Pressure to act quickly. Treat unusual urgency, threats or demands for secrecy as a reason to slow down. The NCSC highlights the way scam messages can use authority and emotion to push people into acting without checking.
Requests for sensitive information. Be cautious when a message asks for passwords, account information or other sensitive details. Do not use an unexpected link or attachment to provide information. Check the request through an established, trusted channel.
Changes to payment details. The FBI’s guidance on business email compromise advises verifying changes in account numbers or payment procedures. Use a known contact route or independently obtained number, rather than contact details supplied in the suspicious request. Follow your organisation’s approval process.
An unfamiliar route around normal controls. A request to skip review, move a conversation to a new channel or ignore an established procedure deserves a closer look. Consider the context, not just the appearance of a message; a familiar name or professional tone does not establish authenticity.
Unclear or inconsistent information. A mismatch between a request and the expected business activity may need clarification. Record what you noticed and pass it to the designated team. Avoid making accusations or sharing the concern widely.
Make reporting straightforward. Training should identify the internal contact, the information to preserve and the actions employees are authorised to take. Use realistic practice so colleagues can recognise a concern and explain their next step.
Pause, verify and report
Subscribe to our newsletter
Thank you!
Created with
