Phishing Awareness for Employees: How to Spot and Stop Fake Emails, Messages and Calls

Most cyber incidents in small and mid-sized businesses start with a single message: a fake invoice, a password reset that is not real, or a call pretending to be the bank. Firewalls and antivirus help, but trained employees are the strongest defence against phishing.

1. Common warning signs

• Urgency or fear: “your account will be blocked today”, “pay this invoice immediately”.
• Sender addresses that look almost right but are slightly misspelt.
• Unexpected attachments, ZIP files or links to log in.
• Requests to change bank details for a vendor or to buy gift cards.
• Calls or messages asking for OTPs, PINs or passwords — genuine banks and services do not ask for these.

2. Check before you click

Hover over links to see the real address, open websites by typing the known address yourself, and verify payment or bank-detail changes by calling the person on a number you already have — never the number in the message.

3. If someone clicks

• Disconnect the device from the network and inform IT immediately.
• Change passwords from a clean device and enable multi-factor authentication.
• For financial fraud, contact the bank at once and report on the national cybercrime portal or helpline 1930.
• Do not hide mistakes — fast reporting limits damage.

4. Build a phishing-aware culture

Run short training sessions every quarter, share real examples, and consider safe simulated phishing exercises. Make reporting easy with a single email address or button. Combine training with technical controls such as email filtering, SPF, DKIM and DMARC — see our guide to domain and business email setup.

5. Get help

ATTPL IT helps businesses with security assessments, email protection and staff awareness. Data protection obligations are explained in our DPDP Act 2023 guide, and you can contact ATTPL for group IT support.

Frequently asked questions

What is phishing?

A fraud where attackers pretend to be a trusted person or organisation to steal passwords, money or data, usually through email, SMS, WhatsApp or calls.

Where can cyber fraud be reported in India?

On the National Cyber Crime Reporting Portal (cybercrime.gov.in) or by calling helpline 1930.

How often should staff be trained?

Short refreshers every quarter work better than one long annual session.

This article is general information. Security needs differ by business; get a professional assessment for your environment.