In short
Most cyber attacks start with an email. Check the sender's real address, be suspicious of urgency and unusual requests, hover over links before clicking, and report anything odd. If someone clicks, report it straight away.
Why phishing matters
Phishing emails try to trick people into clicking a link, opening an attachment, entering a password or sending money. They're the most common way attackers get into businesses, because it's easier to fool a person than break through a firewall.
The warning signs
Urgency or pressure: "your account will be closed today" or "pay this invoice now".
A sender address that doesn't quite match, such as a misspelt company name or a free email account pretending to be a supplier.
Unexpected attachments or links, especially to shared documents you weren't expecting.
Requests to change bank details, buy gift cards or keep something confidential.
Login pages that look right but have an odd web address.
Generic greetings, or a message that's out of character for the person it claims to be from.
Simple habits that help
Hover over links to see where they really go. Check payment or bank detail changes by phone, using a number you already have. Never enter your password from a link in an email; go to the site directly. When in doubt, ask.
What to do if someone clicks
Don't panic and don't hide it. Report it to your IT support straight away. Change the password for any account that was entered, and let IT check the device. Quick reporting can turn a potential breach into a non-event.
Layers of protection
Staff awareness works best alongside email filtering, multi-factor authentication and security monitoring. Nexa SecureIT provides cyber security awareness training and managed security for businesses across Glasgow and the Central Belt.