User clicked a phishing link and entered credentials

Intake

Sarah entered her password on a page reached from a 'shared invoice' email. Twenty minutes later a supplier received an email from her mailbox with new bank details.

Evidence gathered

• ▸Sign-in log shows a successful sign-in from an unfamiliar country minutes after the click
• ▸A new inbox rule moves messages containing 'invoice' to RSS Feeds and marks them read
• ▸Sent Items has been cleared, but the supplier has the message
• ▸MFA (Multi-Factor Authentication) was enrolled — the sign-in shows a satisfied MFA claim