A phishing-season checklist for your team

By Don Zurbrick · Sample issue

Scammers follow the calendar. Year-end brings more invoices, shipping notices, payroll changes and holiday deals, and every one of those is easy to fake. Here's a checklist you can forward to your team today.

The one thing to do today

Agree on one rule and say it out loud at your next team meeting: any request to change bank details, pay a new vendor or buy gift cards gets confirmed by phone, using a number you already have. Never use the number in the email.

The checklist

Slow down on urgent messages. "Pay today or lose the account" is the oldest trick there is. CISA lists urgent or emotional language as a top sign of phishing.
Check the sender and the link. Look for addresses that are almost right, like an extra letter in the company name. Hover over a link on a computer, or press and hold on a phone, to see where it really goes.
Don't count on bad grammar. AI tools mean a fake email can read perfectly now. Judge the request, not the spelling.
Go to the source. Type the vendor's or bank's address yourself instead of clicking the link in the message.
Report it. Use your email's Report button if you have one, and tell whoever handles your IT. One report can protect everyone else in the office.

If someone already clicked

Change that account's password from a different device.
Turn on multi-factor authentication (MFA) for it if it isn't on already.
Tell your IT person or provider right away. Speed matters more than embarrassment.

Sources: CISA: Recognize and Report Phishing · CISA: Phishing Guidance · Report fraud: FTC, FBI IC3