AegisAI Perspectives · 129
Brief every new hire before day one, verify CEO requests on a second channel, and turn on impersonation settings that cover a mailbox in its first week.
See it on your own Google Workspace or Microsoft 365 tenant. No MX change.
Or get the Q3 2026 State of the AI Attack report (free, instant download)
Not ready for a demo? Check your domain (free, about 10 seconds).
Warn every new hire at your fintech startup, before day one, that the CEO never emails for gift cards, favours or payments. Verify any such request on a second channel8. AegisAI investigates every email for what it is trying to do, and removes the ones that fail from every mailbox they reached16. If you run IT for a fintech startup of 20 to 500 people on Microsoft 365 or Google Workspace, with a lean IT or security team and no SOC, run the checklist below on each start date.
Filters alone will not close the gap: AegisAI research found 3 in 10 confirmed phishing emails cleared native Gmail and Microsoft filters in Q3 202622. That figure sits on the inbound email security page. For CEO fraud and payroll diversion across the whole company, read how security teams stop CEO fraud and payroll diversion.
Scammers are watching, too, and they might use the update to target you1. A post that names the company and the role tells an attacker who to write to and when.
The usual opener is a quick favour from the CEO's name, before the new hire knows how the CEO writes.
Ask new hires to hold their job update until after the first week, or to post it without a start date.
Short on time? Watch the explainer, or book a demo.
The new hire has no baseline. Unfamiliar with the company's communication norms and executive team, they might not recognize fraudulent requests15. Employees, especially newer ones, are less likely to question directives that seem to come from the top.
The mailbox has no baseline either. In Microsoft 365, the first contact safety tip is not stamped when the message was sent to a mailbox created less than seven days ago10. The warning a new hire would most need is missing in week one.
Treat the first month after a start date as the highest risk window for that person.
Three asks cover most of it: gift cards, a quick favour that turns into a purchase, or a payment or a change to account details.
The FTC is direct: don't buy gift cards for anyone who contacts you to ask2. Gift cards are for gifts, not for payments4. The same ask hits staff well beyond fintech: see how universities stop payroll diversion and gift card scams.
Payments carry the larger loss. The FBI counted 21,442 business email compromise complaints in 20245, with reported losses of $2,770,151,146. Between December 2022 and December 2023, identified global exposed losses rose 9%7.
The sender address does not settle it. Impersonation can pass email authentication checks if the attacker created a lookalike domain and published valid DNS records9.
Put these three asks, in these words, into the welcome email each new hire gets before day one.
HR owns the welcome note. Security owns the route a new hire uses to check a request.
Give one route that does not touch the email thread. The FBI advice: use secondary channels or two-factor authentication to verify requests for changes in account information. For a new hire, that means a number from the company directory, never one in the email.
Give one person to ask. The FTC advice is to talk to someone you trust before acting3. Make that someone a named manager, not "anyone on the team".
Write the route and the name into the welcome note, under the three asks.
Run it for every new starter, in this order, before the first payment or vendor task lands on their desk.
Send the welcome note before day one: the three asks, the callback route and the named manager. Don't buy gift cards for anyone who contacts you to ask.
In Microsoft 365, turn on the first contact safety tip in the anti-phishing policy. Microsoft recommends you turn it on, because it adds an extra layer of protection against potential impersonation attacks11.
Add the CEO and finance leads as protected users for impersonation, and remember that a mailbox under seven days old gets no first contact tip.
In Google Workspace, turn on protection against messages where the sender's name is a name in your Google Workspace directory12.
Also turn on protection against domains that appear visually similar to your company's domains or domain aliases13.
Show the new hire where the report button is on day one, and ask them to report the first odd request instead of answering it.
Copy these six steps into your onboarding ticket template today.
| Control | What it catches | What it misses in week one | Inbound email security |
|---|---|---|---|
| First contact safety tip (Microsoft 365) | A first message from an unfamiliar sender | Not stamped on a mailbox under seven days old | Catches fake executives, vendors and payment requests, even with no link or file to scan17 |
| Employee name spoofing (Google Workspace) | A display name that matches your directory | A request that uses no display name trick | The verdict rests on what this sender has sent you before and on the request itself21 |
| Email authentication (SPF, DKIM, DMARC) | Forged use of your own domain | A lookalike domain with valid records | Reads mail through the Microsoft 365 or Google Workspace API after delivery18 |
| Callback on a known number | A payment or account change | A gift card ask the new hire never reports | No edge. A callback is a people step, and the live product pages describe none |
| Day-one briefing | Gift card and favour asks | A new hire who skips the email | No edge. Briefing new hires stays with your team |
The last two rows are people steps, so keep them whatever tool you run. Fill in the third column for your own tenant before the next start date.
AegisAI reads the thread the way an analyst would: the sender's history, the change being asked for, and where the reply actually goes20. One bad email is pulled from every inbox it reached, forwards included23. Every verdict comes with its reason in plain language, so your team can check it and share it24.
Illustrative example, figures are fictional: Harbor Ledger (fictional) is a fintech startup of 100 people on Google Workspace with one IT lead. A new payments analyst posts her start on Monday. On Wednesday she gets an email with the CEO's name from a personal address: "Are you at your desk? I need a quick favour." The next message asks for six gift cards for a client event. Her welcome note listed gift cards as one of the three asks the CEO never sends, so she reports it instead of replying. The IT lead finds the same message in four other new starters' inboxes. He deletes all five copies and adds the address to the welcome note as an example.
Time your next report like this one: from the moment the email arrives to the moment it is gone from every inbox.
Track three numbers, each from a record you already keep.
On day 30, read the reported count next to the 21,442 national complaint figure only for scale, and decide which step to tighten.
Brief each new hire before day one, give them one callback route, and turn on impersonation settings that cover a brand new mailbox. AegisAI investigates every email for what it is trying to do, and removes the ones that fail from every mailbox they reached.
Because the start date is public and the new hire has no baseline. Scammers might use a job update to target you. New hires are less likely to question directives that seem to come from the top.
Treat it as fake. Don't buy gift cards for anyone who contacts you to ask. Gift cards are for gifts, not for payments.
Not on its own. Impersonation can pass email authentication checks if the attacker created a lookalike domain and published valid DNS records. Add lookalike domain protection and a callback step.
Not in the first week. The first contact safety tip is not stamped when the message was sent to a mailbox created less than seven days ago. Brief the new hire before that week starts.
