Phishing Protection for Perth Businesses

Why phishing hits Perth businesses harder than the headlines suggest

Most phishing attacks aimed at a Perth business with 5 to 50 staff are not the clumsy "Nigerian prince" emails people still picture. They are quiet, well-researched, and timed. An attacker watches your LinkedIn, learns your accounts person's name, sees that your directors travel east for client work, and waits. Then a message lands that looks exactly like your supplier asking you to update their bank details before the next BAS cycle, or your "director" asking the office manager to approve a payment while they are "in a meeting in Sydney."

The WA factor that makes this worse is the two to three hour time difference with the eastern states. A Perth office often runs the first part of its day before head offices, banks, and suppliers in Sydney or Melbourne are fully awake to verify anything. Attackers know this. A 7:30am AWST request to "sort this before close of business east coast" creates urgency that is hard to second-guess when you cannot pick up the phone and confirm. Add the trades, construction, mining-services, and professional firms that dominate the Perth SME landscape, where invoices move fast and approvals are informal, and you have a market built for invoice fraud and payment redirection.

What actually goes wrong, and how it unfolds

The damage rarely starts with malware. It starts with one set of stolen credentials. A staff member clicks a link in an email that looks like a Microsoft 365 sign-in page, types their password, and approves the multi-factor prompt because they assumed it was real. The attacker is now inside that mailbox. From there, the pattern is consistent and we see it again and again:

• They sit silently in the mailbox for days or weeks, reading email and learning how your business talks, who approves what, and which suppliers you pay.
• They create hidden inbox rules that auto-delete or file away any reply that might tip you off, so the real conversation never reaches the victim.
• They wait for a genuine invoice to come through, then intercept the thread and send a follow-up with new bank details that match the supplier's tone perfectly.
• They use the compromised account to phish your clients and suppliers, spreading the problem outward under your name and your domain.

For a Perth business of this size, the cost is rarely just the redirected payment. It is the week your office manager loses untangling which emails were real. It is the awkward call to a long-term client explaining that the invoice they paid went to a criminal. It is the supplier who now wants payment again because the money never reached them. And it is the slow erosion of trust when people learn an email from your business cannot be taken at face value. The financial hit is recoverable. The reputation conversation is the part owners dread most.

How COREWEST shuts the door, Microsoft-first

If your business runs on Microsoft 365, most of the protection you need is already in the platform. The problem is that it ships switched off or set to defaults that assume someone is watching. We turn it on properly and tune it for how your team actually works.

• Defender for Office 365 inspects every link and attachment at the moment a person clicks, not just when the email arrives, so a link that was clean on delivery and weaponised an hour later is still caught. It also detects impersonation, the lookalike sender and display-name tricks behind director and supplier fraud.
• Entra ID with Conditional Access decides who can sign in, from where, and on what device. A sign-in attempt from an unusual location or an unmanaged device gets blocked or challenged before it becomes a foothold, which is what stops a stolen password from turning into a stolen mailbox.
• Microsoft Defender on the laptops and devices catches the next stage if anything does slip through, isolating a device before it can spread across the network.
• Intune enforces that only known, healthy, encrypted devices can reach company email and files, so a personal phone with no passcode cannot quietly sync your inbox.
• Microsoft Purview gives us the audit trail to see exactly what an attacker touched, and Microsoft 365 Backup means a mailbox or SharePoint site can be restored cleanly rather than negotiated over.

We also kill the specific tactics: blocking and alerting on suspicious inbox-forwarding rules, hardening against the MFA-fatigue prompts attackers spam, and verifying your domain's SPF, DKIM and DMARC so criminals cannot send mail that looks like it came from you.

What you get, and what "good" looks like

Protection is not a one-off switch, because the attacks change weekly. Week to week, we watch the sign-in and threat signals coming out of Defender and Entra ID, investigate the flagged sign-ins and quarantined messages that matter, and quietly tune the rules so your team is protected without being buried in false alarms. When something genuinely suspicious happens, your people have one calm number to call rather than a guess about whether that email is safe.

"Good" is measurable and plain to see. Impersonation and lookalike emails are caught before they reach an inbox. A stolen password on its own no longer gets anyone in. Hidden forwarding rules are flagged the moment they appear. Your staff know how to report a suspicious message in one click, and that report goes somewhere a human reviews. And if the worst happens, you can prove what was and was not touched, and restore it. Most owners tell us the real win is quieter than that: the office manager stops hesitating over every payment email, because the system, not their gut, is now the thing standing between you and a redirected invoice.

If you want to know how exposed your Microsoft 365 is to phishing right now, the fastest way to find out is a Free Cyber Risk Snapshot. Thirty minutes, owner to owner, and you will know exactly where the gaps are. Book it at https://calendly.com/corewest/30min.