Avanan | Blog

Could ATP Cost You $3 Million?

Written by Jeremy Fuchs | January 25, 2022

It's everyone's worst nightmare--the missing lottery ticket.

Back in the days of paper tickets, the nightmare could've been a wind-swept evening taking the winning numbers away into the sky.

Today, it's the winning number in your spam folder.

That's what happened to an Oakland County, Michigan woman. She had bought a Mega Millions ticket on the Michigan Lottery website. She picked the five correct numbers to win $1 million, plus had the Megaplier that got her prize up to $3 million.

If only she knew about it. The email ended up in her spam folder.

Luckily for her, she eventually found it while checking her spam folder for something else, and was able to claim her winnings.

But if you have security like Microsoft ATP, this could happen to you--and you might not get as lucky.

Microsoft ATP flags an unusually high percentage of legitimate emails as phishing detections. Some organizations will set their ATP Policies to "quarantine" will end up spending considerable time fielding requests from end-users to release legitimate emails. That's untenable. The alternative is to have ATP detections sent to the Junk Folder.

This policy, which we call the "ATP Dumpster Dive Policy" sends marketing emails, subscriptions and targeted phishing attacks to the Junk Folder. From a security standpoint, that means that phishing attacks are accessible to the end-user.

But it also sends legitimate emails to the Junk folder. That could very well be a lottery notification that you won $3 million. 

It's better to do things differently. Avanan's AI is trained specifically on the sophisticated attacks that were designed to evade default Office 365 EOP and ATP. We can do this without hindering their ability to filter out spam and phishing. That means malicious emails are blocked and legitimate ones--like the lottery notification--go into the inbox, where they belong.

Security is meant to prevent attacks that could lose you or your organization money. It shouldn't keep you from getting money that's rightfully yours.