How to spot and report phishing at work

An email says your salary will be delayed unless you confirm your banking details. A message from your manager asks you to open a shared document. A courier SMS requests a small payment before delivering an office parcel.

Any of these could be genuine. Any could also be phishing: an attempt to persuade you to disclose information, transfer money or take an unsafe action.

The safest response is not to become suspicious of every colleague. It is to recognise requests that need checking, verify them independently and know how to report concerns. You do not need to prove that a message is malicious before asking for help.

Look at the request, not just the presentation

Phishing does not always contain spelling mistakes or an obviously strange logo. CISA's phishing guidance warns that AI can help criminals produce convincing grammar. Urgency, unexpected information requests and misleading addresses remain important warning signs.

Pause when a message:

• Threatens consequences unless you act immediately.
• Requests passwords, verification codes or banking information.
• Introduces an unexpected document, payment or login.
• Asks you to bypass a normal approval process.
• Insists on secrecy or discourages a phone call.
• Moves a work task to an unfamiliar website or personal account.

One warning sign does not automatically prove fraud. It means the request needs a safer check before you act. Also consider whether it fits your job. An employee who never handles supplier payments should question an unexpected instruction to settle an invoice, even if it appears to come from a director.

A familiar sender is not enough

Check the full email address rather than relying on the display name. A sender named “HR Department” could use an unrelated address. Small changes in a domain can be easy to miss.

However, an apparently correct address is not a guarantee. Criminals can take over genuine accounts and use existing conversations to make requests seem normal. CISA's employee guidance includes compromised familiar contacts.

Treat addresses, signatures and familiar writing styles as clues—not proof. The same principle applies to workplace chat, SMS and WhatsApp. A profile photo or recognisable name does not establish who controls the account.

Fictional example: the payroll deadline

Lerato receives an email headed “Final payroll verification”. It says employees must confirm their banking information within 30 minutes or miss the monthly salary run.

The message includes the company logo and a “Secure employee portal” button. Lerato is expecting payroll communication, so the request initially feels plausible.

Instead of using the button, she opens the payroll system through her usual bookmark. There is no notification. She calls HR using the number in the staff directory. HR confirms that no verification exercise is under way. Lerato reports the message through the company's approved process.

Her successful decision was not spotting a particular typo. It was checking the request outside the message. This is an illustrative scenario, not a report of a real AwareStaff customer's incident.

Verify without using the suspicious message

If a request might be genuine:

1. Leave its links and attachments unopened.
2. Open the service independently, using a trusted bookmark or established application.
3. Contact the person through a known channel, such as the staff directory or a previously verified supplier number.
4. Describe the requested action and ask whether they actually initiated it.
5. Follow the normal approval process, even if the sender claims urgency.

Do not use a number supplied in the suspicious email to verify that same email. A criminal can answer a verification call too.

Previewing a link may reveal an unexpected destination, but it is not a safety test. On a phone, avoid tapping just to investigate. If the destination is unclear, independent navigation is simpler.

Report internally before cleaning up

Use your employer's approved reporting button, service desk or security contact. If you do not know the process, ask your manager or IT support through a known channel.

A useful report includes when the message arrived, its sender and subject, what it asked you to do, whether you clicked or entered information, and whether money or personal information may be involved.

Use the approved method for submitting the original message. Avoid forwarding suspicious attachments to colleagues or posting live links in a team chat. After reporting, follow instructions on deleting or retaining it. CISA's public guidance recommends reporting and deleting phishing messages, but workplace responders may first need the original as evidence.

If you already clicked, say so immediately

A click does not always mean an account or device has been compromised. It still deserves prompt attention.

Stop interacting with the page and contact IT or security. Explain exactly what happened. Distinguish between opening a page, downloading a file, entering a password and approving a sign-in request.

If you entered credentials, use your employer's trusted recovery process. A password change may be necessary, but responders may also need to address active sessions or other access. Do not assume changing the password resolves everything.

If a device behaves unexpectedly, stop work and seek instructions. Do not wipe it, install a “cleaner” or delete evidence yourself.

Make reporting a normal habit

Managers should thank people for early reports, including reports made after a mistake. Staff should not need certainty or a complete investigation before speaking up.

NCSC guidance recommends layered phishing defence. Employee judgement matters, but it should sit alongside organisational safeguards rather than replace them. UK public reporting services are not a substitute for a South African employer's incident process.

Possible exposure of employee or customer information should also reach the designated Information Officer or incident lead. They coordinate assessment and applicable POPIA notifications.

AwareStaff's Cyber Security Essentials course supports these basic habits. The everyday rule remains: pause, verify independently and report early—even if you have already acted.

Sources and further reading

• CISA: Recognize and Report Phishing.
• CISA: Teach Employees to Avoid Phishing.
• NCSC: Phishing guidance.

Sources checked for this article on 3 November 2026.

General awareness guidance, not legal advice. Apply your organisation’s policies and seek qualified advice for specific legal questions.