Why “I Know the Sender” Doesn’t Mean an Email Is Safe

Short answer: No—an email is not safe just because it comes from someone you know. Strong email security for businesses starts with accepting that a message can arrive from a real, trusted contact’s actual account and still be an attack. When criminals steal a legitimate login, every message they send passes every “do I recognize this person?” test your team relies on.

Here’s how that plays out in the real world.

A Real Attack: The Bid Invitation That Wasn’t

Recently, our team responded to an incident that shows exactly why sender trust fails.

A professional-services firm received an email inviting them to bid on a project—a polished “RFP opportunity” with a submission deadline, confidentiality language, and a link to a project portal. It looked completely routine. The sender wasn’t spoofed or faked. It came from the real, correct email address of a genuine business contact at a company they knew.

The problem: that contact’s mailbox had been hijacked. An attacker had stolen the account’s password and defeated its multi-factor authentication, then used the real mailbox to blast a phishing message to everyone in reach. The “portal” link quietly routed through an outside redirect to a fraudulent site built to harvest credentials. Before the account was locked down, 4,007 phishing messages had gone out to 1,285 unique recipients.

Every one of those recipients saw a sender they recognized. That recognition is precisely what the attacker was counting on.

Why Sender Recognition Is No Longer Proof

For years, security advice boiled down to “don’t open emails from people you don’t know.” Attackers adapted. Today the most effective attacks come from people you know—because their accounts have been taken over.

The federal Cybersecurity and Infrastructure Security Agency notes that phishing messages are deliberately designed to look like they come from a trusted person or organization, and that AI now lets attackers write clean, error-free messages with none of the old giveaways (CISA: Recognize and Report Phishing). When the account itself is genuine, the classic tells disappear:

• The sender address is correct—because it’s the real account
• There’s no misspelled domain to catch
• The grammar is clean and the tone may match past emails
• Multi-factor authentication was already defeated, so “they have MFA” wasn’t protection

In other words, the checks most employees are taught to run all pass. Recognition is not verification.

What Actually Protects a Business

If “knowing the sender” can’t be trusted, email security for businesses has to rest on habits and systems instead of gut feeling.

• Verify unexpected requests through a second channel. A surprise bid invitation, invoice, payment change, or login link deserves a phone call to a known number—never a reply to the email or a number the email provides.
• Treat links, not just senders, as the risk. Hover to preview a destination, and be wary of any link that redirects or asks you to log in.
• Deploy advanced email filtering that inspects links and attachments in real time, beyond the basic spam filter.
• Use phishing-resistant MFA and monitor for account takeover, since attackers clearly get past text-code MFA. Unusual sign-ins and new inbox or forwarding rules are warning signs.
• Have an incident response plan ready, so a compromised account is contained in minutes, not hours.

That last point is where preparation pays off.

Speed Is the Whole Game

In the incident above, the difference between a scare and a catastrophe was response time.

From the first fraudulent email to full containment—password reset, active sessions revoked, MFA re-registered—was 10 minutes. Within roughly an hour, every reachable recipient (1,212 of them, after removing bounces and duplicates) had received a security notification warning them not to click the link and telling anyone who already had what to do next. That notice was sent from our own domain (slingshotis.com) so recipients could verify it came from a legitimate IT provider, and it was delivered in batches to avoid reputation-based blocks in the wake of the incident.

A compromised mailbox is going to happen to someone in your orbit—a vendor, a client, a partner. What determines the damage is whether it’s caught in minutes or discovered days later.

Frequently Asked Questions

Can an email be dangerous if it’s from someone I actually know?
Yes. If that person’s account has been compromised, the attacker sends from their real address. The message will pass every sender-recognition check, which is exactly why it’s effective.

How can I tell if a known sender’s account was hacked?
Watch for unexpected requests (bids, invoices, payment changes, login links), unusual urgency or confidentiality demands, links that redirect to a login page, and messages that don’t quite match how that person normally writes. When in doubt, confirm by phone using a number you already have.

What should I do if I clicked a link in one of these emails?
Assume your credentials may be exposed. Change your password immediately, alert your IT team, and enable or re-verify multi-factor authentication. If you entered payment details, contact your bank.

Does multi-factor authentication stop these attacks?
It helps but isn’t foolproof—attackers defeated MFA in the case above. Phishing-resistant MFA and active account-takeover monitoring provide stronger protection.

The Bottom Line

The old rule—trust the email if you trust the sender—is broken. Real email security for businesses means verifying requests, scrutinizing links, hardening accounts against takeover, and being able to respond in minutes when something slips through.

Based on Boston’s North Shore, Slingshot provides security-focused IT support for businesses across the North Shore and Cape Ann—so a hijacked-account attack gets caught in minutes, not days.

Would your business catch a hijacked-account attack in 10 minutes, or 10 days?

Find out where you stand. Take our free IT Risk Scorecard to self-assess your email security and spot the gaps before an attacker finds them first.