Protection against phishing and account abuse
Training and email controls that make phishing harder to land, and sign-in and OTP controls that make your login and verification flows expensive to abuse.
Abuse goes for the cheapest way in
An attacker doesn’t need a flaw in your code if someone can be tricked into handing over a password, or if your own sign-up and OTP flows can be used against you.
OTP codes sent by SMS cost money on every message, so a flood of fake requests becomes a bill as well as a security problem.
Signs this is you
- Emails pretending to come from your domain, or your own email landing in spam
- Unexpected spikes in OTP or SMS costs
- Customers reporting sign-ins they didn’t make
- Staff unsure how to report a suspicious email
From the inbox to the sign-in screen
Phishing simulation and awareness training
Realistic simulations agreed with your leadership, followed by short training built around what the results showed.
Email domain hardening
SPF, DKIM and DMARC set up and moved to enforcement step by step, so your domain is harder to impersonate. Check yours now with our free email security checker.
OTP flooding and SMS-pumping protection
Rate limits, CAPTCHA, cost alerts and controls at your SMS provider, so verification messages can’t be abused at scale.
Credential-stuffing and brute-force defence
Rate limiting, lockout rules, checks against known breached passwords and multi-factor sign-in where it matters.
Bot protection
Controls on sign-up, sign-in and other high-value forms that slow automated abuse without blocking real people.
Account-takeover detection
Alerts for unusual sign-ins, new devices and changes to email or password, so a takeover is noticed early.
Review, prioritise, put controls in place, rehearse
Review
Your email domain setup, your sign-in, sign-up and OTP flows, and what you currently alert on.
Prioritise
The gaps ranked by how likely they are to be abused and how much they matter to your business.
Put controls in place
Email authentication, rate limits, bot and takeover controls, and the training, done with your team.
Rehearse
Incident playbooks for an account takeover, an OTP flood and a reported phishing email, walked through with your team.
Advisory, build or run
Advisory
We review your email setup and your sign-in and verification flows, and hand you a prioritised list of controls to add.
Build
We put the controls in place with your team and run the training and the first simulation.
Run
We stay on to review abuse patterns as they change and run follow-up simulations on a schedule agreed with you.
Controls in place and a team that knows what to do
- A review of your email domain, sign-in and OTP flows, with the gaps ranked
- Controls set up and tested in your environment
- Training and simulation results presented as lessons for the team
- Incident playbooks for account takeover, OTP floods and phishing reports
No control stops every attack. The aim is to make abuse harder and more expensive, and to spot it early when it happens.
Is this the right fit?
Businesses whose customers sign in or verify with a one-time code, and teams whose staff handle payments, customer data or supplier invoices by email.
Common questions about phishing and account abuse
Will a phishing simulation upset our staff?
It can if it is handled badly. We agree the scenarios with your leadership, avoid themes that would cause real distress, and use the results to improve training, not to single out individuals.
Do you collect passwords during a simulation?
No. A simulated page records that a link was clicked or a form was submitted. It does not store what was typed.
What is SMS pumping?
Attackers trigger large numbers of OTP or verification messages to phone numbers they profit from, and you pay for every message sent. Rate limits, CAPTCHA, cost alerts and controls at your SMS provider make this much harder.
What do SPF, DKIM and DMARC do?
Together they let receiving mail servers check that email claiming to come from your domain really does. That makes your domain harder to impersonate and helps your genuine email reach the inbox.
Will these controls get in the way of genuine customers?
We tune them so they step in when behaviour looks unusual, such as many attempts in a short time, rather than challenging every user on every visit.
Do we need to change our email or SMS provider?
Not necessarily. We start with the controls your current providers support, and tell you if one of them cannot support something you need.
Can you guarantee we will not be phished or abused?
No. No control stops every attack. We make abuse harder and more expensive, help you detect it sooner, and give your team a plan for when it happens.
Start with your sign-in and your inbox
Tell us how your customers sign in and how your team uses email. We’ll point out the gaps worth closing first — and if your setup is already in good shape, we’ll say that.