Phishing in Morocco: the 8 email scams targeting SMBs in 2026

Most of the security incidents we handle start with an email. Not with a sophisticated technical exploit: with a credible message, received on a Tuesday at 11 am, that pushes someone to click, type a password or pay. Fraudsters know how Moroccan SMBs work: supplier transfers, parcels held at customs, exchanges in French with partners. Here are the eight scenarios we come across most often, how to recognise them, and what stops them.

1. The supplier bank-details change

An email, sometimes from a supplier’s genuinely compromised mailbox, announces a new bank account for future payments. The tone is normal, the signature exact, and the message often lands in the middle of a real thread about an invoice. The transfer goes to the fraudsters. Habit: every change of bank details is confirmed by phone, on the number already on file, never the one in the email.

2. CEO fraud

“I’m in a confidential meeting, make an urgent transfer, I’ll explain later.” The message imitates the boss, often with the exact display name, sometimes from a personal address “because I’m travelling”. It targets accounting at a moment when the boss really is away. Habit: no transfer is ever triggered by an email alone, whatever the urgency, and the boss applies the rule too.

3. The fake Microsoft 365

“Your password expires today”, “You have messages in quarantine”, “A document has been shared with you”. The link leads to a perfect copy of the Microsoft sign-in page that harvests username and password, and sometimes the MFA code in real time. The stolen account is then used to send more booby-trapped emails to customers and suppliers. Habit: never sign in from a received link, always from the app or a bookmark. And deploy phishing-resistant MFA (security key, Windows Hello, passkey), as we explain in our MFA guide.

4. The parcel on hold

Fake DHL, Amana or Aramex: “customs fees to pay to release your parcel”. The message arrives by email or SMS, and the page asks for a card number for a few dirhams. The amount is small, but the card is then used elsewhere. Habit: carriers never ask for payment through an SMS or email link; if in doubt, track the parcel on the carrier’s official website.

5. The invoice attachment

A PDF or Office file “Invoice No…” that asks to enable macros, or a link to a compressed file “too large to attach”. It is the classic ransomware vector, whose defences we detail in ransomware: 7 measures for an SMB. Habit: macros blocked by policy for files coming from the internet, EDR on every endpoint, and no invoice opened unless it matches a known order.

6. The fake HR or payroll department

“Update your bank details for your salary transfer”, “View your payslip”. The link points to a form that captures personal data or the password. Habit: HR never sends external forms, and IT verifies the sender. Employees’ personal data is also protected by Law 09-08, covered in our article on CNDP obligations.

7. The tender or purchase order too good to be true

A supposed large account or public body sends a purchase order, requests a quote, then a booby-trapped “specifications” file or a download link that requires signing in. Habit: verify the contact on the organisation’s official website, never through the details in the email, and be wary of any request to sign in just to read a document.

8. The fake IT support

A call or email “from your provider” or “from Microsoft” asks for a remote connection or a password. Habit: your managed services provider already has its own access and will never ask for your password. When in doubt, hang up and call the number on the contract.

Warning signs

Signal	Example	Habit
Urgency or secrecy	“Before 4 pm”, “don’t tell anyone”	Slow down and verify through another channel
Changed details	New bank account, new phone number	Call back on the number already on file
Close but different address	One letter changed, a .co domain instead of .ma	Display the sender’s full address
Link to a sign-in page	“Sign in again to read the document”	Go through the app or a bookmark
Unusual attachment	Compressed file, macros to enable	Do not open, forward to support
Payment request by link	Customs fees, expired subscription	Check on the official website

What really protects

No single measure is enough. Three combined levers stop these scams.

• Technology: email filtering with link and attachment analysis (Microsoft Defender for Office 365 is included in Business Premium), web and DNS filtering on the FortiGate firewall to block known malicious sites, MFA everywhere, EDR on endpoints. On the domain side, SPF, DKIM and DMARC, taken step by step to reject mode, stop anyone spoofing your address.
• Procedures: dual approval for transfers, phone confirmation of bank-detail changes, a written rule everyone knows, leadership included.
• Training: short, regular awareness sessions and quarterly phishing simulations, with a kind reminder for those who click. The goal is not to punish, but for everyone to report a doubt instead of hiding it.

If someone clicked

Speed matters more than anything. Staff must be able to say so without fear. Then:

1. Alert IT or your provider immediately.
2. Change the password from a clean machine and revoke every open session.
3. Check the mailbox: forwarding or deletion rules added by the attacker, messages sent in the user’s name.
4. Isolate the machine from the network if an attachment was opened, and run an EDR scan.
5. Call the bank straight away if a transfer has left, to try to stop it, then file a police report.
6. Warn contacts if the account was used to send booby-trapped emails.

In Morocco, incidents can also be reported to maCERT, the DGSSI’s cyber-alert centre.

The most common mistakes

• Relying only on the spam filter, with no transfer approval procedure.
• Leaving DMARC in monitoring mode for years, never moving to reject.
• Enabling MFA for staff, but not for leadership or accounting.
• Punishing those who click, which makes the next ones stay silent.
• Training once at onboarding, then never mentioning it again.

How we deliver it

We start with the initial audit, which is free: email and domain configuration, filtering, MFA, account rights, payment procedures. We then fix the technical setup, notably on Microsoft 365, write with you a one-page transfer approval rule, and run regular phishing simulations with a summary for management. 24/7 monitoring watches for suspicious sign-ins and abnormal mailbox rules, and a critical incident is handled in under 15 minutes. Examples of our projects are on our case studies page.

Checklist to verify this week

• Does a written rule forbid any transfer requested by email alone?
• Are bank-detail changes confirmed by phone on the known number?
• Is MFA active on every account, leadership and accounting included?
• Are SPF, DKIM and DMARC set up on your domain, and is DMARC in reject mode?
• Are macros in files from the internet blocked?
• Does every employee know whom to report a suspicious email to?
• When was the last phishing simulation?

Taking action

We include all three levers, technology, procedures and training, in our business cybersecurity offer. To find out how your business would hold up against these eight scenarios, contact us: we reply within 24 business hours.