Phishing in Slovenia: How to Protect Employees from Scams

Phishing is a form of social engineering where an attacker uses a fake email, SMS, or call to trick a victim into revealing credentials, confirming a transaction, or opening an attachment with malicious code. According to SI-CERT data, phishing is the most common successful attack on companies in Slovenia — which is why comprehensive protection is a necessity, not an option.

TL;DR — Key Points

• Configure SPF, DKIM, and DMARC (initially `p=none`, later `p=quarantine`/`p=reject`)
• Enforce Multi-Factor Authentication (MFA) for all users — ideally using passkeys
• Conduct phishing simulations and micro-training at least quarterly
• Establish an easy reporting point ("Report Phishing" button in Outlook)

What a typical attack on a Slovenian company looks like

An attacker sends an email on behalf of a bank, post office, supplier, or the CEO themselves (so-called CEO fraud). The message creates a sense of urgency ("please transfer today", "your account will be blocked") and directs the victim to a fake login page. Once the user enters their Microsoft 365 credentials, the attacker gains access to email, documents in OneDrive, and often all connected services.

In the last two years, we have noticed that attackers frequently target accounting departments with forged invoices and IBAN change notifications. Damages from a single successful attack on Slovenian SMEs range between 5,000 and 80,000 EUR.

Technical Protection: SPF, DKIM, and DMARC

Three DNS records are the minimum today, without which you risk your domain being abused for spoofing:

We recommend a gradual rollout: start with `p=none` to receive reports, then after resolving false positives, move to `p=quarantine` and finally `p=reject`. Free services exist for report analysis, or we can handle them as part of our cybersecurity services.

MFA and Passkeys

If an attacker obtains a password, MFA is the only wall preventing an account takeover. In Microsoft 365, enable Security Defaults or (better) Conditional Access policies that require MFA for all users and additional conditions based on location and device. For the best protection, we are moving toward passkeys (FIDO2), which completely eliminate the risk of credential phishing.

Filtering Attachments and Links

Microsoft Defender for Office 365 (Plan 1 or 2) adds Safe Attachments (a sandbox for attachments) and Safe Links (real-time URL scanning upon click). For companies without a Defender license, we recommend installing an advanced gateway or third-party solution. Attachment types like `.iso`, `.js`, `.hta`, `.lnk`, and macro-enabled Office documents should be blocked by default.

Training and Simulations

Technology alone is not enough without aware users. We recommend:

1. Short (15-minute) basic training during onboarding and once a year.
2. Quarterly phishing simulations — those who click get a 5-minute micro-course, not a punishment.
3. Internal communication about real attack attempts (without calling out individuals).
4. A simple "Report Phishing" button in Outlook that sends the message to IT and removes it from the inbox.

What to do in case of an incident

If a user has entered credentials on a phishing page:

1. Immediately change the password and invalidate all active sessions (`Revoke Sessions` in Entra ID).
2. Check mailbox rules (attackers often create a rule for automatic forwarding).
3. Check Sign-in logs for unknown locations and devices.
4. If the account compromise was used for fraud, report the incident to SI-CERT and, if necessary, the police.

A brief overview of additional measures

• Separate administrative accounts without email
• Limit password age (60–90 days) only if you do not use MFA — otherwise, forced rotation is counterproductive
• Enable Impersonation Protection for executives and accounting
• Regularly check domain lookalike registrations (e.g., `vitalitsi.com`, `vita1it.si`)

Is Google Workspace more secure than Microsoft 365?

Both platforms offer comparable protection if you correctly configure SPF/DKIM/DMARC, MFA, and appropriate policies. The difference lies in the details (rule sets, Windows integration), not in the overall security level.

How effective are phishing simulations?

In companies where we implement VitalIT services, the rate of successful clicks typically drops from 25–35% to under 5% within one year, provided simulations are accompanied by micro-training.

Is DMARC a risk for email deliverability?

If you move to `p=reject` too quickly, there is a risk that legitimate messages will end up in spam or be rejected. Therefore, always start with `p=none` and analyze the reports.

What are passkeys and are they already useful?

Passkeys are cryptographic keys tied to a device and unlocked with a fingerprint or PIN. Microsoft 365, Google, and all major platforms support them today — we recommend them as the next step after classic MFA.