The invoice that was not an invoice. The courier message that was not from a courier. The boss asking for gift cards at midnight. Phishing reaches every inbox, so the goal is not a perfect staff that never gets fooled - it is an office that spots most attempts and reports the rest fast.
Most small-office breaches do not start with a technical masterstroke. They start with an email someone trusted. Modern phishing is polished: correct logos, real company names, and messages timed to arrive when the accounts person is busiest. Telling staff to just be careful is not a strategy. What works is recognition training on real examples, a no-blame reporting habit that surfaces clicks within minutes instead of weeks, and a couple of technical settings that quietly remove the worst of it before it lands. This page lays out all three, honestly - including why fear-based training and trick tests usually backfire.
Forget spotting bad grammar; modern phishing reads better than most real email. The reliable signs are about behaviour, not spelling: a sender domain that is almost but not quite right, urgency and deadlines designed to stop you thinking, requests that break normal process - bank details changed by email, gift cards bought in secret, a password page linked from a message.
The strongest office rule is simple and memorable: money and passwords never change because of an email alone. Any request to change where money goes gets verified on a phone number you already have, never one printed in the suspicious message itself.
The speed of your response decides how much a successful phish costs you. If staff hide a click because they fear punishment, the attacker gets days inside the mailbox. If reporting is praised and takes thirty seconds, you get a password reset and an MFA check done within the hour.
Give everyone one obvious route - forward the message to the owner or IT person, or use the report button if your mail system has one - and thank people publicly when they report, including when they report after clicking. Especially then.
When a click or credential entry is reported, the routine should be boring and identical every time: change that account password from a clean device, review and revoke active sessions, confirm MFA is on, check mailbox rules for silent forwarding the attacker may have added, and warn staff if the message is circulating.
The mailbox-rules check is the step offices miss. Attackers who get into a mailbox often add a rule that forwards or hides mail about payments, so the compromise quietly continues after the password change. Looking for rules you did not create is a two-minute check that closes the back door.
People are the last line, not the only line. Keep your mail provider spam and phishing filtering on, turn on attachment scanning, and use the safe-links or safe-attachments features if your plan includes them. On the PCs, a DNS filter that blocks known phishing domains catches some clicks even when a person is fooled.
Also publish the simple domain protections for your own domain - SPF, DKIM and DMARC - so attackers cannot as easily send mail pretending to be you to your customers. Your mail provider documents these; they are one-time settings that protect your reputation as much as your inbox.
Every essential in this guide is explained with full knowledge and installation in the IT Security Essentials video.
Watch Full VideoReport it immediately and change the password from a different, trusted device. Then the person handling IT should revoke existing sessions, confirm MFA is enabled, and check the mailbox for forwarding rules the attacker may have planted. Speed matters more than embarrassment - report first, always.
No. Filters remove a large share of it, which is valuable, but well-made targeted messages get through every filter sometimes. That is why the human layer - recognition and fast reporting - is treated as a real control in this guide, not a slogan.
Use real examples. Once a month, spend ten minutes in a normal team meeting showing one real phishing mail that arrived at your office or is circulating, and point out the signs together. Short, regular and real beats an annual video nobody remembers.