6 Ways to Combat Social Phishing Attacks
Phishing has grown up. Here are six practical habits that keep your team from clicking the wrong thing — even when the message looks legitimate.
Phishing is no longer full of typos and Nigerian princes. Modern attacks copy your vendors' branding, spoof your executives, and time themselves to real events on your calendar. The good news: a handful of ordinary habits shut down the vast majority of attempts.
1. Slow down on anything urgent
Urgency is the phisher's oldest tool. Any message that pushes you to act right now — a wire, a password reset, a gift card run — deserves an extra minute, not fewer.
2. Verify money and access requests out of band
If a message asks to move money, change bank details, or grant access, pick up the phone. Call the person at a number you already have, not a number in the email.
3. Hover before you click
Every modern mail client shows the real destination of a link on hover. If the domain doesn't match the sender, it isn't the sender.
4. Turn on multi-factor authentication everywhere
MFA turns a stolen password into a dead end. Prefer an authenticator app or a hardware key over SMS codes.
5. Report, don't just delete
A phish sent to one person was almost certainly sent to a dozen others. Reporting it lets IT block the sender and warn the team.
6. Train quietly and often
A short quarterly refresher beats an annual video nobody remembers. Simulated phishing keeps the muscle memory in shape.
Phishing will keep getting better. The habits that stop it, though, stay the same.