In 2020 I ran a phishing attack on camera, from the attacker's chair and then from the victim's, to show how little it takes to give away a password.
Afterward we wrote down the signs that would have stopped it. The tools have changed since then. The signs have not.
A new sender plus a request to act is the shape of almost every phish. Do not reply to the email to check; the attacker answers replies. Call the person, or walk over.
An extra letter, a missing one, .co instead of .com, a dash where there was none. We read words as shapes, and the attacker knows it. Read the address letter by letter.
Your account will close, the payment will bounce, the boss needs it before the meeting. Urgency exists to stop you thinking. Slow down, and look for the other signs.
On a computer, rest the pointer on it and read the real destination. On a phone, press and hold. If you want the real site, type its address yourself or use your bookmark.
Where a message really came from is in its headers, and a sending address can be faked with characters that look like English letters and are not. Send the message to us and we will read them.
Look at the address bar before you type anything. If the address is not the service you expected, close it. Real services rarely email you a sign-in link out of the blue.
Attackers copy a sign-in page once and use it for years. If it looks dated, it is a copy.
A warning from the browser is a stop sign. The reverse is no longer true: the lock icon only means the connection is encrypted, and attackers have certificates too.
That blip was the handoff. The fake page took your password and sent you on to the real one so you would not notice. Change the password now, from a device you trust, and tell us.
Do not forward it around the office. Send it to us, and if you typed a password anywhere, say so in the first sentence. People are only in trouble for the one they kept quiet about.
Short, regular training is in every plan, with messages like these sent to your own people so the first phish they fall for is ours. Security awareness training.
