Why phishing works (and why it keeps getting worse)
Phishing is a type of social engineering: criminals send messages that look legitimate so someone will click a link, open an attachment, or share sensitive information. It works because it targets normal human behaviour — trust, urgency, curiosity, and the desire to be helpful.
The good news: you don't need to be technical to spot most phishing attempts. You just need a consistent routine.
The core idea
Phishing is rarely about “hacking the computer”. It's about persuading a person to do something unsafe. That's why staff awareness training is one of the highest-impact security investments a business can make.
The 10 red flags to teach every staff member
If your team can recognise these red flags, you'll prevent the majority of real-world attacks.
- Unexpected urgency: “Payment needed today”, “Account will be suspended”, “Final warning”.
- Pressure to bypass normal process: “Don't tell anyone”, “Use this new bank account”, “I'm in a meeting — just do it”.
- Sender looks right at a glance, but not on inspection: display name says “Microsoft” but the email address is unrelated.
- Links that don't match the text: hover over the link (or long-press on mobile) and check the real destination.
- Attachments you weren't expecting: especially “invoice” or “payment advice”.
- Requests for passwords or MFA codes: legitimate support teams should never ask for your password.
- Spelling, grammar, or odd formatting: not always present, but still a common clue.
- Too good to be true: unexpected refunds, prizes, or “you've won” messages.
- Login pages that feel slightly off: wrong branding, unusual prompts, or a URL that isn't the real service.
- Anything that creates a “panic click”: fear is a feature of phishing.
The safe verification routine (what to do instead of clicking)
The simplest rule for staff: Never use the contact details provided in a suspicious message.If an email asks you to log in, pay, or change details, verify using a known-good method.
Do this
- • Type the website address yourself (or use a saved bookmark)
- • Phone the person using a number you already have
- • Confirm bank detail changes verbally
- • Ask IT to verify the message before acting
Not this
- • Clicking the link to “check”
- • Replying to ask if it's real
- • Calling the number in the email
- • Forwarding it to colleagues as a warning (without telling IT)
How to train staff (a simple programme that actually sticks)
Training isn't a once-off slideshow. The goal is to build a reflex: pause, verify, report. Here's a lightweight approach that works well for small and mid-sized teams.
- 1) Set one clear rule: if an email creates urgency around money, passwords, or login — verify out-of-band.
- 2) Teach the red flags: use the checklist below as a common language.
- 3) Make reporting easy: staff should know exactly how to report suspicious messages (and feel safe doing it).
- 4) Run short refreshers: 5 minutes monthly beats 1 hour annually.
- 5) Reward the right behaviour: praise reporting, even when it turns out to be a false alarm.
Want help rolling this out?
We can help you tighten email security, set up safe reporting, and train staff in plain English.
Book a security assessment