Can You Trust That Shared File? How to Spot Fake Cloud Invitations

Article summary: Cybercriminals exploit legitimate file-sharing services like OneDrive, SharePoint, Dropbox, and Google Drive to distribute convincing phishing attacks. Because notifications may come from trusted platforms or compromised vendor accounts, these scams can be difficult to detect. Verifying unexpected file invitations, using phishing-resistant MFA, and strengthening sharing controls can help businesses protect their accounts and prevent financial fraud.

It's Tuesday afternoon when an email arrives from a longtime vendor. The subject line reads, “Q3 Audit Documents shared with you.” It comes from their legitimate email address, displays the familiar OneDrive logo, and links to a genuine Microsoft page.

You click the link and are prompted to verify your email address with a code. Then you're asked to sign in to access the document.

That's where things get suspicious.

Modern phishing attacks don't always rely on fake websites or obviously fraudulent emails. Cybercriminals increasingly exploit legitimate cloud-sharing tools to make malicious requests appear trustworthy, making these scams harder to recognize.

Why Fake Cloud Invitations Fool Smart People

Checking sender addresses and hovering over links are still useful precautions. But they aren't always enough to catch modern phishing attacks.

According to Microsoft Threat Intelligence, attackers have increasingly used legitimate file-sharing services, including OneDrive, SharePoint, and Dropbox, to evade security defenses.

One common tactic starts with a compromised vendor account. Criminals upload a malicious document, restrict access to specific recipients, and share it through the cloud platform.

The recipient receives a legitimate sharing notification, sometimes appearing to come directly from a trusted vendor. Because the file is hosted on a familiar service, the invitation may appear harmless. However, the document can contain a link leading to a phishing page designed to steal login credentials.

Google has documented similar attacks involving Google Drive. Its automatic sharing notifications can also carry malicious links, making fraudulent invitations appear more credible.

The danger isn't necessarily the sharing notification itself. It's the malicious content hiding behind a legitimate service.

What Happens After You Click?

A malicious cloud-sharing invitation may lead you through several steps before exposing your account:

1. The document opens. A shared file with a title like "Payment Remittance" or "Password Reset Required" appears on a legitimate cloud platform.

2. You're directed elsewhere. A button labeled "View Full Document" takes you to a convincing Microsoft 365 or Google sign-in page.

3. You enter your credentials. The fraudulent page captures your password and may prompt you to complete multifactor authentication (MFA).

4. The attacker gains access. In more sophisticated attacks, criminals intercept your authenticated session, potentially allowing them to access your account without completing MFA again.

This technique, known as adversary-in-the-middle (AiTM) phishing, exploits session tokens that keep users signed in. According to Microsoft's security research, stolen authentication tokens can allow attackers to bypass certain MFA protections.

Once inside a compromised mailbox, criminals may monitor conversations, identify upcoming payments, and impersonate trusted contacts to redirect funds. This is a common form of business email compromise (BEC).

The financial damage can be substantial. The FBI's 2025 Internet Crime Report recorded 24,768 BEC complaints and more than $3 billion in reported losses.

How to Spot a Fake Shared Document

You Weren't Expecting It

Did a vendor suddenly share an invoice or contract nobody discussed? Before opening it, confirm the request through a trusted contact method. 

The Federal Trade Commission recommends using a phone number or website you already know is legitimate, not the contact information in the suspicious message.

It Redirects You to an Unexpected Login Page

Legitimate cloud services sometimes require additional verification. However, a document that sends you to an unfamiliar sign-in page should raise concerns. Don't enter your credentials until you've verified the request and website.

The Title Creates Pressure

"Action Required." "Account Suspended." "Final Notice." Scammers use urgency to push people into acting without thinking. Be especially cautious when an unexpected document demands immediate action.

Something Doesn't Add Up

A generic greeting, unusual wording, or a request that doesn't match your contact's normal behavior can signal trouble. Even messages from familiar accounts deserve scrutiny. When in doubt, contact the sender directly using a trusted phone number.

Building a Team That Pauses Before It Clicks

Recognizing phishing attempts takes more than occasional security reminders. Build these practices into your team's daily routine:

• Normalize verification. Encourage employees to call vendors using trusted contact information when unexpected files arrive.

• Use phishing-resistant MFA. Passkeys and FIDO2 security keys provide stronger protection against credential theft than traditional verification codes. Our guide to secure authentication explains the options.

• Review external-sharing permissions. Configure Microsoft 365 and Google Workspace sharing controls to limit unnecessary access and reduce exposure to suspicious content.

• Make reporting easy. Employees should know how to report suspicious sharing invitations so IT can investigate and warn others.

• Respond quickly to compromised accounts. If someone enters credentials on a phishing page, reset their password, revoke active sessions, and investigate suspicious activity. Stolen session tokens may remain usable after a password change.

These precautions matter because attackers increasingly exploit trusted business relationships. A compromised vendor account can make a malicious file invitation appear legitimate.

As we explored in our article about a SharePoint phishing scam targeting Office 365 credentials, the delivery methods may change, but the objective remains the same: gaining unauthorized access to your accounts and information.

Would Your Team Catch a Fake Share?

File-sharing phishing exploits the trust employees place in familiar platforms and business contacts. Verifying unexpected requests, using phishing-resistant MFA, and reviewing sharing permissions can significantly reduce your company's exposure.

Since 2003, BrainStomp has helped Indiana businesses strengthen their IT security. Our team can review your Microsoft 365 or Google Workspace settings, identify potential vulnerabilities, and help employees recognize suspicious sharing invitations.

Call BrainStomp at 260-918-3548 or contact us online to discuss your security needs.

Article FAQs

How can I tell if a shared OneDrive or Google Drive file is fake?

Be cautious of unexpected files, unfamiliar login pages, or requests to enter credentials after opening a document. Legitimate sharing services may require verification, so confirm suspicious invitations directly with the sender using trusted contact information.

Can a phishing email come from a real vendor's address?

Yes. Attackers can compromise a vendor's account and use legitimate cloud-sharing services to distribute malicious files. The invitation may come from a genuine account even though the request is fraudulent.

Does MFA stop file sharing phishing?

MFA provides important protection, but some sophisticated attacks can steal authenticated session tokens and bypass certain MFA methods. Phishing-resistant options, such as passkeys and FIDO2 security keys, offer stronger protection against these techniques.

That USB Drive You Found Could Be a Security Threat

Article summary: An unknown USB drive can expose a business to malware and other security threats when an employee plugs it into a work computer. Clear policies, employee awareness, and device controls can reduce the risk by keeping untrusted USB devices away from company systems.

A small black USB drive is sitting in the parking lot, just a few steps from your office door. Someone on your team picks it up and decides to plug it in to see if they can figure out who it belongs to.

That simple decision could put your business at risk.

USB drop attacks take advantage of curiosity and good intentions. A malicious USB device may contain malware or be designed to compromise a computer once it is connected.

That’s why protecting your business computers also means thinking about what employees plug into them.

Why People Plug in Drives They Find

You might assume only careless employees would plug in a USB drive they found on the ground. Research suggests the motivation is often much more innocent.

In a 2016 study involving researchers from the University of Illinois, University of Michigan, and Google, researchers scattered 297 USB drives across a university campus. Files were opened on 45% of the drives, and the first drive was connected in less than six minutes.

Most survey respondents who plugged in a drive said they were trying to return it to its owner. Curiosity also played a role, with some users opening files such as vacation photos before looking for information that could identify the owner.

That’s what makes USB drop attacks effective. They don’t necessarily depend on careless employees. They can take advantage of ordinary curiosity and the instinct to help someone who appears to have lost something.

What a Malicious USB Drive Can Actually Do

A malicious USB drive does not have to look suspicious. It just has to convince someone to plug it in.

Hide Malware Behind Ordinary-Looking Files

A USB drive can contain malicious files disguised as documents employees expect to see.

In 2026, Microsoft researchers documented a USB-spreading worm that hid legitimate documents and created malicious shortcuts using the same filenames.

When someone opened one of those shortcuts, the malware launched instead. The worm could then spread to newly connected USB drives, while another component targeted cryptocurrency wallet information and other sensitive data.

Pretend to Be a Keyboard

Some malicious USB devices do not behave like storage drives at all. They can identify themselves to the computer as a keyboard and automatically enter commands once connected.

That can allow an attacker-controlled device to launch scripts, download malware, or make other changes without waiting for someone to open a suspicious file.

What to Do When Someone Finds a USB Drive

The safest rule is simple: if you don’t know where a USB drive came from, don’t plug it into a work computer just to see what’s on it or figure out who owns it.

Give employees a clear process to follow:

1. Don’t plug it in. That includes spare work computers and personal devices.

2. Give it to IT. Let whoever manages your technology decide how it should be handled.

3. Be cautious with unexpected USB drives in the mail. Professional packaging or an official-looking letter does not guarantee the device is safe.

4. Report it immediately if someone already plugged it in. Disconnect the computer from the network and contact IT so they can determine what happened.

Promotional USB drives from conferences and trade shows deserve some caution, too. If you cannot verify where a drive came from or whether it can be trusted, there is no reason to connect it to a business computer.

Backing the Rule Up with Technology

Employees should know not to plug in unknown USB drives, but technology can provide another layer of protection when someone makes a mistake.

Microsoft Defender for Endpoint includes device control features that can restrict how removable devices are used. Depending on your needs, IT can block removable storage, limit access to approved devices, or control whether users can read or write files.

Endpoint protection should also be installed and kept up to date on every business computer, starting with how new laptops and PCs are set up.

Finally, give employees better ways to move and share files. Approved cloud storage can reduce the need for USB drives in everyday work. Combine those safeguards with cybersecurity habits your team actually follows, and employees are less likely to reach for an unknown device in the first place.

Are Your Computers Protected from Unknown USB Drives?

A USB drive found in a parking lot may seem harmless, but plugging an unknown device into a work computer can expose your business to malware and other security threats.

A simple rule, an easy reporting process, and the right device controls can reduce that risk without getting in the way of everyday work.

BrainStomp can help you review how removable devices are handled across your business, strengthen endpoint security, and put safeguards in place to keep unknown USB drives off your network.

Contact BrainStomp or call 260-918-3548 to get started.

Article FAQs

Is it safe to plug in a USB drive I found?

No. An unknown USB drive could contain malicious files or behave like another type of device when connected. Give it to IT rather than plugging it in to identify the owner.

Can a USB drive attack a computer without opening any files?

Yes. Some malicious USB devices can impersonate a keyboard and automatically enter commands after they are connected. That’s why employees should avoid plugging in unknown devices at all.

What should I do if someone already plugged in a found USB drive?

Disconnect the computer from the network and contact IT immediately. Avoid using the computer until IT has checked it for suspicious activity.

Think Before You Scan: How to Spot a Fake QR Code

Article summary: Fake QR codes can hide malicious links in emails, signs, and even parking meters. Spotting a fake QR code starts with a quick pause to check where it came from and preview the link before opening it. Combined with email filtering and stronger sign-ins, that simple habit reduces the risk of stolen passwords and fraudulent charges.

A flyer taped to the breakroom door promises a free lunch for completing a quick employee survey. There’s a QR code at the bottom.

Someone scans it, and their phone opens what looks like the company’s Microsoft 365 sign-in page.

There’s just one problem: nobody in HR posted the flyer.

QR codes have become so common that scanning one barely feels like clicking a link. Scammers take advantage of that familiarity to send people to fake login pages, payment sites, and other malicious destinations.

Learning to recognize a suspicious QR code is now part of everyday business security, not just something for IT to worry about.

Why QR Codes Make Such Good Bait

A QR code is essentially a link you can’t read at a glance.

With a regular link, you can inspect the web address before clicking. A QR code hides that destination inside an image, making it harder to tell where you’re going before you scan.

Attackers are taking advantage of that blind spot. Microsoft Threat Intelligence reported that QR code phishing attacks increased 146% during the first quarter of 2026, climbing from 7.6 million in January to 18.7 million in March.

Most were delivered through PDF attachments. By hiding malicious links inside QR-code images, attackers can also make them harder for text-based email scanning tools to detect.

There’s another advantage for the attacker: a QR code displayed on a work computer is usually scanned with a phone. That can move the victim away from the protections on a company-managed computer and onto a personal or unmanaged device.

The result is a phishing link that is harder for both the employee and some security tools to inspect before someone follows it.

Where Fake QR Codes Show Up

Fake QR codes work best when they appear somewhere you already expect to see one. Here are three places to be especially careful.

In Your Inbox

QR code phishing emails often disguise themselves as routine business messages. You might see a document waiting for your signature, an HR notice, or a warning that your multifactor authentication needs to be reset.

The message tells you to scan a QR code to take care of the problem. Instead, the code leads to a fake login page designed to steal your credentials.

On Parking Meters and Public Signs

Scammers can place fraudulent QR code stickers over legitimate ones on parking meters, signs, menus, and other public materials.

The FBI has warned that criminals tamper with physical and digital QR codes to redirect people to malicious websites that steal login credentials, payment information, and other sensitive data.

If a QR code looks like a sticker placed over another code, has been tampered with, or sends you somewhere unexpected, don’t continue.

In Unexpected Packages

A malicious QR code can even show up at your door.

In 2025, the FBI warned about unsolicited packages containing QR codes but little or no information about the sender. Curiosity about the mystery package can persuade recipients to scan the code.

That scan may lead to a fraudulent website designed to collect personal or financial information or potentially download malicious software onto the device.

How to Spot a Fake QR Code Before It Costs You

Before you scan, ask four questions:

• Was I expecting this? Be suspicious of unexpected codes, especially ones that create urgency.

• Does it look tampered with? Check public QR codes for stickers placed over the original.

• Where does it lead? Preview the address and watch for misspellings or unfamiliar domains, just like in business impersonation scams.

• What does it want? If an unexpected code leads to a login or payment page, stop and visit the official site or app instead.

The FTC also recommends keeping your phone updated. And skip third-party QR scanner apps. Your phone’s built-in camera can usually do the job.

What Your Business Can Do Beyond Training

Employee awareness works better when technology provides another layer of protection.

Start with email security that can inspect images and attachments for phishing threats, not just visible links.

Next, strengthen account security. Phishing-resistant authentication can help stop credentials captured by a fake login page from being used to access an account. Number matching for MFA prompts can also help protect employees from MFA fatigue attacks.

Finally, make suspicious QR codes easy to report. If someone enters a password on a fake site, IT needs to know quickly so it can secure the account and investigate. If payment information was entered, contact the card issuer promptly.

Just like suspicious email attachments, questionable QR codes should be reported instead of ignored.

Is Your Team Ready for the Next Fake QR Code?

QR codes are easy to trust because scanning them has become second nature. A quick check of the source and destination can help employees recognize when something doesn’t look right.

Pair those habits with stronger email protection and account security, and your business has more than one line of defense against QR code phishing.

BrainStomp can help strengthen your email and account security while giving your team practical guidance for recognizing phishing attempts before they cause trouble.

Contact BrainStomp or call 260-918-3548 to get started.

Article FAQs

What is quishing?

Quishing is a type of phishing attack that uses a QR code to send someone to a malicious website. The goal is often to steal login credentials, payment information, or other sensitive data.

How can I check where a QR code goes before opening it?

Use your phone’s built-in camera to scan the code, but check the web address it previews before opening the page. Watch for misspellings, unfamiliar domains, or an address that doesn’t match the organization you expected.

What should I do if I scanned a fake QR code and entered information?

Report it to IT immediately so they can secure any affected accounts. If you entered payment information, contact your card issuer promptly and follow its instructions for protecting the account.

Business Identity Theft: How Scammers Are Cloning Companies Online

Article summary: Business identity theft uses a company’s established reputation to make scams more convincing. Monitoring for impersonation, strengthening email security, and creating clear verification procedures can help businesses spot suspicious activity earlier and reduce the risk to customers, vendors, and employees.

Imagine finding a second version of your company online. The logo looks right. The website has been copied page for page. Even the domain looks familiar, except for one extra letter or a different ending.

The deception can go further. Emails may use the name and signature of a real employee, while spoofed caller ID can make a call appear to come from the business itself.

To a customer or vendor who already trusts the company, there may be little reason to question what they’re seeing.

That’s what makes business identity theft so effective. Scammers copy the trust a company has already built and use it against the people who do business with it.

A digital identity review can help uncover vulnerabilities that make impersonation easier.

What Business Identity Theft Looks Like Right Now

Business identity theft can take several forms, but the goal is usually the same: convince someone that they’re dealing with a company they already know and trust.

A scammer might register a lookalike domain and use it to send fake invoices, impersonate an employee in emails, redirect payments, or collect customer information. Others create fake social media accounts, business listings, or customer service channels to intercept people trying to reach the real company.

What makes these scams difficult to catch is that the real business may never be contacted directly. The scammer communicates with its customers, vendors, or employees instead.

That means a company may not know its identity is being used until someone reports a suspicious message, missing payment, or fraudulent account.

How the Attack Comes Together

A convincing business impersonation scam often combines several small details that make the fake look legitimate.

The lookalike domain

A fraudulent domain may differ from the real one by only a character or two. An extra letter, a missing hyphen, or a different ending such as .net instead of .com can be surprisingly easy to overlook.

The cloned website

Scammers can copy the appearance of a legitimate website, including its branding, images, and page layouts. They then change key details, such as contact information or forms, so visitors end up communicating with the scammer instead of the real company.

The spoofed caller ID

Caller ID can also be manipulated to make a call appear to come from a familiar business. Seeing the correct company name or phone number on the screen can make an unexpected call seem much more trustworthy.

The borrowed employee identity

Using the name, job title, or email signature of a real employee adds another layer of credibility. Information available on company websites and professional networking profiles can give scammers enough detail to make an impersonation attempt seem convincing.

Why This Tactic Works So Well

Business impersonation works because scammers don’t have to build trust from scratch. They borrow the reputation of a company people already recognize.

The scale of the problem is significant. According to the Federal Trade Commission, consumers reported losing nearly $1 billion to business impersonators in 2025, with bank impersonators accounting for the highest reported losses.

Some of the costliest scams begin with fake security alerts that appear to come from financial institutions. Victims are then told to move money to “protect” it, when they’re actually sending it to a scammer.

Phone impersonation remains a problem as well. In April 2026, the FCC announced an enforcement action involving suspicious calls with spoofed caller IDs, many of which displayed phone numbers belonging to major U.S. banks. Call records showed more than 60,000 calls with U.S. caller IDs transmitted in just three days.

How to Protect Your Business from This Threat

Protecting your business starts with visibility, much like the everyday habits that keep a business secure. You can’t respond to an impersonation attempt you don’t know exists.

Consider registering obvious variations of your domain, including common misspellings and alternate extensions. Regularly search for your business name online and watch for unfamiliar websites, social accounts, or listings using your brand.

Email authentication matters, too. Configure SPF and DKIM for your domain and enforce a DMARC policy to help receiving mail systems identify and handle messages that improperly claim to come from your domain.

Train employees to verify unusual financial or account requests using contact information they already trust, rather than a phone number or link supplied in the message. It’s the same verify-before-you-trust approach that can help employees recognize manipulated emails.

If someone does impersonate your business, move quickly. Document the fake site or account, report it to the appropriate provider or registrar, and alert customers through your established communication channels.

Protect the Identity Your Business Has Built

Your company’s name and reputation took time to build, and scammers can use that trust against your customers, vendors, and employees.

The right safeguards can make impersonation attempts easier to spot and harder to pull off. That includes monitoring your online presence, strengthening email authentication, and giving employees a clear process for verifying suspicious requests.

BrainStomp can help you identify gaps in your digital identity and put practical protections in place. Contact BrainStomp or call 260-918-3548 to get started.

Article FAQs

What is business identity theft?

Business identity theft happens when a scammer impersonates a legitimate company using its name, branding, website, contact information, or other identifying details. The goal is often to trick customers, vendors, or employees into sharing information, sending money, or providing account access.

How can I tell if someone is impersonating my business online?

Monitor search results, domain registrations, social media, and business listings for unfamiliar accounts or websites using your company’s name or branding. Customer reports about unusual emails, payment requests, or websites can also be an early warning sign.

Can scammers make a call appear to come from my business’s real number?

Yes. Caller ID information can be spoofed, allowing a fraudulent call to appear to come from a legitimate business number. That’s why the number displayed on a phone should not be treated as proof of who is actually calling.

Bank Impersonation Scams: What to Do When "Your Bank" Calls

Article summary: A caller claiming to be from your bank’s fraud department says your account has been compromised and needs to be verified right now. That single word, "now," is doing all the work in a bank impersonation scam. Hanging up and calling the number on the back of your card, rather than reacting to the pressure, is the one habit that stops nearly every version of this scam.

The phone rings, and the caller ID shows the name of your bank. The person on the other end says there’s been suspicious activity on your account, and they need to verify a few details before they can secure it.

At first, everything seems legitimate. They know the last four digits of your card. They may even know which branch you use. Then they ask you to read back a verification code that was just sent to your phone.

That’s where it pays to stop and take a closer look.

Bank impersonation scams are designed to feel convincing, especially when the caller already has some of your information. But knowing how a legitimate bank communicates with customers, and taking a moment to verify who you’re actually dealing with, can help you spot a scam before you hand over access to your account.

Why "Urgent" Is the First Red Flag

The caller may claim that money is being transferred, someone is trying to access your account, or your card needs to be locked immediately.

That sense of urgency is intentional. A legitimate bank may contact you about suspicious activity, but you should not feel pressured to provide sensitive information or make an immediate decision during an unexpected call. 

Scammers also have more information to work with than many people realize. A familiar-looking caller ID combined with a few real details obtained through a data breach, phishing attempt, or other source can make a fraudulent call sound surprisingly convincing.

How Bank Impersonation Scams Actually Work

These scams usually follow one of three scripts, sometimes combined in the same call or message.

The caller who already knows your information

Scammers can get personal information exposed in previous data breaches, including names, phone numbers, and partial account or card numbers. When a caller can repeat those details back to you, it can make the conversation feel much more legitimate.

The link that looks like your bank’ login page

A text or email may claim there’s a problem with your account and ask you to click a link to verify your information. The page may look almost identical to your bank’s real login screen, but anything you enter is sent directly to the scammer.

The request for a "security code" 

This is where the scam can turn into account access. The scammer may initiate a real password reset, login attempt, or transaction, causing the bank to send a one-time security code to your phone.

If you read that code to the caller because you think you’re confirming your identity, you may actually be giving the scammer what they need to get into your account.

Why This Scam Keeps Working

Bank impersonation scams work because they borrow the trust of a real institution and combine it with a problem that feels like it needs an immediate response.

The threat is growing, too. CrowdStrike reported that voice phishing, or vishing, attacks increased 442% between the first and second half of 2024. Its research also found that criminals are using generative AI to improve social engineering and make attacks easier to create and scale.

The Federal Trade Commission offers two simple warnings: never give a caller a verification code, and never move money because someone says it needs to be “protected.” A legitimate bank fraud department will not ask you to do either.

The FDIC also warns that scammers create convincing fake bank websites and may misuse the FDIC’s name or logo to appear legitimate. 

What to Do If "Your Bank" Contacts You

Hang up or stop replying. There's no requirement to stay on the line or keep answering questions from an unverified caller.

Call the number on the back of your card or your bank’s official website, never one provided by the caller. This lets you verify the situation directly with your bank.

Never share a one-time code, PIN, or password with anyone who calls or texts asking for it. According to the American Bankers Association, a real bank will never ask a customer for that information over the phone, in a text, or by email.

Watch for the same red flags that show up in phishing emails, since bank impersonation scams frequently start as a text or email before moving to a phone call. The pressure tactics are nearly identical either way.

Report the attempt to your actual bank and to the FTC, even if no money or information changed hands. Reports help flag the phone numbers and accounts scammers are actively using.

If your team handles wire transfers or account changes for the business, build the same verification habit into that process that protects logins elsewhere. A request that arrives suddenly and demands immediate action deserves a callback before it deserves a response.

Ready to Build a Verification Habit Your Team Will Use?

Bank impersonation scams depend on catching someone off guard. A simple verification process can make it much harder for a convincing call, text, or email to turn into a costly mistake.

For businesses, that means making sure employees know exactly what to do when a financial request seems suspicious and who to contact before taking action.

BrainStomp can help you build practical security processes that protect your business and give your team clear steps to follow. Contact BrainStomp or call 260-918-3548 to get started.

Article FAQs

How do I know if a call from my bank is legitimate?

If you’re unsure, hang up and contact your bank using the number on the back of your card or its official website. This lets you verify the call without relying on information provided by the caller.

Will my bank ever ask for a one-time verification code?

Banks use one-time codes to confirm logins, transactions, and other account activity. Never share a code with someone who unexpectedly calls or messages you asking for it. Instead, contact your bank directly if you’re unsure why you received one.

Can a scammer's phone number really show up as my bank's real number?

Yes. Caller ID spoofing can make a fraudulent call appear to come from your bank or another trusted organization. Even if the name or number looks familiar, caller ID alone is not proof that the call is legitimate.

Why That "Allow Notifications" Click Could Lead to a Tech Support Scam

Article summary: A single click on "Allow" for browser notifications can open the door to fake virus alerts that look and sound like real antivirus software. These browser notification scams push a victim toward calling a phone number that connects straight to a scammer. Knowing where legitimate security warnings come from, and cleaning up notification permissions on a regular basis, closes that door before it opens.

A pop-up appears in the corner of the screen: "This site wants to show notifications." Allow or Block. Most people click Allow without a second thought, just as they dismiss cookie banners every day.

Days or weeks later, another notification appears. It looks like it's from Windows Defender or a well-known antivirus company, warning that the computer is infected and urging the user to call a phone number for immediate help.

No malware was installed. The notification itself is the scam.

That single click on Allow is often all it takes for browser notification scams to start delivering convincing fake security alerts directly to the desktop.

How a Notification Prompt Turns into a Fake Virus Alert

Browser notifications are a legitimate feature. News websites use them for breaking headlines, and retailers and shipping companies use them for order and delivery updates. The feature itself isn't the problem.

The problem is that any website can request permission to send notifications, including one created solely to deceive users. Once someone clicks Allow, that site can continue sending notifications to the desktop even after the browser tab has been closed.

Scammers create websites for the sole purpose of gaining notification permission, then use them to send fake security alerts days or even weeks later.

Google Chrome uses Safe Browsing to identify websites that abuse browser notifications. When a site is flagged for deceptive or misleading behavior, Chrome can remove its notification permission and require it to ask for access again. It also periodically prompts users to review notification permissions.

Those protections help, but they aren't enough on their own. New browser notification scams appear every day, which is why users should think carefully before clicking Allow in the first place.

Why the Fake Alerts Are So Convincing

These pages borrow real logos, real color schemes, and real-sounding error codes. Some lock the browser into full-screen mode or play a looping alarm sound to add pressure.

Older adults reported $159 million in losses to tech support scams in 2024. The Federal Trade Commission also found they were far more likely than younger adults to report losing money to these scams. 

A convincing fake security alert doesn't have to fool everyone. It only has to catch one distracted employee at the wrong moment.

A recent alert covered by Seton Hall University's technology office points to a reliable tell: if the notification carries a Chrome, Edge, Firefox, or Safari icon, it came from a website, not the operating system or installed antivirus software. 

The Signs of a Fake Virus Warning

Fake browser notifications tend to follow the same pattern:

• They include a phone number to call. Legitimate security software doesn't tell you to call a support hotline.

• They claim your computer has already been scanned and infected. A website cannot scan the files on your device.

• They continue appearing after you've closed the original webpage because the notifications are coming from the browser, not the site itself.

• They use urgent, alarming language to pressure you into acting before you have time to think.

Microsoft's official guidance on tech support scams also advises that it does not send unsolicited support messages or include phone numbers in its error and warning messages. If a pop-up or browser notification tells you to call Microsoft or another technology company, it's almost certainly a scam.

What Happens If Someone Calls the Number

The phone number connects to scammers, not a legitimate support desk. They typically convince the caller to install remote access software, then charge for fixing problems that don't exist or use that access to search for financial information, saved passwords, or other business data.

If someone has already called the number or granted remote access, act immediately. Disconnect the device from the network, run a scan with trusted security software, and change the passwords for any accounts that were open or accessed during the session.

Reviewing what else a compromised device might expose is worth doing even if no obvious signs of misuse are present.

Cleaning Up Notification Permissions

Reviewing existing notification permissions takes only a few minutes and can prevent many of these scams.

In Chrome or Edge

Open Settings, then Privacy and Security, then Site Settings, then Notifications. Every site currently allowed to send notifications is listed there. Remove anything unfamiliar, and anything that isn't a tool the business actually relies on for alerts.

As an ongoing habit

Before clicking Allow, ask whether the website really needs permission to send notifications after you've left the page. In most cases, it doesn't. Block is the safer default, and you can always enable notifications later if they're genuinely useful.

Pairing that habit with the everyday cybersecurity practices that protect the whole team keeps one careless click from turning into a bigger problem.

Ready to Tighten Up Your Team's Browser Security?

Clicking Allow may seem harmless, but across an entire business, those permissions can create an easy path for scammers to reach employees with convincing fake security alerts. A few simple browser settings and better user habits can prevent a minor click from becoming a costly incident.

BrainStomp can review browser notification settings across your organization, identify unnecessary permissions, and help your team build practical habits that reduce the risk of notification-based scams.

Reach out at brainstomp.com/contact or call 260-918-3548 to get started.

Article FAQs

How do I know if a virus warning in my browser is fake?

Check the icon next to the alert. If it shows a browser icon like Chrome or Edge instead of your antivirus software's logo, the message came from a website, not your operating system.

Can a website actually scan my computer for viruses?

No. A web page runs inside the browser and has no access to the files or system on the device. Any pop-up claiming to have already found a virus is fabricated.

What should I do if I already called the number on a fake alert?

Disconnect the device from the network, run a scan using legitimate security software already installed on the machine, and change passwords for any accounts active during the call.

Securing Workplace Browser Extensions: How to Block the "Invisible" Data Drain in Chrome and Edge

Article summary: A browser extension that promises to save a few clicks a day often asks for permission to read and change everything on every website visited, including logins to payroll, banking, and customer systems. Browser extension security means treating every add-on as software running inside the browser, not a harmless shortcut. A short audit and a policy for what gets installed closes a gap most businesses have never looked at.

Someone on the team finds a browser extension that promises to speed up expense reports. It installs from the Chrome Web Store in seconds, with no admin approval required.

A popup asks for permission to "read and change all your data on the websites you visit." Almost everyone clicks Accept without thinking twice.

That permission is not just a formality. It gives the extension access to whatever account is open in that browser tab, whether that's email, online banking, or the business systems your team relies on every day.

Browser extension security rarely gets much attention, yet the browser has quietly become where employees spend most of their workday.

The Hidden Risks of Browser Extensions

Browser extensions do more than add features. They run with the permissions granted during installation, and those permissions often remain long after the extension is installed.

Many browser extensions request permission to read and modify content on every website you visit, view your browsing activity, or access cookies. A single sign-on session, a saved payment method, or a client record open in a browser tab may all be within reach.

None of this requires malware or a full system compromise. The browser is already inside your business, which is why browser extension security deserves the same attention as any other endpoint.

What a Malicious Extension Can Actually Do

In January 2026, researchers at Socket uncovered five malicious Chrome extensions masquerading as productivity tools for enterprise platforms including Workday, NetSuite, and SAP SuccessFactors. On the surface, they performed their advertised functions while quietly stealing authentication cookies every 60 seconds and sending them to attacker-controlled servers.

Two of the extensions went even further by blocking access to key Workday security administration pages. Password resets, IP allowlists, audit logs, and other administrative tools were hidden or redirected, making it harder for security teams to detect or respond to a compromised account.

Before Google removed them from the Chrome Web Store, the extensions had been installed more than 2,300 times. While that number was relatively small compared to some malware campaigns, a single compromised browser extension inside a business can expose sensitive accounts without anyone realizing it.

The Risk Isn't Limited to Obvious Extensions

It's easy to worry about browser extensions with strange names and no reviews. In reality, many of the biggest risks come from extensions that look completely legitimate.

A February 2026 investigation identified 287 Chrome extensions with more than 37 million combined installations transmitting users' browsing history to third parties, including data brokers. Many looked like legitimate productivity tools, making the data collection difficult for users to spot. 

High install counts and positive reviews offered little reassurance. An extension can perform exactly as advertised while quietly collecting far more data than most users realize. 

Browser extensions can also change hands. A trusted add-on may be sold to a new owner who releases an update with tracking or other data collection the original developer never included.

The name, reviews, and install count stay the same, so most users never realize anything has changed. That's why browser extension security isn't just about approving new extensions. It also means regularly reviewing the ones already installed.

How to Audit and Lock Down Extensions in Chrome and Edge

Neither browser leaves this to chance once IT gets involved. Chrome and Edge both support policies that control which extensions can be installed at all.

In Chrome

Google's Chrome Enterprise console lets admins block all extensions except a pre-approved allowlist. 

The ExtensionInstallBlocklist and ExtensionInstallAllowlist policies can also restrict extensions based on the permissions they request, blocking tools that require access to sensitive data such as cookies or activity across every website.

In Edge

Microsoft Edge mirrors this approach. Edge's ExtensionInstallBlocklist policy lets admins block all browser extensions by default and allow only approved ones.

Running a first audit

Create an inventory of every browser extension installed across company devices, not just the ones IT approved.

For each extension found, ask three questions:

• Does it request permission to read and change data on every website when its function doesn't require that?

• Is it still actively maintained, or has it gone untouched for years?

• Was it installed by someone who can explain why the business needs it?

Any extension that doesn't pass those checks should be removed. The rest should be added to an approved list and reviewed regularly, not forgotten after installation.

Most extension platforms weren't built with strict oversight in mind, which is part of why regular access reviews matter across every connected tool, not just apps and user accounts.

Building the Habit Going Forward

A one-time cleanup is a good start, but employees install new browser extensions all the time in search of useful shortcuts. Pairing an approved extension list with a simple review process turns browser extension security into routine maintenance instead of a one-time project.

Require a quick IT review before any new extension is installed on a work device. It doesn't have to be complicated. A brief conversation about what the extension does, what permissions it requests, and why it's needed can prevent most problems before they start.

Ready to Close the Gap in Your Team's Browsers?

Browser extensions may seem small, but they often have access to the same business data your employees do. Without proper oversight, a single risky extension can undermine the security controls you've worked hard to put in place.

BrainStomp can help you inventory browser extensions, implement approved extension policies in Chrome and Edge, and establish a simple review process for new installations

Reach out at brainstomp.com/contact or call 260-918-3548 to get started.

Article FAQs

What browser extension permissions should raise a red flag?

Permissions to read and change data on the websites you visit deserve extra scrutiny. Depending on what you're signed into, that access could include email, business applications, or other sensitive information.

Can a trusted browser extension become risky over time?

Yes. An extension can change ownership or receive an update that adds new tracking or data collection. That's why installed extensions should be reviewed regularly, not just when they're first approved.

How do I block unapproved extensions in Chrome or Edge?

Both Google Chrome and Microsoft Edge support centralized management policies that let organizations restrict browser extensions to an approved list, helping prevent employees from installing unapproved software.

The "Digital Offboarding" Checklist: Securing Business Data When an Employee Leaves

Article summary: When an employee leaves, most businesses collect a laptop and a badge while the digital footprint stays active. A documented employee offboarding checklist closes every account, login, and integration they touched. Doing this in the first hours after departure is one of the cheapest security upgrades a small business can make. 

An employee’s last day has arrived. They return their company laptop, say goodbye to the team, and walk out the door. From an HR perspective, the departure may be complete.

From a security perspective, the work is just beginning.

The former employee may still have access to email, shared files, business applications, or accounts no one remembers approving. If those connections remain active, they can create security risks long after the employee leaves.

A complete offboarding process closes every point of access, not just the ones that are easy to see.

Why Offboarding Is a Security Event, Not an HR Formality

Many businesses approach offboarding primarily as an HR process: issuing the final paycheck, updating benefits, and conducting an exit interview. Removing access is often treated as a separate IT task rather than a critical part of the employee’s departure.

That gap may be larger than many business owners realize.

In a Beyond Identity survey, 83% of respondents said they continued accessing at least one account from a previous employer after leaving, while nearly one in four admitted to intentionally keeping a workplace password.

Those findings highlight why access removal cannot wait until IT gets around to it. Every account, application, and credential should be identified and addressed as part of the employee’s departure.

Most former employees may never use that access maliciously. But that is not the only risk.

An active account that no one is monitoring can also provide an attacker with a legitimate path into the business. Because the login uses valid credentials, the activity may appear normal and be harder to detect.

The Digital Offboarding Checklist

A complete employee offboarding checklist should address four key areas. Overlooking any one of them can leave unnecessary access in place.

Identity and email

Disable the departing employee’s primary account first, ideally through your identity provider (Microsoft Entra ID, Google Workspace, or similar) so the change cascades across every connected app at once.

Force sign-out on all active sessions. Disabling a password doesn’t automatically end a session that’s already open on a phone or home computer.

Decide how the former employee’s email will be handled, whether that means forwarding messages to a manager, converting the account to a shared mailbox, or setting up an automatic reply. Whatever approach you choose, disable the former employee’s ability to sign in.

Shared accounts and passwords

Change the password for any account the departing employee accessed through shared credentials. This may include social media accounts, accounting software, shared email inboxes, or other business applications without individual user logins.

Review where those credentials are stored as well. If shared passwords are kept in spreadsheets, documents, or other informal locations, it may be difficult to know who still has access. A business password manager provides better control over how credentials are stored, shared, and updated.

Devices and physical access

Collect laptops, phones, and any security keys or tokens. Deactivate keycards, change alarm codes if they were shared, and remove the person from any physical access lists.

Wipe or reimage returned devices before assigning them to another employee. Local files, saved passwords, and cached login credentials may remain on the device after the employee leaves.

Third-party apps and integrations

Third-party applications are easy to overlook during offboarding. Over time, employees may connect business accounts to outside tools using options such as “Sign in with Google” or “Connect to Microsoft 365.” Some of those authorizations may remain active until they are specifically reviewed or revoked.

As part of the offboarding process, review the applications connected to the employee’s account and remove any access that is no longer needed. Our guide to auditing and revoking third-party app access explains how to identify these connections and determine which ones should be removed.

Where the Gaps Usually Hide

The employee’s primary account is usually disabled. The less obvious connections are where gaps remain.

That may include a salesperson’s personal Dropbox account containing company proposal templates, an AI writing tool paid for by the business but tied to a personal login, or a contractor’s remote access tool that was never connected to the company’s identity system.

According to IBM’s 2025 Cost of a Data Breach Report, breaches involving compromised credentials took an average of 186 days to identify and another 60 days to contain.

Because attackers are using valid login information, their activity may initially appear legitimate, making unauthorized access more difficult to detect.

Federal guidance treats employee separation as a coordination issue as much as a technical one. CISA recommends promptly revoking physical and system access when an employee leaves.

Access removal should be part of the departure process, not a task left for days later.

Building a Process You’ll Actually Follow

A successful offboarding process requires clear ownership and consistent follow-through. A few practical steps can help make that happen:

• Establish a process for notifying IT as soon as an employee’s departure date is confirmed.

• Keep an up-to-date record of the systems, applications, and shared accounts each employee can access.

• Make access removal a core part of the departure process, not a task completed days later.

• Document which accounts and permissions were removed, when the changes were made, and who completed them.

NIST personnel security guidance emphasizes the importance of a defined termination process, including clear responsibilities and established timeframes for disabling system access.

Ready to Close the Gap on Employee Departures?

Effective employee offboarding does not have to be complicated. It requires a complete, repeatable process that removes access consistently every time someone leaves.

If you are not sure whether every account, shared login, and connected application is included in your current process, BrainStomp can help. We can identify gaps, document your full technology environment, and build an offboarding process that covers everything from email and user accounts to overlooked third-party applications.

To get started, reach out at brainstomp.com/contact or call 260-918-3548.

Article FAQs

What should be included in an employee offboarding checklist?

A complete checklist should include disabling the employee’s primary account, ending active sessions, removing access to business applications, changing shared passwords, collecting company devices and physical access items, and reviewing third-party applications connected to company accounts.

How quickly should access be removed after an employee leaves?

Access should be removed as close to the employee’s departure as possible. For planned departures, IT should coordinate with HR and management so accounts are disabled at the appropriate time. Delays can leave unused accounts available to former employees or attackers.

Why is third-party application access often missed during offboarding?

Employees can connect third-party applications to business accounts with only a few clicks, often without a formal approval or tracking process. Regular audits can help identify these connections so unnecessary access can be removed when an employee leaves.

Beyond the Wi-Fi Password: Setting Up a Secure Guest Network for Your Office Clients

Article summary: Handing visitors the same Wi-Fi password your team uses puts every device on your network within reach of anyone sitting in your lobby. A secure guest network keeps visitors online without giving them a path to your servers, printers, or point-of-sale systems. Setting it up correctly takes a short list of settings, not a network overhaul.

A client asks for the Wi-Fi password while waiting in your lobby. A few seconds later, their personal phone is connected to the same network your employees use to access accounting software, shared files, and other business systems.

Most small businesses allow this without a second thought. After all, offering Wi-Fi to clients, vendors, and visitors feels routine.

The problem is not the Wi-Fi password. It is allowing guest devices onto the same network as the systems your business depends on.

Why One Shared Password Isn’t Security

A single Wi-Fi network with one password feels simple. It’s also what’s known as a flat network, meaning every device on it can potentially see every other device.

A visitor’s phone, a vendor’s laptop, and the workstation containing your customer database may all be connected to the same network, with no meaningful barriers between them.

Most guest devices are perfectly harmless. That’s not really what matters here.

An infected phone, an outdated laptop, or a compromised tablet can introduce risk when it connects to the same network as sensitive business systems. Once connected, malware may scan the network for other devices it can access or exploit.

Federal guidance is direct on this point: guest Wi-Fi should be separate from and not connected to your business network.

The FTC’s small business cybersecurity guidance states this plainly as a baseline recommendation, not an advanced or optional step. The agency also recommends verifying that any device meets your security requirements before allowing it to connect to your business network.

What a Secure Guest Network Actually Requires

A secure guest network isn’t just a second Wi-Fi name on your router. It creates a separate path for visitor traffic, keeping guest devices isolated from your business systems, data, and internal network resources.

Give guests their own network, not just a login screen

Most business routers can broadcast a separate guest network alongside the primary one.

The mistake is assuming a different network name and password provide real security. If guest traffic isn't truly isolated from your business network, the risk remains.

Segment it so guest traffic can’t reach your systems

This is the part that actually provides the protection.

Your guest network should sit on its own VLAN (virtual local area network), a way of logically dividing one physical network into separate sections, with firewall rules that block guest devices from reaching your servers, shared drives, or point-of-sale system entirely.

Guests should be able to reach the internet. Nothing else.

Cisco’s guidance on guest Wi-Fi security recommends this kind of segmentation specifically so that a compromised guest device can’t be used to access internal resources.

Use real encryption, not an open network

An open network with no password at all is a liability, even for guests. Every guest network should run WPA2 or WPA3, the current encryption standards that protect what’s being transmitted.

Change the guest password on a reasonable schedule, especially if it gets shared widely or is posted somewhere visible.

Turn on client isolation

Client isolation stops devices on the guest network from seeing or talking to each other, not just to your main network.

Without it, one guest’s infected laptop could reach another guest’s phone sitting two tables over. With it, every device is boxed off on its own. That’s the same walled-off principle behind treating every device on your network as untrusted until it proves otherwise.

Setting It Up Without an IT Overhaul

None of this requires replacing your hardware in most cases.

NIST’s guidelines for securing wireless local area networks note that WLAN security depends on how well every component, from access points to client devices, is configured throughout its life, not just at setup. A checklist you revisit occasionally matters as much as the initial configuration.

A workable rollout looks like this:

1.    Confirm your router or access points support multiple SSIDs with VLAN tagging. Most business-grade equipment from the last several years does.

2.    Create the guest SSID and assign it to its own VLAN, separate from your business VLAN.

3.    Configure firewall rules that explicitly block guest VLAN traffic from reaching internal IP ranges.

4.    Enable client isolation on the guest network.

5.    Set WPA2 or WPA3 encryption with a password that isn’t reused anywhere else.

6.    Test it. Connect a phone to the guest network and try to reach a printer or shared folder. If it works, the segmentation isn’t actually in place.

If your network handles card payments, guest Wi-Fi separation can affect the scope of your PCI compliance obligations. Without effective segmentation, the guest network may be considered part of the cardholder data environment and subject to additional requirements.

The Habits That Keep It Secure

A secure guest network is not a one-time setup. A few ongoing habits help keep it secure.

Change the guest password periodically, especially after a large event, an extended vendor engagement, or when someone no longer needs access. A password that has remained unchanged for years may be known far beyond its intended users.

Keep your router and wireless access points updated. Firmware updates often address security vulnerabilities and should be part of routine network maintenance.

Finally, control how the guest password is shared. Provide it only to visitors who need access and avoid posting it publicly or leaving it displayed indefinitely.

Ready to Separate Your Guest Wi-Fi the Right Way?

A secure guest network gives visitors convenient internet access without exposing the systems your business relies on. But meaningful separation requires more than a second Wi-Fi name. It requires proper segmentation, current security settings, and ongoing maintenance.

If you are not sure whether your guest Wi-Fi is truly isolated from your business network, now is a good time to find out. BrainStomp can review your network configuration, identify potential gaps, and help ensure guest access stays separate from your critical business systems.

Reach out at brainstomp.com/contact or call 260-918-3548 to get started. 

Article FAQs

What makes a guest Wi-Fi network actually secure?

Real segmentation. The guest network needs its own VLAN with firewall rules that block traffic to internal systems, current WPA2 or WPA3 encryption, and client isolation so guest devices can’t reach each other.

Do I need new equipment to set up a secure guest network?

Usually not. Most business-grade routers and access points sold in the last several years support multiple SSIDs and VLAN tagging out of the box. The gap is almost always in configuration, not hardware.

Is a separate Wi-Fi name enough to protect my business network?

No. A second network name with the same underlying access is not segmentation. Unless firewall rules explicitly block guest traffic from reaching internal systems, both networks are effectively one.

The Hidden Costs of Buying a New Printer

Article summary: Modern consumer printers come bundled with subscription services, mandatory account registrations, internet requirements, and firmware that blocks cheaper ink. Understanding the hidden costs of buying a new printer before you commit changes the calculation significantly.

The printer costs less than a night out for dinner. It seems like an easy purchase.

Then the ink runs out.

The first trip to buy replacement cartridges is often when people realize the “bargain printer” wasn't much of a bargain after all.

That's by design.

For decades, printer manufacturers have relied on a business model that keeps hardware prices low and makes up the difference through ongoing ink and toner sales.

Today's printers have taken that approach even further. Many require online accounts, internet connectivity, subscription services, or manufacturer-approved cartridges. Some even use firmware updates to restrict the use of lower-cost third-party ink.

None of it appears on the box. And making informed decisions about the hardware and software you bring into your business starts with knowing what you’re actually committing to.

The Business Model Behind the Bargain Price

Printer manufacturers sell hardware at thin margins or below cost, then recoup through ink. It’s an intentional structure. The printer exists to give you a reason to buy cartridges.

JD Young estimates that an $80 bestselling consumer inkjet printing 1,000 pages per month would cost approximately $16,280 over five years when ink and hardware costs are combined.

Ironically, the cheaper printer turned out to be the more expensive option. The analysis found it could cost nearly $5,900 more to operate over five years than a higher-priced model designed to deliver more pages per cartridge.

The hardware price is often the least relevant number in the comparison.

Third-party cartridges can cut ink costs by 50% or more compared to manufacturer originals. 

That savings opportunity is precisely why manufacturers work hard to block access to them.

Subscription Plans and What They Actually Commit You To

HP is the most prominent example of printer subscription entanglement. 

The company offers two main programs: 

1. The HP Instant Ink which covers ink only.

2. The HP All-In Plan which bundles a printer and ink together.

What you sign up for

According to reporting by Tom’s Hardware, the HP All-In Plan costs between $8 and $36 per month based on the printer model and monthly page allowance. It requires a 24-month commitment and includes cancellation fees if you exit early. 

Print more than your monthly page allowance and additional charges apply. Although HP advertises a 30-day trial, customers must provide a payment method when enrolling and return the printer within 10 days of cancellation to avoid fees.

Opting into HP+ is marketed as a free upgrade. The actual conditions require an HP account, an active internet connection, and use of HP Original Ink for the lifetime of the printer. Once accepted, those restrictions are applied via a firmware update that cannot be undone.

What happens when you cancel

HP Instant Ink cartridges stop functioning when the subscription ends, even if ink remains in them. According to HP's terms, subscription cartridges are remotely disabled when the service is cancelled, requiring the user to install standard replacement cartridges to continue printing.

Internet Requirements and Account Sign-Ups

HP+ printers require a permanent internet connection to function, not just to set up. 

HP confirms this as a program requirement. A printer on HP+ that loses internet access cannot print until connectivity is restored.

Beyond HP, most modern wireless printers require a manufacturer account for full setup, cloud printing, or firmware access. It is one more set of credentials to create, manage, and secure.

That matters from a security standpoint. Each new vendor account is another entry point, another password to manage, and another data relationship to maintain. Handling those credentials with the same care as any other business account keeps that exposure manageable.

Firmware Updates and Third-Party Ink Restrictions

The mechanism behind third-party ink blocks is firmware: software updates pushed directly to the printer over the internet. 

HP’s Dynamic Security feature causes the printer to check an authentication chip on every cartridge. If the chip does not match HP’s signature, the printer refuses to print.

This has been the subject of multiple lawsuits. 

One complaint brought on behalf of European consumers, HP was accused of encouraging customers to register their printers for automatic updates and then deploying firmware that blocked aftermarket cartridges without clear disclosure. The case ultimately resulted in a $1.35 million dollar fund to compensate eligible HP printer owners.

The practical consequence is that cartridge compatibility is not always fixed at the time of purchase. A firmware update can alter which cartridges a printer will accept months or even years later.

What to Check Before You Buy

The best time to uncover these limitations is before the printer comes home. Start with these questions:

• Does this printer require an internet connection to operate, or only for setup and optional features?

• Is this model enrolled in HP+ or an equivalent program that permanently restricts ink to brand cartridges?

• What is the cost per page using manufacturer cartridges, and does the model support third-party alternatives?

• Does this printer prompt for a subscription during setup, and what are the cancellation terms?

• What happens to installed cartridges if a subscription lapses or is cancelled?

Need Help Evaluating Your Print Setup?

The hidden costs of buying a new printer add up fast when you’re not looking for them. A bit of due diligence before purchase saves money for years.

If you’re outfitting an office, reviewing a current print setup, or trying to understand why a printer is costing more than expected, BrainStomp can help you evaluate your options. Reach out at brainstomp.com/contact or call 260-918-3548.

Article FAQs

Do all new printers require an internet connection?

Not all of them. Many modern consumer models only need connectivity for cloud printing, remote access, or initial setup.

What is HP+ and what does it commit me to?

HP+ is a program that applies enhanced features to compatible HP printers via a firmware update. Accepting it is permanent and requires an HP account, an active internet connection, and the use of HP Original Ink for the lifetime of the printer. It cannot be reversed after the update is applied.

Can I use third-party ink cartridges in any printer?

Many printers support third-party cartridges, and they can reduce ink costs substantially. HP printers with Dynamic Security firmware do not. Before buying, check whether the specific model uses Dynamic Security and whether automatic firmware updates might introduce it post-purchase.

What happens to HP Instant Ink cartridges if I cancel the subscription?

They stop working. HP Instant Ink cartridges verify subscription status with HP’s servers, and cartridges issued through the plan are disabled when the subscription ends, regardless of how much ink remains in them.