Learning example.example
Hello,
Payment for the attached invoice must be approved today. Open the page below to review the details.
This example link is inactive and collects no information.
Security guide · Recognize and report
How to recognize and safely report phishing
A phishing message may look urgent and convincing while its sender, link or request does not fit the work context. This guide covers what to check before acting and what to do after an incident.
Learning example
Exercise: inspect a suspicious email
This is a learning example. Review the message cues, then compare reporting it with opening its link.
How would you respond?
Safe choiceSafe choiceWhat happens after your choice
Good choice: you reported the suspicious message
Reporting is the safe response. You chose the right step in this exercise; the purpose is to teach, never to shame employees.
Key takeaway
Do not decide from a single clue. Consider the sender, domain, expected process and requested action together; if in doubt, verify without using the message’s links or contact details.
Check the sender and message context
Do not rely on the display name; check the full sender address and domain. Unexpected urgency, a request for secrecy, or a request for a password, MFA code, money or personal information deserves scrutiny. Familiar writing and correct grammar do not prove a message is genuine; templates and AI can produce polished text. Consider several signals together.
Assess the link, attachment and requested action
If a safe link-preview feature is available, use it to inspect the domain without following the link. Otherwise, do not test the suspicious link: open the known official app or service independently. Do not open an unexpected file or upload a confidential attachment to a public checking site. Verify requests for passwords, MFA approval or payment-detail changes through a separate, previously known channel.
Report a suspicious message
A timely report helps the security team investigate similar messages and take action for other recipients. Use your organization’s approved reporting process.
Stop interacting
Do not reply, open the link or file, or scan the QR code.
Use the approved reporting channel
Use the mail client’s phishing-report control or a known support or security channel.
Submit the message as instructed
Follow the approved handoff process; do not forward the message broadly to colleagues.
If you opened a link, report it quickly
Do not hide a mistake: reporting quickly helps the response. Opening a link alone does not establish that a device is infected; the response team will decide what to do next.
Report immediately
Report immediately through the known IT and security channel without concealing the mistake.
Describe what happened
Say whether you opened a link, opened or ran a file, entered a password, approved MFA, or sent information or payment. Do not resend passwords or codes.
Follow the response team’s instructions
Authorized responders decide password-reset, session and device actions. Payment issues are coordinated with finance and the bank under the organization’s plan.
Combine organizational safeguards
Email filters help detect malicious messages, while domain authentication helps counter sender-domain spoofing; it does not identify every message from a compromised genuine account. Use multifactor authentication (MFA) for accounts with access to important data and choose a phishing-resistant method where available: not every MFA method is resistant. Grant only necessary access and do not email passwords or codes. Endpoint protection may alert on files and processes, while payments and data sharing still need separate verification.