An urgent supplier email? Verify before you act

Consider a fictional example: a regular supplier emails an urgent request with an attachment. The displayed name looks familiar. Before opening the file or following the link, staff need a verification method everyone understands.

Recognise when to pause

Phishing includes impersonating a trusted contact to obtain information or prompt an action. Urgency, an unexpected document or an unusual address should attract attention. Good spelling and a familiar logo do not establish authenticity.

Examine the full sender address and the context: were you expecting this document? Does the request match an existing order? If unsure, do not use the supplied link to sign in to email or a customer portal.

Use an independently known channel

Call your contact using the number already in your directory, rather than the one in the suspicious message. Open a portal through your usual bookmark or its known address. Replying to the received email is not an independent check.

In our example, the person handling the request records one of two outcomes: confirmed by the usual contact, or awaiting confirmation. The case remains visible to a colleague taking over.

Give staff a clear rule

• A designated internal contact receives reports.
• Unusual requests remain on hold until verified.
• Nobody needs to share a password or sign-in code to justify a concern.
• Prompt reporting is encouraged, including after a mistake.

If a password has already been entered on a suspicious page, alert support immediately and change it through the official service, with help if needed. Keep the message for investigation. If an attachment was executed, report that too: the response must account for what happened.

A simple exercise without tricking employees

Present a fictional message during a team meeting. Ask who each person would contact, which number they would use and where they would record the answer. The expected result is a usable procedure, not a contest to spot a spelling mistake.

An assessment of access and working practices can help make this habit part of your business routine.