Phishing uses misleading messages or interactions to obtain information or trigger an action. A useful defence combines supported technical controls, clear working practices and a way for people to report concerns.
Look at the action being requested
Unexpected payment changes, sign-in requests, document-sharing prompts or urgent instructions deserve verification. A familiar name or convincing design is not enough evidence that a message is genuine. The relevant question is whether the action makes sense and has been confirmed through a trusted route.
Use known contact details when checking a sensitive request rather than relying on details supplied inside the questionable message. A business payment process should not depend on one person deciding whether an email looks professional.
Combine people and system controls
Awareness matters, but it is not the whole defence. Supported filtering, device protections, suitable MFA, permissions and monitoring can reduce risk in different ways. The appropriate controls depend on the systems involved and need technical ownership.
Staff should know how to report a concern without being blamed for asking a question. Clear approval processes for changing bank details or granting access can make the decision less dependent on recognising every new form of deception.
Prepare for the click or disclosure
If someone has interacted with a suspicious message, prompt reporting gives responders more information. Preserve the relevant message and record what happened through the agreed process. Do not assume deleting the message or changing a password by itself resolves every possible exposure.
An authorised responder can assess accounts, sessions, devices and affected information. The response should fit the event. Use a trusted communication route if the normal account may be compromised.
Practise a sensible verification step
For an illustrative supplier bank-detail change, the accounts team pauses the change, uses an established contact route to verify it and records approval before updating the payment record. The example shows a business control rather than a guarantee that all deception will be detected.
Agree similar verification for unusual access requests and confidential document sharing. Keep the process practical so staff can follow it during a busy day rather than improvise an exception under pressure.
Keep guidance current
Read ACSC guidance on scams, emails and messages and the relevant service-provider instructions. Avoid relying only on a fixed list of spelling mistakes or visual clues.
Our MFA planning guide and cybersecurity scope connect awareness with account controls and response responsibilities. No tool or training session can promise that an incident will never occur.
