
  4. Capture the warning details and contact TnT if the blocked item is needed for work.

Security concern right now?

Stop interacting with the suspicious content. Submit a ticket, or call TnT immediately for an active compromise or widespread incident.

Open Support & Resources