Security awareness becomes useful when it tells someone what to do at the moment a request arrives. A convincing email, familiar website or urgent login prompt can still ask for the wrong action.
Dark Reading’s 3 November awareness roundup highlights how routine workflows create openings for attackers. The following routine turns that concern into decisions an employee can practise and an IT team can support.
Verify the request before following its route
When a message asks for a payment, login or sensitive document, pause and ask whether you expected that specific request. A recognisable name is only a starting point. For an unexpected request, open the service through an existing trusted bookmark or contact the organisation using independently obtained details.
The UK NCSC’s phishing guidance recommends contacting organisations directly rather than using the phone number or address inside a doubtful message. Apply the same check to a QR code in an email: scanning it should not replace verifying where the request came from.
A useful office exercise is an unexpected invoice with changed bank details. The successful outcome is a callback through a known contact route before any payment approval.
Stop when a webpage asks to operate your computer
If a verification or troubleshooting page asks you to open Run, PowerShell or Terminal and paste a command, stop. Leave the command unexecuted and ask IT through your usual support channel.
Microsoft’s ClickFix research documents attackers using fake errors and human-verification prompts to persuade users to execute commands themselves. A page can place a command on the clipboard while presenting an apparently harmless interaction.
Training should rehearse that decision without executing a sample command. The skill to practise is recognising when a routine browser task suddenly requests local code execution.
Prepare the account, then report the mistake
For important accounts, check whether passkeys are supported in the service’s security settings. The NCSC recommends passkeys where available because they resist phishing. Where they are unavailable, use strong passwords and enable two-step verification. For work accounts, follow the organisation’s enrollment and recovery process.
If you entered a password or ran something suspicious, report exactly what happened promptly. Include the approximate time, device and original message or URL; use your established reporting route rather than replying to the suspicious sender.
The NCSC’s post-phishing guidance directs work-device users to IT, advises changing exposed passwords wherever reused, and recommends contacting the bank if banking details were shared. An antivirus scan may help after opening a suspicious link or installing software, but it should accompany reporting rather than replace it.
