Overview

Phishing is a fake email that pretends to come from a company you trust, so that you give away your password or other private details. Smishing is the same trick sent by SMS (text message), WhatsApp or another chat app.

Attackers sometimes pretend to be Fixably. A common example is an email about your "Fixably subscription" or an "upcoming renewal" that asks you to log in from a link. The link opens a copy of a login page. Anything you type there goes to the attacker, not to Fixably.

This article shows you how to:

1. Recognize a fake message
2. Check a link before you click it
3. Act fast if you already entered your password
4. Protect your whole team

Remember these three rules

Keep these in mind every time a message asks you to log in or pay:

• Fixably never asks for your password by email, SMS or WhatsApp. No one at Fixably needs your password, and we never ask you to "confirm" it.
• Only log in at your own Fixably address. Your company has its own address, for example https://yourcompany.fixably.com. Save it as a bookmark and always log in from the bookmark.
• If in doubt, don't click. Open your bookmark instead, or contact Fixably Support and ask if the message is real.

Recognize a fake message

Most fake messages share some of these signs. One sign alone is a reason to stop and check.

Check a link before you click it

Follow these steps for any link that asks you to log in.

1. Look at the real address. On a computer, hover your mouse over the link without clicking. The real address shows at the bottom of your browser or email program. On a phone, press and hold the link to preview it.
2. Read the domain from right to left. The part just before the first single / is what matters. For example:

   https://yourcompany.fixably.com/session/login    <- real Fixably address
   https://fixably.com.account-renewal.net/login     <- fake, the domain is account-renewal.net
   https://fixably-subscription.com/login            <- fake, the domain is fixably-subscription.com

3. Compare it with your bookmark. If the address is not exactly your company's Fixably address, do not log in.
4. When you are not sure, close the message and open Fixably from your bookmark. If there really is something you need to do, you will see it there.

What happens on a fake login page

A fake login page often looks exactly like the real one. After you type your email and password, it usually shows a message such as "We sent you a code" or "Enter your verification code". The code never arrives, or the page asks you to type the code in.

This is a sign that the attacker is trying to use your password straight away. If this happens to you, follow If you already entered your password below right now.

Fixably does have a real code step. If your administrator turned on Two Factor Authentication (a second check after your password, explained in Protect your whole team below), the real login page asks for a code after your password. The difference is the address: the real code step is always on your company's own Fixably address.

If you already entered your password

Act quickly. The sooner you change your password, the less time the attacker has.

1. Change your password now. Go to your company's Fixably address from your bookmark, log out if you are logged in, and click Forgot your password? on the login page. Follow the email to set a new password. Use a new password that you do not use anywhere else.
2. Change the same password everywhere else. If you used the same password for other services (email, GSX, GSPN, banking), change it there too.
3. Tell your Fixably administrator. They can reset your password for you and check your account. An administrator with the Reset user's password permission can open your user and click Reset password.
4. Contact Fixably Support. Forward the fake message to us. See Getting support below for what to include.
5. Don't reply to the message and don't send any codes you receive.

Protect your whole team

Administrators can make your company's account much harder to break into, even if someone's password is stolen.

Turn on Two Factor Authentication (2FA). With 2FA, every login also needs a one-time code, sent by email or created by an authenticator app (TOTP, a phone app such as Google Authenticator or Microsoft Authenticator that shows a new code every 30 seconds). A stolen password alone is then not enough to log in.

To turn it on:

1. Open System Settings from the user menu in the top-right corner.
2. Go to Security > General.
3. Turn on Enable Two Factor Authentication.
4. Under Set the 2FA strategy, choose when the code is asked for:
   • Trigger 2FA every time the employee log in (safest)
   • Trigger 2FA if the IP has changed since the last log in (asks for a code when someone logs in from a new network)
5. Under Set the 2FA method, choose Two Factor Authentication via Email or Two Factor Authentication via TOTP.
6. Save.

Each employee must have an email address, or a TOTP app set up, for 2FA to work.

Other good habits for the whole team:

• Share this article with new employees as part of their first week.
• Make sure everyone has your company's Fixably address saved as a bookmark.
• Never share logins. Give each person their own Fixably user.
• When someone leaves, remove or disable their user the same day.

Troubleshooting

"Your Fixably Subscription and Upcoming Renewal" email asks me to log in
Treat it as fake. Don't click the link. Open Fixably from your bookmark and contact Fixably Support if you have questions about your subscription.

"We sent you a code" but no code arrives
You are probably on a fake page. Close it and follow If you already entered your password above.

An SMS or WhatsApp message says my Fixably account is blocked
Fixably does not contact you this way about your account. Don't click the link or reply. Open Fixably from your bookmark to check.

A customer says they got a strange message "from your repair shop"
Attackers can also pretend to be your business. Tell the customer not to click any links and to contact you directly. Then contact Fixably Support so we can look into it.