Most breaches don’t start with sophisticated software. They start with a message that looks ordinary: a notice from the bank, an invoice from a supplier, an urgent request from the manager. Its goal is to get you to click a link, open an attachment or type in a password.
Six signs of a fake message
- Urgency and threats: “Your account will be closed within an hour.” Real organizations rarely pressure you like this.
- A strange sender address: the bank’s name is shown, but the email itself comes from a different domain or has spelling mistakes.
- A link that doesn’t match: hover over it, or long-press it on your phone, and check the real address before opening it.
- A request for sensitive information: a password, a verification code or card details. No bank or serious company asks for these by message.
- An unexpected attachment: a zip file, or a document asking you to “enable content”.
- An unusual request: a manager asking for an urgent transfer by message, or a supplier suddenly changing their bank details.
What to do if a message looks suspicious
Don’t click and don’t reply. Contact the organization directly using a number or channel you already know, not the one in the message, then tell the person responsible for IT in your company.
And if you’ve already clicked?
- Change the password immediately from another device, and turn on two-step verification.
- Disconnect the device from the network if you downloaded or installed a file.
- Tell your IT team right away; the first minutes make a big difference.
The best protection: a team that knows
Technology alone isn’t enough. One trained employee can stop an entire attack, which is why we recommend short training for your team and simulated phishing emails from time to time.
Want to know where your company stands? We’ll check it for free.
Request the free check