🎣 Stuff Everyone Should Know About Phishing & Scams: Training Guide

Phishing is social engineering

Phishing is a trick that makes you reveal information or take a harmful action by pretending to be a person or company you trust.

Social engineering uses human trust, urgency and helpfulness instead of only attacking software.

Spearphishing targets one person, company or industry with details that make the message feel personal.

Voice phishing, called vishing, uses phone calls or voicemail to pressure you to act fast.

Warning signs that push you to act

A phishing message often creates fear or excitement so you react quickly. An urgent threat demanding instant action is a red flag.

Scammers say you have a limited time to respond, such as within 24 hours, or threaten a fine. That urgency sign is one of the NCSC's five signs.

Scarcity uses only a few left offers like concert tickets, money or a cure for a medical condition.

Authority, emotion and current events can also make a fake message feel real.

Modern phishing can look perfect

Scammers now use tools that polish writing, so perfect spelling and grammar do not prove the message is safe.

Misspelled domains, like amazan, can still appear in links or sender addresses.

A slightly wrong logo or an unexpected attachment is another phishing clue.

Verify through a channel you know

If a text says your bank account is locked, do not tap the link. Contact the bank using a phone number or website you already know is real.

Real companies will not email or text a link to update your payment information. Contact the company yourself if you think the problem is real.

Do not reply to a text that asks for your account details. Real companies do not ask for account information by text.

Ask yourself whether you even have an account with the company. If not, the message is likely fake.

Common phishing red flags

Scammers register names that look right at a glance, like amazan instead of amazon. Read the whole address letter by letter.

A short link hides the full web address, so you cannot judge the destination before clicking. Treat short links from unexpected messages with suspicion.

Fake invoices and messages about payments you never made try to get you to click to dispute or pay.

Unexpected attachments can install harmful software, even when the email appears to come from someone you recognize.

A generic greeting is one common sign of a phishing email.

Report and delete

The FTC says to forward phishing email to the Anti-Phishing Working Group. At work, tell your IT or security team too.

Forward scam text to 7726 (SPAM). Your wireless provider can spot the scam and block similar texts.

In Outlook, select the message and choose Report, then Report phishing. In Gmail, use the More option beside Reply to report phishing.

Do not click an unsubscribe link in a suspicious email. Delete it and report it if you can.

CISA says phishing training should be repeated at regular intervals because scams change.

The padlock is not a character reference

A padlock and https mean the connection between your browser and the site is encrypted, not that the site is honest.

Most websites now scramble information, so the FTC says public Wi-Fi is usually safe. Look for a lock or https, but still check the address.

A scammer can put a lock on a fake site, so encryption does not mean you should sign in without checking.

QR codes can hide the destination

QR code phishing is called quishing. A QR code hides the web address inside an image, PDF or Word file, so you cannot read it before scanning.

Scammers have put their own QR stickers over real ones on parking meters. A fake site can steal whatever you type.

If an unexpected email or text contains a QR code asking you to sign in, do not scan it. Contact the company with a trusted number or site.

After scanning a QR code, inspect the previewed web address for misspellings or a switched letter before opening the link.

Check the address before you type

Before you type any personal or payment information, look at the web address for misspellings or a switched letter.

A wrong domain may swap .gov for .com or contain misspellings.

Use a known bookmark or official app instead of a suspicious link or QR code.

Caller ID and robocalls

Scammers can fake the displayed name or number on caller ID. The name for faking caller ID is spoofing.

If an unwanted sales robocall offers a button to stop calls, hang up without pressing buttons. Pressing buttons can lead to more robocalls.

A caller who says you won a vacation but must pay a fee first is running a prize scam. A real prize does not require payment to collect it.

Tech support scams and pop-ups

A pop-up that says Microsoft Alert: Virus found! Call this number now is fake. Real Microsoft warnings never include a phone number.

A fake tech support caller wants remote access to your computer. With that access they can see your screen, steal passwords and install malware, then charge for fake repairs.

If someone calls claiming to be Microsoft Support, hang up. If someone claims to be Apple Support and asks for your password or verification code, just hang up.

If you already let a fake tech support caller into your PC, uninstall their apps, run a full scan, change passwords and tell IT.

A fake virus pop-up can trap the browser. Use Task Manager to end the browser task instead of clicking inside the pop-up.

The FBI warns about the Phantom Hacker script: a fake tech support agent, then a fake bank, then a fake government agent all tell you to move money to a safe account. Hang up.

AI voice and video impersonation

Scammers can copy a voice from a short clip posted online, so a familiar voice is not proof. Hang up and call the real person on a number you already have.

The FBI suggests creating a secret word or phrase with your family to verify identities during a scary call. At work, use a callback rule for money requests.

Criminals can also fake real time video of executives. For money or data requests, confirm through a second channel you trust.

Never share a two-factor code sent to you, even if the caller claims to need it. Those codes prove you are you.

AI-generated audio is often difficult to identify. Verify who is calling by finding the number yourself and calling back.

Gift cards are for gifts, not payments

No real business or government agency will ever tell you to buy a gift card to pay them. Anyone who asks for the numbers off the back of a card is a scammer.

Gift cards work like cash. Once the codes are gone the money is gone, so scammers posing as tech support, utilities, prize offers and relatives all ask for them.

A robocall offering a discount on your phone or TV bill if you pay with gift cards is a scam. Real providers do not take gift cards for bills.

Boss requests and gift card recovery

A text from your boss asking you to buy gift cards for clients is likely a scam. Check with your real boss first using a known number.

If you already sent gift card codes, report it to the card company right away and ask for a refund. Keep the card and the store receipt.

Thieves can copy codes from cards on a rack before you buy them. Check the package for signs of tampering before you load money.

Fake checks and payment pressure

Money can appear in your account before a fake check actually clears. It can take weeks for the bank to discover a check is fake, and then you owe the bank.

Anyone who insists you can only pay by wire, crypto, a payment app or gift card is probably a scammer. A credit card gives more protection because you can dispute charges.

In July 2026 the FTC said people reported losing more than $4 billion in the prior year to scams paid by bank transfer or crypto.

Romance scams

An online sweetheart you have never met may build trust, invent an emergency and ask for money. Never send money or gifts to a sweetheart you have not met in person. Stop contact and report the profile.

Prize scammers may call a required fee taxes, registration or shipping. A real prize does not require payment to collect it.

What BEC is and why it works

Business email compromise is a sophisticated scam that targets businesses that often work with foreign suppliers or do wire transfers.

Attackers pick companies that move money often because a fake request hides in the normal flow.

In 2025, the FBI's IC3 report listed BEC losses of about $3.05 billion. Only investment fraud cost victims more.

Common BEC requests

An email may include an invoice you do not recognize and ask you to click to pay. The invoice is fake and the link may carry malware.

A vendor may email new bank details for the next payment. If the attacker controls the email, replying to it only reaches the attacker.

An email from an employee may ask HR to change their direct deposit account. HR should confirm any bank change in person or by phone on a known number.

A fake boss text may ask you to buy gift cards for clients and send the codes. Check with the real boss first using a known number.

Verify and respond

Use a phone number you already have to verify requests for account changes. A secondary channel reaches the real vendor or boss.

In Outlook, an External label shows the message came from outside your organization. If it claims to be your boss or coworker but carries the tag, stop and check.

If you wired money to a fraudster's account, call your bank right away and request a recall. Speed matters. Then file a complaint with the FBI, no matter the amount.

In 2025 the FBI IC3 Recovery Asset Team helped freeze about $679 million, a 58% success rate.

Long, unique passwords

A strong business password should be at least 16 characters long, according to CISA. Use a different password for every account.

When a password is the only login factor, NIST says it should be at least 15 characters. With multi-factor authentication, the minimum drops to eight.

NIST says do not force people to use special symbols, capital letters or periodic changes. Those rules lead to weak, guessable passwords like Password1!.

Login pages should allow paste so password managers can fill long random passwords. Blocking paste pushes people to choose short ones.

The NCSC suggests combining three random words to make a strong, memorable password. The words must be random, not a quote or something about you.

The FTC says posting passwords near a workstation should be against company policy. Change default passwords on new routers or apps right away.

Add a second factor

A password alone is not enough. Add a second factor, such as a text code, an authenticator app or a passkey.

Text message codes are vulnerable to phishing and SIM swap attacks, but any two-step verification is better than none. Turn it on when that is all the account offers.

Phishing-resistant MFA is the gold standard. The only widely available phishing-resistant sign-in method is FIDO/WebAuthn, which includes passkeys and security keys.

Push bombing, also called MFA fatigue, floods you with prompts until you tap Accept. If you did not sign in, deny and report it.

With number matching in Microsoft Authenticator, you enter the number from the sign-in screen. That prevents approving a prompt you did not start.

Never share a two-factor code sent to you, even if someone claims to need it.

Password managers and passkeys

A password manager only autofills your password on the real website. On a lookalike phishing site it stays blank, which is a warning.

A passkey is a cryptographic key stored on your device and unlocked with your fingerprint, face or PIN. There is no password to type, so a phishing page has nothing to capture.

WebAuthn binds a credential to its RP ID. A different domain cannot ask the authenticator to use that credential, so a fake login page gets nothing.

If a scammer got your password, change it everywhere you reused it. If you entered a password on a phishing page, change passwords on affected accounts and make sure MFA is on.

Update and protect your devices

Install software updates even when you do not want new features, because updates can fix security weaknesses. Turn on automatic updates so fixes arrive promptly.

CISA says to install all updates, especially for web browsers and antivirus software. Install them as soon as possible.

Lock employee computers after inactivity with password-activated screen savers. On Windows, Windows key + L locks the PC instantly.

Shoulder surfing is when someone watches your screen as you type a password. Turn your screen away in public and stay aware of your surroundings.

A simple app may ask for contacts, photos and location it does not need. Deny unneeded permissions or delete the app.

Be careful with AI chat tools. Microsoft enterprise data protection does not train foundation models, but Google says some consumer AI chats may be read by human reviewers. Do not enter confidential information.

Physical safety, USB drives and lost devices

Never leave files or devices holding sensitive data unattended. Sensitive paper should be kept in a locked file or cabinet.

Laptops and flash drives should use encryption if they store sensitive data. BitLocker helps protect data on lost or stolen Windows devices.

A work laptop should never be left visible in a parked car. Keep it with you or locked up.

If you lose an Android phone and erase it, the phone asks for your Google Account password before anyone can set it up again. On Apple devices, Lost Mode locks the device so others cannot access your information.

Every employee should know what to do if a device or file goes missing.

Do not plug in an unknown USB drive. Hand it to IT or security without plugging it in. Keep personal and business USB drives separate.

Network and cloud sharing

Public Wi-Fi is usually safe because most websites use encryption, but a lock does not mean the site is real. Check the address.

Before choosing a VPN app, check whether it encrypts and shares your data. A VPN sends your traffic through its own servers, so research the app first.

A router has two passwords: the Wi-Fi password and the admin password for changing settings. Change both from the factory defaults.

Use a guest account for visitors so your main Wi-Fi password stays private.

SharePoint and OneDrive Anyone links let anyone with the link open the file without signing in. Use Specific people links for confidential files and set expiration dates for temporary access.

If admins turn off external sharing, guests typically lose access within one hour.

Malware, backups and reporting

Keep offline, encrypted backups of critical data. Test their availability and integrity regularly. Many ransomware variants try to delete or encrypt backups they can reach.

Protect your online backups by turning on 2-step verification. Use online storage and an external device together to create two backups.

Do not expose remote desktop protocol directly to the internet. Put remote access behind a VPN or secure gateway with multi-factor authentication.

If you clicked a link and may have installed software, update security software, run a scan and remove problems. Tell your IT person right away.

If a scammer got your Social Security or bank account number, use the FTC identity theft recovery site for a plan and tell your employer if work data was involved.

Review who has access to important accounts every few months. Keep only the customer information you need and have a plan to respond to incidents.

Security awareness training should cover guarding against, detecting and reporting malicious software. If you see an unusual sign-in alert, check your Recent activity page and choose This wasn't me if it was not you.