Hypothetical scenario — illustrative, not a customer story
How it could unfold
- A staff password is guessed or reused from another service.
- The attacker signs in using a legacy protocol that does not prompt for MFA.
- The attacker creates an inbox rule that forwards mail with payment keywords to an outside address and deletes the originals.
- Client payment conversations are read and a fake instruction is sent.
Warning signs visible from outside
- Administrator accounts have no MFA registered.
- Legacy authentication blocked (flagged when it is not).
What PixelPrivate would have shown you
Administrators without MFA
Lists administrator accounts that have not registered MFA.
External forwarding rule (indicator for review)
Shows a rule that forwards outside the organization. We cannot tell who created it or whether it is malicious.
What you would do
- Require MFA for every account, starting with administrators.
- Block legacy authentication.
- Review and remove rules you do not recognise, and restrict external forwarding.
Honest limits
PixelPrivate can show the exposures listed above. It cannot guarantee that an incident would not happen, and it cannot see anything outside its checks. PixelPrivate does not detect intrusions or fraud. This scenario describes no real company, person, quote or statistic.
