Stop. Check. Report.

What phishing really is

Phishing is a message pretending to be someone you trust, trying to get you to do something that helps an attacker. The disguises change constantly — the ask never does.

Watch for these four common requests. Attackers may also ask for confidential documents or personal information:

"Too small to target" is a myth

Attackers run automated campaigns hitting thousands of businesses at once. Nobody has to choose us — being on the internet is enough.

• Real money moves through real accounts — payroll, vendor payments, client funds.
• Small teams mean fewer layers — often one person controls payments or IT.
• Our inboxes are the prize — invoices, wire details, client documents, and trusted relationships an attacker can impersonate.

Anatomy of a phish

Below is a fictional example of a common phishing lure. The controls are safe training buttons, not real email links. Tap or click the parts that look suspicious. There are 4 to find — 0 of 4 found.

Urgency is a weapon

Many scams manufacture a reason you cannot wait. Taking time to verify through a trusted channel can interrupt the attack.

• "Within 24 hours" · "immediately" · "final notice"
• "Are you at your desk? I need this handled quietly."
• Fear ("account suspended") or reward ("refund waiting")

Who is this really from?

Level 1 — Display name games

"Sarah (CEO)" can be typed by anyone. Always check the actual address — on mobile, tap the name to reveal it.

Level 2 — Lookalike domains

micr0soft.com (zero for O) · rnicrosoft.com ("rn" for "m") · company-billing.net (plausible extras).

Level 3 — The hard one: real address, hacked account

A vendor's genuine mailbox gets compromised, and the phish arrives from their real address, mid-conversation, in a real thread.

Never let the message choose your route

• Inspect the destination without opening it — hover on a computer or use your phone’s link-inspection controls. Avoid loading a page preview. When uncertain, use the official app or a trusted bookmark.
• Unexpected attachment? Verify with the sender first — even a known contact. A quick call or Teams message.
• A QR code is another way to open a link. Legitimate codes exist, but unexpected login or payment requests need independent verification. Do not open a destination just to inspect it.

The Big Four — always verify first

The request type, not the message's appearance, determines the risk. Highest alert whenever a message asks you to:

These four earn the 30-second check every time — even if the email looks perfect, even if it's from the boss, and especially if it's urgent. This check matters even when the message has no spelling or design mistakes. Also verify requests for confidential business or personal data.

Same scams, different doors

Well-meant instincts that make it worse

• Don't reply — even to ask "is this real?" You'd be asking the attacker, and confirming your address is live.
• Don't verify using contact info inside the message — that "helpful" phone number belongs to the scammer. Use numbers you already have.
• Don't forward it around the office — that just gives the phish more chances to be clicked. Report it to one place.
• Don't process banking or payment changes from email alone — ever. Voice verification on a known number, no exceptions for deadlines.
• Don't delete it before reporting — the original email is evidence that protects your coworkers.
• Don't click "just to see" — curiosity on a work computer becomes everyone's incident.

If you already clicked: speed beats shame

Anyone can make a mistake — including IT professionals. Reporting quickly helps responders limit the damage. Do not wait for symptoms or hide the message. Even a prompt report may still require incident response.