Phishing: How to Protect Your Staff and Your Company

Phishing: How to Protect Your Staff and Company from Fake Messages

Phishing does not need advanced technical skill, only a well-timed message that seems to come from someone you trust. That is why security software is not enough, and every employee needs to know how to spot the trick.

Cloud, infrastructure and security 5 min read

By Nour Aldein Tleti. Updated 7 October 2026.

What is phishing and how do I protect my staff from it?

Phishing is an attempt to trick a person into revealing a password or verification code, transferring money, or opening a malicious file, through a message that impersonates a trusted party. Protection rests on short, repeated staff training, clear rules for verifying payment requests, and two-factor authentication so that a stolen password alone is not enough.

Forms of phishing that reach companies

Email that looks like a supplier’s: An invoice or a request to change the transfer account number, sent from an address one letter different from the real supplier’s.
Impersonation on WhatsApp: A message from an unknown number claiming to be the manager or a relative, asking for an urgent transfer or for a code you received by text.
Social media account alerts: A message saying the company page will be closed for a violation, with a link to a fake login page.
Prizes and tempting offers: A link to a prize, grant or job that asks for personal details or for an unknown app to be installed.

Signs that give a fake message away

Urgency and pressure: Phrases such as “immediately”, “within an hour” or “your account will be closed” are meant to stop you thinking.
A request for a verification code: No trusted party asks for the code you received by text. Whoever asks for it is trying to get into your account.
A link that does not match the sender: Long-press the link or hover over it before opening it, and check the actual site name.
Changed payment details: Any request to change an account number or payment method must be confirmed by calling a number you already know.
An unfamiliar style: Wording that does not sound like the sender’s usual way of writing, bearing in mind that some recent messages are very polished.

Why phishing works in our workplaces

Trust in people we know: Many transactions rely on personal acquaintance, so a message carrying a familiar name gets through without scrutiny.
The phone is the work device: When an employee runs all their work from a phone, it is hard to see the full link or the sender’s real address.
Transfer requests over chat: Being used to payment and transfer requests on WhatsApp makes a fake message look completely normal.
No training: Most employees have never had any security awareness training, so they do not know a verification code is a secret never to be shared.

A simple awareness programme for your team

01
A short introductory session
Show real examples of the messages that reach your sector, in plain language without complex jargon.
02
The independent confirmation rule
Any payment request or change to payment details is confirmed by phone or face to face, not by replying to the same message.
03
An easy way to report
A named person or internal group where staff can send any suspicious message without fear of blame.
04
Regular reminders
A new example shared in the work group every so often keeps people alert better than one annual lecture.
05
Turn on two-factor authentication
Even if an employee falls for the trick, the second step stops the attacker getting in with the password alone.

What to do if you clicked the link

What happened	Immediate action	Then
You entered your password on a fake page	Change it at once from the official site	Turn on two-factor authentication and sign out of all devices
You gave a verification code to someone	Tell your IT contact and start recovering the account	Warn your contacts about messages they may receive in your name
You opened a suspicious attachment	Disconnect the device from the network	Have it checked before it goes back into use
You transferred money because of the message	Contact the bank or transfer provider immediately	Keep all the messages and seek legal advice

Read also

Cloud, infrastructure and security

Frequently asked questions

Does phishing happen in Arabic too?

Yes. Many messages aimed at Arabic-speaking users are written in Arabic and use the names of local organisations or familiar occasions to look convincing.

Why are accountants and secretaries targeted more than others?

Because they handle payments, incoming mail and documents, so tricking them leads directly to a money transfer or access to sensitive data.

Should we punish an employee who falls for phishing?

Punishment pushes staff to hide mistakes. It is better to encourage quick reporting, because the first minutes decide how much damage is done.

Does antivirus software protect against phishing?

It helps block some links and attachments, but it cannot stop an employee typing their own password into a fake page. Awareness is the most important line of defence.

Relatives abroad send money requests on WhatsApp. How do we verify them?

Call the person by voice on their known number before any transfer, and agree within the family or company on a password or question strangers would not know.