System Security / Foundations
Pause before you trust an urgent message
A familiar name does not prove a message is genuine. Attackers impersonate managers, suppliers, and banks to push people into opening files, signing in, or sending money.
Environment and inputs: A fictional suspicious message and a trusted contact directory. Do not send the message, open links or make a payment during the exercise.
A familiar name does not prove a message is genuine. Attackers impersonate managers, suppliers, and banks to push people into opening files, signing in, or sending money.
- Verify unusual requests. Call a number you already trust, rather than one included in the message.
- Open services directly. Use a saved bookmark or the official app instead of an unexpected login link.
- Report suspicious messages. Let your IT team know, especially if you opened an attachment or entered credentials.
One action today: Agree how your team will independently verify payment and bank-detail changes.
Source: NIST — Phishing