Phishing messages borrow familiar cues from working life. A purchase order, a manager’s request or an invitation to view a file can all prompt a quick action. The examples below show where a team can pause and verify the request.
Why are phishing attacks so common?
A plausible message can reach someone who already has the access an attacker wants. A request to change a supplier bank account can look like routine work, especially near a payment deadline. Checking the change through the supplier contact already on file protects the payment even if the email looks convincing.
The role psychology plays in a phishing attack
A message can combine several techniques. An apparent request from a director carries authority. A short deadline adds urgency. Pick a known contact route and verify the underlying business action before following a link or sharing data.
An unusually generous reward
“Get a £500 Amazon voucher when you give us your feedback”
What would you do next? Pause before opening the voucher link. Check the offer through a contact or website you already trust, using details obtained independently of the message. Use your organisation’s usual phishing reporting route. If someone has already clicked, thank them for speaking up and ask when it happened and whether they entered information so their internal team can respond.
A reward draws attention to the benefit and away from the sign-in page behind it. Familiar branding or a known supplier’s name can make the offer feel credible.
A familiar routine
“Please see attached the July Sales Report”
A regular report arriving at its usual time can make an unexpected attachment easy to overlook. Open the report through the workspace normally used to share it.
A senior person’s authority
“I need you to action this right away”
A message that appears to come from a director can make a request feel authorised. Apply the usual approval or callback even when the sender appears senior.
Fear of a mistake
“Your section of the bid document is wrong and we have to submit it before the end of the day”
An apparent error on a deadline creates pressure to open a document quickly. Ask the colleague responsible for the bid through the existing project channel.
Good news
“Pay reviews will commence next month, make sure you have provided us with your achievements for the year”
A pay review can make an employee eager to open an unfamiliar form. Check the announcement through the usual HR system before entering information.
Curiosity about confidential news
“This acquisition announcement is embargoed until 7am tomorrow”
A promise of early access can encourage someone to open a file they would normally question. Verify the sender through a known channel before following the invitation.
Protecting your teams from phishing attacks
Practice should make it easier to ask for verification and report a mistake early. Compare the time to first report and the reporting rate across similar exercises. If nobody reports, ask whether the route was easy to find. The NCSC phishing guidance explains how to recognise suspicious messages and what to do after sharing information.
Plan recurring simulations and coaching for your team.
Explore managed phishing and awareness training ↗
