Solution · MailGuard

Fake IT support:first the email flood,then the chat.

Attackers flood a mailbox with sign-up emails and then offer help through Teams. Conbool MailGuard connects the two and warns the person affected early.

Request a demoMailGuard in detail

Why the scam works

It exploits stress and willingness to accept help, not a security gap.

The flood distracts

Masses of sign-up confirmations fill the mailbox. Important messages get lost and stress rises.

Help arrives on cue

Shortly afterwards, alleged IT staff get in touch through Teams and offer to solve the problem.

Then comes remote access

Anyone who agrees hands over remote access, credentials or both. From then on the attacker is in the account.

Viewed separately, nobody sees it

The mail filter sees sign-up confirmations, Teams sees a chat. Only together do they become an attack.

How an attack unfoldsSchematic

Incoming emails for one person, schematic

  1. Email floodThe mailbox fills up.Person warned, finding for your IT team
  2. Contact“This is IT, I can help you.”Suspected fake IT support
  3. Remote accessNext comes the remote access link.Remote access tool from an outsider
The attack step by step

Warned before the help arrives.

The warning goes to the person affected as soon as the flood stands out. Not only once the scammer writes.

Warning directly in Teams, without the app by email

Finding rated high for your IT team

Requests for remote access and credentials stand out

One alert per person and day instead of a series

MailGuard sees both sides

Detect, warn, connect.

1. Detect the flood

MailGuard sees the emails in the mail flow and detects when a person suddenly receives unusually many from many domains.

2. Warn the person early

The person learns that fake IT support may get in touch next. Your IT team receives a finding.

3. Assess the contact

If someone conspicuous then writes from outside in Teams, it counts as dangerous. Your IT team sees the connection.

What protection brings together

The difference lies in connecting email and Teams.

Email and Teams connected

A detected email flood feeds into the assessment of conspicuous contacts from outside.

Warning to the person

With clear instructions: allow no remote access, give out no credentials, open no links. The warnings are currently in German.

Name and organization

Job titles in the name and conspicuous names of other organizations stand out.

Requests in chat

If someone from outside stands out with requests for remote access or credentials, a finding is created.

Remote access links

Links to remote access tools from outsiders are detected.

All in one place

Findings appear under Incidents on the Teams tab, with a notice in the bell and an email to your alert recipients.

Email and Teams together or separately

The scam only stands out once both sides come together.

 
Conbool MailGuard
Email and Teams viewed separately
Email flood
Detected and reported as a finding
Individual emails, often inconspicuous
Person affected
Warned early, if switched on
Learns nothing
Contact from outside afterwards
Counts as dangerous if it stands out
A chat like any other
Connection
Finding mentions the earlier flood
Has to be made manually
Link to remote access
Detected in chat
Depends on settings and tools
Place for your IT team
One tab under Incidents
Two separate interfaces

As of November 2026. The right column describes the usual approach without connected checks, not any single vendor.

FAQ on fake IT support

What is fake IT support?
A scam: first come masses of sign-up emails, then alleged IT staff offer help through Teams or by phone and ask for remote access or credentials.
What has to be set up?
MailGuard in the mail flow and Teams protection. Only emails passing through MailGuard count towards the flood.
Is the person always warned?
If “Warn those affected” is on. With the Teams app the warning arrives directly in Teams, otherwise by email. The warnings are currently in German.
When does it count as an email flood?
We do not publish the exact thresholds, so attackers cannot stay just below them. A flood triggers one alert per person and day.
Does MailGuard detect every case?
No, no detection is complete. Train your employees as well: real IT support does not contact people unprompted from outside.
Does Conbool read chats and emails for this?
The check reads Teams messages after your consent. Findings are stored, message text is not.
Can MailGuard lock out the scammer?
The sender can be removed from a group chat. You block other organizations in Teams under “External access”.
Does this run on your own server?
No, Teams protection is available in the cloud only.

Related solutions

Phishing in Teams

Links, QR-Codes und falsche Absender im Chat erkennen, Betroffene warnen.

Conbool Mail

Das Postfach dazu: Grundschutz in jedem Plan, betrieben in Deutschland.

Hornetsecurity-Alternative

Deutsche MailGuard-Alternative nach der Proofpoint-Übernahme.

Barracuda-Alternative

Module je Postfach statt Planstufen, deutscher Vertragspartner.

Phishing-Schutz

BEC, Spear-Phishing und QR-Code-Phishing erkennen und entfernen.

Phishing-Simulation

Was durch den Filter kommt, mit dem Team üben statt hoffen.

Ransomware-Schutz E-Mail

Mehrstufige Anhang-Filter und URL-Reputation gegen Ransomware-Kampagnen.

Spam-Filter Unternehmen

Spam und unerwünschte Massenmail mit DACH-Heuristiken filtern.

CEO-Fraud-Schutz

BEC und CEO-Fraud-Attacken über Authentifizierungs-Layer abwehren.

DANE und TLSA

Manipulationssichere Transportverschlüsselung nach BSI TR-03108, gegen Downgrade und MITM.

Directory-Harvesting-Schutz

Abwehr von Adress-Sammlern, bevor gültige Postfächer in Spam-Datenbanken landen.

Spot the scam before anyone agrees.

View email and Teams together.

Request a demoMailGuard in detail