Workplace module
Protecting your work account
The account is the real target. Learn what your provider does, and the tricks that beat a password and a code.
How a work account is actually taken: fake Microsoft 365 notices and sign-in pages, device code and consent phishing, MFA fatigue prompts, and a colleague's hijacked mailbox. What to check, and how to recover.
- Fake Microsoft 365 sign-in pages
- Device code phishing
- Consent phishing
- MFA fatigue prompts
- A hijacked colleague mailbox
You will be able to
- Read the real domain behind a provider notice, and know what a genuine one does.
- Recognise the sign-in, code and permission tricks that get past multi-factor authentication.
- Report and recover from a suspect message, including after you have already clicked.
The lessons
01The alert that borrows Microsoft's nameRead the real sending domain behind a provider notice before you act on it.About 10 minutes · 4 activities and a decisionLocked
02The sign-in page that keeps your passwordUnderstand why a perfect copy of a sign-in page beats a strong password and a code.About 10 minutes · 4 activities and a decisionLocked
03The code you were asked to typeRecognise device code phishing, where every page you see genuinely belongs to the provider.About 10 minutes · 4 activities and a decisionLocked
04Permission is not a passwordRecognise a consent request that hands over access without ever asking for your password.About 10 minutes · 4 activities and a decisionLocked
05When it comes from insideApply the same checks when a message comes from a colleague or from your own organisation.About 11 minutes · 4 activities and a decisionLocked
06Check it, report it, recover from itAct confidently after a suspicious message, including when you have already clicked.About 9 minutes · 4 activities and a decisionLocked
Then the assessment
Finish the six lessons by getting each one's final decision right, then answer eight new questions. A score of at least 80% earns a personal completion record. You can retake it, with an explanation for every answer; it is a learning exercise, not a timed exam or an accredited qualification.