Five phishing signs every employee should know

Phishing is a message, usually an email, SMS or WhatsApp, that pretends to come from someone you trust so you click a link, open a file, share a password or send money. Five signs give most of these messages away: urgency, a sender address that does not match the name, a link that goes somewhere unexpected, a request for credentials or payment, and an attachment you were not expecting. Teaching every employee these five signs, and what to do after a mistake, stops many attacks before they reach your systems.

Firewalls and antivirus protect servers and laptops, but they cannot decide whether a request from the “finance manager” is real. That decision is made by a person, often in a few seconds, which is why staff awareness is part of security and not an extra.

What is phishing and how does it reach employees?

Attackers copy the look and tone of organisations people deal with every day: banks, delivery companies, email providers, government services, suppliers and even colleagues. The goal is to make one action feel normal and urgent at the same time.

• Email: fake login pages, fake invoices and fake shared documents.
• SMS (sometimes called smishing): fake delivery notices, bank alerts and prize messages.
• WhatsApp and social media: messages from a new number claiming to be a manager or a client.
• Phone calls: a caller posing as IT support or the bank, asking for a code that was just sent to you.

What are the five signs of a phishing email?

1. Urgency or pressure: “your account will be closed today”, “pay this invoice before 3 pm”, “don't tell anyone yet”. Real organisations rarely demand action within minutes.
2. A name you know with an address you don't: the display name says your manager or your bank, but the actual email address or number is different, misspelled or from a free email service.
3. A link that doesn't match: the text says one company, but the real address goes somewhere else. On a computer, hover over the link to see it; on a phone, press and hold. Watch for small changes such as an extra letter or a different ending.
4. A request for passwords, codes or payment: a message asking you to log in, confirm a one-time code, update bank details or buy gift cards. Your IT team and your bank will not ask for your password or code by message.
5. An unexpected attachment: an invoice, a CV or a “shared document” you were not expecting, even from a colleague, since their account may have been taken over.

One sign is a reason to slow down. Two or more is a reason to stop and check through another channel, for example by calling the person on a number you already have.

What should an employee do after clicking a phishing link?

Clicking happens, even to careful people. What matters is the next few minutes. Give your team a short, blame-free routine:

1. Stop. Don't enter anything else and close the page.
2. Tell IT or your security contact straight away, and say exactly what you clicked or typed.
3. If you entered a password, change it from a trusted device, and change it anywhere else you used the same one.
4. If you shared a code or payment details, call the bank or the service provider at once.
5. Don't delete the message. It helps the team check who else received it and block the sender.

People hide mistakes when they fear blame. A company that thanks employees for reporting quickly finds out about attacks sooner.

How do you train staff to recognise phishing?

A single long session is usually forgotten within weeks. Training works better as a habit:

• Short sessions in the language your team uses every day, with real examples of the messages that target your sector.
• A few simple rules people can remember: check the sender, check the link, never share codes, report anything strange.
• One clear way to report a suspicious message, such as a named contact or a dedicated email address.
• Occasional simulated phishing emails, followed by a quick explanation rather than punishment.
• Short reminders when a new scam is going around.

What else reduces the damage from phishing?

Training lowers the chance of a click; technical controls reduce what one click can do. Turn on two-factor login for email and important accounts, so a stolen password alone is not enough. Set up email authentication (SPF, DKIM and DMARC) so others find it harder to send email that appears to come from your domain. Give each person only the access they need, remove old accounts, and keep tested backups.

Common questions

Is phishing only an email problem?

No. The same tricks arrive by SMS, WhatsApp, social media and phone calls. Training should cover every channel your team uses for work.

Can antivirus or a spam filter stop all phishing?

No. Filters catch many messages, but well-made ones still get through, especially those with no attachment or sent from real accounts that were taken over. People are the last check.

How often should phishing training happen?

Run it when people join, then repeat it with short refreshers and occasional practice through the year rather than one session.

Should employees be punished for clicking a test email?

No. The point of a test is to learn. Show what the warning signs were and train again; punishment teaches people to hide real incidents.

How Masters helps

The Masters Cyber security service includes staff training: short, practical sessions in Arabic that teach your team to spot phishing, handle passwords and two-factor login, and report anything strange, using real examples of the emails and messages that target Egyptian companies. Optional simulated phishing campaigns show who clicks so you can train again. Alongside training, our security audits check your website, servers, email and accounts, including spoofing protection, two-factor login and who has access to what, and our team fixes the findings with yours. Tell us what you would like checked and we will agree the scope and send a fixed price.