How to recognise phishing
- Pressure and urgency: "act now", "account will be locked", "payment today".
- Unusual sender: the display name fits but the address behind it does not; slightly altered domains.
- Links with a different target: hover over the link without clicking and check the destination.
- Unexpected attachments: especially Office files with macros, packed archives and invoices from strangers.
- Requests for credentials or payments: legitimate bodies do not ask for passwords by email.
- Unusual requests from superiors: such as buying gift cards or changing bank details (CEO fraud).
What to do when in doubt
Do not click, open or reply. Forward the message through the agreed reporting route, for example a report button in the mail client or an address at IT. Anyone who already clicked or entered data should report immediately, because speed limits the damage. What matters is that nobody fears blame.
What effective training looks like
- Short and regular: a few minutes, several times a year, instead of one long mandatory session.
- With real examples: phishing emails from practice, ideally from your own industry.
- With simulations, used fairly: practice emails show where retraining helps. They serve learning, not exposure.
- With a clear reporting route: one click or a well-known address.
- With feedback: when employees report an email they receive a short reply.
Technical support
Training does not replace technology. Useful are a mail filter, multi-factor authentication so stolen passwords alone are not enough, and restrictions on macros and risky file types. Together with permission concept and backup this creates protection that holds even when someone clicks.