Understand phishing

Editorial update: 21 September 2026. Introductory learning material.

Phishing uses a message, website or call to persuade someone to disclose information or take an unsafe action. It can arrive through email, text, social media, QR codes or voice calls.

Urgency, unexpected attachments and changed payment instructions deserve scrutiny. A familiar sender, professional writing or a convincing logo does not prove a request is genuine; a legitimate account can also be compromised.

Respond safely

• Pause before opening links, signing in or sending information.
• Verify requests through a known contact method or your usual application.
• Report suspicious messages using the organization’s process.
• If you already interacted, notify the response team promptly and follow its containment instructions.

Activity: Practice verifying an unexpected payment change without using contact details supplied in the message.

Reference: CISA small-business phishing resources. Check the source and your system provider’s current instructions before implementation.