Key takeaway
A familiar name or logo does not prove who sent a message. If it asks for money, a password, a multifactor authentication (MFA) approval or sensitive information, verify it separately without using the message’s link or contact details.
Executive, supplier and payment impersonation
An attacker posing as an executive or supplier may request a transfer, gift cards or a bank-detail change. Even a genuine mailbox may be compromised. Verify through a previously known channel rather than the message’s contact details, and follow normal approval procedures. Checking unusual payment requests:
| Request | What to verify | Safe channel |
|---|---|---|
| Supposed executive transfer or gift cards | Authority and normal approval | Known internal contact |
| Supplier bank-detail change | Genuine change and second approval | Contact already in supplier records |
| Unexpected invoice | Expected purchase and receipt of goods or services | Existing purchasing records or contact |
Fake sign-in pages and malicious attachments
A link in a document share, voicemail or password notice may lead to a fake sign-in page. Check the domain, not just the logo; open the known official app yourself to reach a work account. Verify an unexpected invoice, résumé or archive with the sender through a separate channel. Stop and follow your organization’s approved IT process if a message asks you to enable macros, install software or enter a password.
QR codes, text messages and other channels
A QR code delivers a link; the code itself is not proof of fraud, but may conceal the destination. Do not scan an unexpected code to verify a work account or set up MFA. Smishing is phishing through SMS; similar requests can arrive through messaging apps and social platforms. An attacker posing as IT support may ask you to install remote-access software or reset MFA. Verify through a known support channel. Familiar photos and job titles do not prove identity.
Check before you act
Check the full sender address, link domain and whether the request fits the work context. A rushed deadline, secrecy or a request to bypass normal approval is a warning sign; polished writing does not make a message trustworthy. Report it with your organization’s phishing-report button or official support channel. If you already opened a link, entered a password or approved an MFA prompt, notify IT immediately.