Learn / Small business security
Employee phishing training that actually works
How to train a small team to spot and report phishing without shaming anyone, plus a simple monthly routine.
Why training matters for small teams
Phishing remains one of the most common ways attackers get into businesses. In a small company, the same person may approve invoices, reset passwords and answer customer email, so one convincing message can do a lot of damage. Technology helps (spam filters, MFA, link scanning), but some messages will always get through. Training turns your staff from the weakest link into an early warning system.
For a refresher on how the attacks work, see our guide to phishing.
What good training looks like
Practitioner consensus has moved away from annual slideshows and "gotcha" tests. What works better:
- Short and frequent. Five minutes a month beats one hour a year. People remember recent examples.
- Real examples from your own inbox. Show the fake invoice your bookkeeper received last week, with the warning signs highlighted.
- Focus on the action, not the click. The goal is that people pause before they pay, log in or open an attachment, and that they report anything odd.
- Reward reporting. Thank the person who reports a phish, even if it turns out to be harmless. Never punish someone for reporting their own mistake; the hour you save by hearing about it early is worth far more.
The five habits to teach
- Check the sender's real address, not just the display name. "Accounts Payable" can come from any domain.
- Hover before you click. On a computer, hover over a link to see where it really goes. On a phone, press and hold.
- Never log in from an email link. Open the site or app yourself from a bookmark.
- Verify money and data requests by phone, using a number you already have. This covers changed bank details, gift card requests and "urgent" wire transfers from the boss.
- Report, then delete. Make reporting one click (the built-in report button in Outlook or Gmail) or a shared address such as a security mailbox on your domain.
Simulated phishing: use it carefully
Many tools send fake phishing emails to staff to measure who clicks. They can be useful, but small teams should use them gently:
| Do | Avoid |
|---|---|
| Tell staff simulations will happen | Surprise "gotcha" campaigns with public scores |
| Use realistic, everyday lures | Cruel lures such as fake bonuses or layoffs |
| Measure report rate, not just click rate | Disciplining people for clicking |
| Give instant, friendly feedback | Long mandatory courses as punishment |
Report rate is the better metric. A team where most people report a phish within minutes is safer than one with a low click rate but no reporting, because one early report lets you warn everyone and block the sender.
A simple monthly routine
- Week 1: Share one real phishing example with the warning signs marked.
- Week 2: A two-minute tip (for example, how QR code phishing works, or how to check a sender).
- Week 3: Optional simulation, followed by a friendly explanation.
- Week 4: Review what was reported and thank reporters, by name if they are happy with that.
Add a banner to emails from outside your organization ("External sender"). Most email platforms support this, and it makes impersonation of internal staff much easier to spot.
Topics to rotate through the year
- Invoice and bank-detail change fraud (business email compromise).
- Fake login pages for Microsoft 365, Google and shared-document services.
- QR codes in emails and on printed flyers.
- Phone calls pretending to be IT support or the bank (vishing), and why staff should never read out an MFA code.
- Text messages about deliveries, tolls and payroll.
- Messages that appear to come from the owner or a manager asking for gift cards.
When someone clicks
Clicking happens. What matters is the next ten minutes. Teach this script: disconnect from Wi-Fi if a file was opened, change the password from a different device if credentials were entered, and tell the person responsible for IT immediately. Your incident response plan should list who that is and how to reach them outside office hours.
