Pause before you trust an urgent message

A familiar name does not prove a message is genuine. Attackers impersonate managers, suppliers, and banks to push people into opening files, signing in, or sending money.

• Verify unusual requests. Call a number you already trust, rather than one included in the message.
• Open services directly. Use a saved bookmark or the official app instead of an unexpected login link.
• Report suspicious messages. Let your IT team know, especially if you opened an attachment or entered credentials.

One action today: Agree how your team will independently verify payment and bank-detail changes.

Source: NIST — Phishing