I'm not sure whether a message I received is a legitimate Granite email or a phishing/scam message. What should I do?

Granite never sends emails asking users to reply with personal information, form data, passwords, or login credentials. Links included in Granite's automated emails always point directly to your organization's own HTTPS-secured Granite environment, not to unrelated external websites.

Practical steps to verify the message:

• Check the sender and domain. Granite system-generated emails are typically sent from no-reply@fm.granitegrc.com. Be cautious if the sender address differs from what you normally receive from Granite.
• Preview links before clicking. Hover your mouse over any link without clicking it. Verify that the destination points to a familiar Granite URL, such as your organization's Granite environment (for example, https://yourorganization.granitegrc.com). If the link leads to an unfamiliar domain, a shortened URL, or another external website, do not open it.
• Log in to Granite directly. Instead of using a link from a suspicious email, open Granite using a trusted address, such as a bookmarked URL. If the email relates to a task, form, or training course, you should be able to find it directly within Granite after signing in. You can search for the item using Granite's filtering and search features.
• Assess the content. Legitimate Granite emails may include: Training notifications, Reminders about overdue tasks, Notifications about form updates and Direct links to forms or training content. Elements such as years (for example, 2024) or tracking identifiers do not automatically indicate fraud. Requests for passwords, multi-factor authentication (MFA/2FA) codes, or sensitive information by email are strong signs of phishing. Granite never requests such information by email.
• Consider your organization's login method. If your organization uses Single Sign-On (SSO) through services such as Microsoft Entra ID (Azure AD), Active Directory, Microsoft 365, or Okta, Granite does not send password reset links for those internal authentication systems. If you receive an unexpected password reset request, verify its authenticity with your IT department before taking any action.
• Ask for verification if needed. Forward the suspicious message to your organization's IT security team or contact Granite Support through your organization's approved support channel. Include the full email and, if possible, the email headers. Do not send inquiries to email addresses that are intended only for outgoing notifications.

Examples of messages that are often legitimate:

• Weekly reminders about open forms when you have been assigned as a handler.
• Notifications stating that you have been added as a Responsible Person, Owner, or Handler.
• "Form has been modified" notifications.
• Training completion reminders containing a direct link to a course.

If you are unsure why you are receiving notifications, your organization's Granite admin user can verify whether you have been assigned as a responsible person, owner, or handler and can help clarify why the notifications are being sent.

If you clicked a suspicious link or shared information: Change your password immediately according to your organization's security procedures. Contact your organization's IT security team without delay. Follow any incident response instructions they provide.
.

Updated on: 21/10/2026