One mail a day. Real, or phishing? Check the sender, point at the links, open the headers if you like, then decide.
You are Sanne de Vries, office manager at Bakkerij Klaassen in Veenwold: one shop, twelve staff, a lot of flour. Peter Klaassen owns it; Lotte runs the shop, Ahmed bakes. You do the ordering, the paying, the website and anything with a screen.
The bakery’s mail runs on Fyzno. It banks with Tulpbank, buys its flour from Meelmolen De Hoop, keeps files in Wolkdrive, does its books in Kasboek and its payroll through Bosman Administratie. The phones are a landline in the shop and everyone’s own mobile.
What you knowLast Monday Meelmolen De Hoop delivered 20 bags of wheat flour and 5 of spelt, like most weeks.
Meelmolen De Hoop <facturen@meelmolendehoop.nl>
30 Oct, 10:02
To: Sanne de Vries <sanne@bakkerijklaassen.nl>
Dear Sanne,
Attached is the invoice for last Monday's delivery: 20 bags of wheat flour and 5 bags of spelt.
Payment term is 14 days, to our usual account. You can also find all your invoices in the customer portal:
Kind regards, Marja Koster, Meelmolen De Hoop
Point at a link (or tap it) to see where it really goes.
Several of these mails only work because the real sender has no strict DMARC policy. The free mail check shows in twenty seconds whether yours does.
Got a real mail you are not sure about? The header reader shows where it came from, in your browser.
Every person, company and domain in these mails is made up, apart from Fyzno. The links and QR codes go nowhere. Your answers stay in this browser (clear them).