Poor spelling is no longer a useful phishing filter. A fraudulent message can be polished, specific, and written in the same tone an employee expects from a manager or vendor. Generative AI makes that level of personalization cheaper and faster for attackers.

The answer is not to ask employees to become forensic email analysts. It is to give them a few verification habits that still work when the message itself looks excellent. The most important signals are usually context, process, and whether the request changes something important.

What to focus on first

Slow down when money or credentials are involved

Urgency is a common pressure tactic. A request to move money, share a password, approve an MFA prompt, or open a “secure” document deserves a deliberate second check.

Verify through a second channel

For unusual financial or account requests, contact the person using a phone number, Teams/Slack identity, or other method you already trust. Do not use the contact details contained in the suspicious message.

Check the destination, not just the display name

Look at the actual sender domain and the real web address before signing in. Look-alike domains and convincing login pages are designed to survive a quick glance.

Treat unexpected authentication prompts as an incident

An MFA prompt you did not initiate is not routine noise. Deny it and report it. Repeated prompts may mean someone already has the password.

Make reporting easy

Employees should have a one-step way to report suspicious mail or ask for a second opinion. The safer culture is one where people report early, even when they are unsure.

Common ways this goes wrong

• Teaching employees to look only for spelling errors, generic greetings, or obvious logos.
• Punishing people for reporting a click after the fact; that encourages delay and hides useful information.
• Relying on awareness training without technical controls such as filtering, MFA, and account monitoring.

Make it part of normal operations

Keep the employee side of this simple and frequent. Short reminders tied to real workflows are more useful than a long annual lecture. Reinforce the behavior after onboarding, before predictable high-risk periods, and whenever an incident or near miss shows that the procedure was unclear. Employees should always know where to report a concern and should not have to decide alone whether something is “serious enough.”

Questions worth bringing to your next IT review

• Can we explain how the ‘Slow down when money or credentials are involved’ practice works today without relying on one person’s memory?
• Where do we have exceptions to ‘Verify through a second channel’, and are those exceptions still necessary?
• Who owns the work behind ‘Check the destination, not just the display name’, and what evidence shows it is working?
• How would we discover that this control or process stopped working?
• What business, staffing, vendor, or technology change should trigger another review?

What a solid approach looks like

Good phishing defense combines technology with a verification culture. Filters reduce volume, authentication limits the value of stolen passwords, and employees know which requests require a second channel. None of those layers needs to be perfect for the combination to work well.

If you want to go one level deeper, see Security Awareness Training.

If your organization would benefit from help reviewing the current environment or turning these ideas into a workable plan, Managed Endpoint and Server Protection from CTResources is available as a practical next step. The goal is to strengthen what matters without adding unnecessary complexity.