Treat the request as the risk
A suspicious message is easier to assess when attention moves from its appearance to what it asks someone to do. Does it request credentials, an urgent payment, a change of bank details, or the installation of unfamiliar software? Polished language and familiar branding do not establish legitimacy.
The same principle applies across email, chat, text messages, and QR codes. Training should give people a small set of useful decisions, rather than asking them to memorise every possible appearance of a malicious message.
Separate verification from the message
Sensitive requests should be confirmed through a channel the recipient already trusts. For a supplier bank-account change, use a known telephone number or an established approval workflow. Replying to the original message only returns to the same uncertain source.
Make these checks an ordinary part of the process so employees do not have to choose between being helpful and being cautious. Clear rules also protect staff from pressure based on hierarchy or urgency.
Reduce what a stolen credential can do
Use strong authentication appropriate to the service, restrict privileged access, and review permissions regularly. Keep administrative accounts separate from everyday email and browsing where practical. A single compromised account should not automatically expose every system.
Technical controls and training support each other. Mail filtering, cautious handling of attachments, and reliable account-recovery procedures matter, but no single control removes the need for a response plan.
Make reporting quick and constructive
Provide a simple reporting route and explain what happens next. People should be able to report a mistake without waiting to prove that an incident occurred. Preserve the suspicious message and its context for the responding team.
When reviewing an exercise or incident, look beyond click rates. Consider how quickly the message was reported, whether a payment control worked, and how long it took to contain affected access. Use those observations to improve the process rather than to shame individuals.