Phishing remains one of the most common ways attackers get in, because it targets people rather than software. A message that looks like it came from a colleague, a supplier or a familiar service persuades someone to click a link, open an attachment, share a password or pay a fake invoice. No single defense stops all of it, so the sensible approach is layers: technical controls to filter the obvious, habits to catch the rest, and a plan for when something slips through.

How Phishing Actually Works

Most phishing relies on a few psychological levers: urgency (“your account will be closed today”), authority (“this is from the director”), curiosity or fear, and familiarity. The goal is usually one of three things: stealing credentials through a fake login page, delivering malware through an attachment or link, or tricking someone into a payment or data transfer, often called business email compromise.

Variants include targeted spear phishing aimed at specific people, text message and phone versions, and messages sent from genuinely compromised accounts, which are the hardest to spot because they come from real senders.

Layer One: Technical Controls

Your email platform can stop a lot before it reaches anyone’s inbox. Review the current documentation for your provider and check that these are enabled:

• Spam and malware filtering at the highest sensible setting, with attachment scanning.
• Sender authentication for your own domain, using the standards known as SPF, DKIM and DMARC. These make it harder for attackers to impersonate your address, and help receiving servers trust your legitimate mail.
• External sender warnings that label messages originating outside your organization.
• Link and attachment protection that checks destinations at click time, where offered.
• Multi-factor authentication on every account, so a stolen password alone is not enough.

Also keep browsers and operating systems updated, since some attacks exploit known flaws.

Layer Two: Human Habits

Awareness training works best when it is short, specific and repeated, not an annual lecture. Teach people to pause on any message that asks for something unusual and to verify through a separate channel. Useful habits include:

• Hover over links to inspect the real destination before clicking.
• Go directly to a service’s website instead of following a link in a message.
• Be suspicious of unexpected attachments, even from known senders.
• Confirm payment changes and urgent requests by phone using a number you already have.
• Never share one-time codes or passwords, whoever asks.

Layer Three: Make Reporting Easy and Safe

People will only report suspicious messages if it is quick and nobody is blamed. Provide a single, obvious way to report, such as a report button or a dedicated address. Thank people for reports, including false alarms. Fast reporting lets you warn others and remove the message from every mailbox before more people see it.

Warning Signs Worth Teaching

Warning sign	Example	What to do
Urgent pressure	“Act within the hour or lose access”	Slow down and verify independently
Unexpected request	Gift card or payment change from a manager	Confirm by phone or in person
Mismatched sender	Display name familiar, address odd	Check the full address
Suspicious link	Link text differs from real destination	Do not click; visit the site directly
Unexpected attachment	Invoice you were not expecting	Verify with the sender through another channel
Request for credentials or codes	“Confirm your password”	Never share; report it

Remember that polished messages exist, so absence of obvious flaws is not proof of safety.

A Realistic Example

Imagine a hypothetical thirteen-person property management firm. An administrator receives an email that appears to come from the owner, asking her to update the bank details for a regular supplier before an urgent payment. The tone is rushed and the sender address differs by one letter, which she does not notice. However, the firm’s policy says any change to payment details must be confirmed by phone using a number from the existing records. She calls the owner, who knows nothing about the request. She reports the email using the report button, and the IT contact removes the same message from the other mailboxes within minutes. A single procedural rule, not a clever filter, prevented a fraudulent payment.

When Someone Clicks Anyway

Assume it will happen eventually, and rehearse the response so nobody hesitates out of embarrassment.

1. Report immediately. Speed matters more than perfection.
2. Disconnect if malware is suspected, by turning off the network connection instead of just closing the window.
3. Change passwords for any account whose credentials may have been entered, from a clean device, and revoke active sessions where possible.
4. Check for damage: forwarding rules added to the mailbox, unusual sign-ins, unexpected approvals or new devices registered for MFA.
5. Scan the device and rebuild it if you cannot be confident it is clean.
6. Record what happened and what you learned, then improve the controls.

If personal or regulated data may have been exposed, notification duties can apply and vary by jurisdiction, so consult a qualified professional promptly.

Measuring Progress

Simulated phishing exercises can reveal how people respond, but use them to educate, not to punish. Track the reporting rate more than the click rate: a team that reports quickly is a team that contains problems. Review the results every few months and adjust your training and filtering accordingly.

Frequently Asked Questions

Can filters catch all phishing? No. Filters block a large share of the obvious attempts, but targeted and compromised-account messages can still arrive, which is why habits and reporting matter.

Is phishing training worth the time for a tiny team? Yes, in short form. A few short sessions each year, plus real examples shared when they appear, build useful instincts at low cost.

What about phishing by text message or phone call? The same principles apply: do not act on urgent unsolicited requests, and verify through a channel you already trust before sharing information or money.

Does multi-factor authentication stop phishing? It stops many credential-theft attempts, but some attacks capture one-time codes or approvals. Phishing-resistant methods such as hardware keys and passkeys offer stronger protection.

Should we punish employees who fall for phishing? Generally no. Punishment discourages reporting, which makes incidents worse. Focus on quick reporting and improving the system.

Next Step

Confirm that multi-factor authentication and external sender warnings are enabled, then establish a single reporting method and announce a rule that payment changes are always verified by phone.