A message appears to come from a regular supplier. It references a real project, includes a familiar signature, and asks your finance team to use new banking details for an upcoming payment. Nothing is misspelled. The request fits an existing conversation. Should the payment go through?
This is where phishing defense becomes a business process, not just an email-filtering problem. Attackers can impersonate trusted contacts, compromise legitimate accounts, and use convincing language to push people toward consequential decisions. A polished message is not proof of legitimacy.
The strongest approach combines three actions: prevent compromise, verify unusual requests, and respond quickly. The following checklist gives business owners, employees, and IT administrators concrete responsibilities across all three.
Build a process that can withstand a convincing message—not one that depends on every employee spotting every deception.
1. Prevent Compromise: Protect Accounts and Systems
Start with controls that reduce the consequences of a deceptive message. Employee awareness matters, but it should operate alongside strong authentication, maintained systems, and properly configured email.
[ ] Require Multifactor Authentication
Owner: IT. Prioritize email, administrator accounts, remote access, and employees who handle sensitive information or authorize payments. Then close coverage gaps across other business applications.
Not all MFA provides the same protection. CISA recommends phishing-resistant MFA. Use options such as FIDO-based security keys or passkeys where supported. One-time codes and ordinary push approvals can still be targeted by phishing.
- Document which accounts have MFA and which remain exceptions.
- Review enrollment, recovery, and fallback methods so they do not undermine stronger authentication.
- Where phishing-resistant MFA is not yet available, use number matching as an interim improvement—not an equivalent replacement.
Teach employees to reject and report unexpected authentication prompts. An approval request they did not initiate deserves investigation.
[ ] Use Unique Passwords and Keep Software Updated
Owner: Everyone, supported by IT. Require a different password for each account, and provide an approved password manager to make that practical. Reusing a password allows a compromise at one service to threaten another.
Include operating systems, browsers, business applications, and security software in the update process. Enable automatic updates where appropriate, and assign responsibility for systems that require scheduled maintenance. These are foundational practices in the FTC’s small-business cybersecurity guidance.
Check that updates actually install. A written patching policy is not evidence that a laptop or browser is current.
[ ] Authenticate Your Organization’s Email Domain
Owner: Email administrator or service provider. Configure SPF, DKIM, and DMARC to help receiving mail systems identify unauthorized use of your domain.
In practical terms, SPF identifies authorized sending infrastructure, DKIM adds a verifiable digital signature, and DMARC checks alignment with the visible sender domain and communicates how authentication failures should be handled.
Inventory legitimate senders first, including payroll platforms, marketing services, and invoicing systems. Monitor results and move carefully toward an enforcement policy so legitimate business messages are not unnecessarily blocked.
Know the limits: Email authentication does not stop every lookalike domain, misleading display name, or message sent from a genuinely compromised account. It is one layer, not a guarantee.
2. Verify Unusual Requests Before Acting
Attackers often succeed by making an unsafe action feel routine or urgent. Verification introduces a deliberate pause at the point where a message could become an account compromise, disclosure, or financial loss.
[ ] Check Unexpected Requests Through an Independent Channel
Owner: Everyone. If a message unexpectedly asks you to sign in, open an attachment, or provide sensitive information, verify it without relying on the message itself. The FTC recommends contacting the organization through a website or phone number you already know is genuine.
For example, if an “IT support” email warns that your account will be disabled, use your established help-desk contact or open the company portal from a trusted bookmark. Do not use the message’s link or callback number.
Apply the same rule to text messages, collaboration tools, and phone calls. Familiar branding, a recognizable name, or fluent writing does not independently establish identity.
[ ] Independently Verify Payment Changes
Owner: Finance and anyone authorized to approve payments. Require independent confirmation for new bank details, changed wire instructions, and unusual purchasing requests.
In the supplier example, call a previously verified contact using the number already held in your vendor records. Do not call a number supplied in the change request. Do not treat a reply within the same email thread as independent confirmation: the account or conversation may be compromised.
The FBI’s business email compromise guidance emphasizes verification of payment requests and changes to account information.
- Record how the change was verified and who approved it.
- Use a second approver for higher-risk transactions.
- Make clear that urgency or executive seniority does not waive verification.
[ ] Make Reporting Simple and Safe
Owner: Security and management. Provide one clearly identified reporting route, such as an approved reporting button or a security-team contact. Publish it where employees can find it without searching a suspicious message for instructions.
Tell employees to report even if they already clicked, entered information, or approved a request. A reporting process that feels punitive encourages delay when speed matters most.
Reinforce the process through regular, practical training, consistent with CISA’s cybersecurity essentials guidance. Practice scenarios should include convincing messages and compromised senders—not only obvious spelling mistakes.
3. Respond Quickly When Something Goes Wrong
A click, a disclosed password, and an executed download require different responses. The first priority is to establish what happened and bring the right people into the response.
[ ] Report the Action, Not Just the Suspicious Message
Owner: Employee and IT. Report immediately and describe exactly what occurred:
- Was the message only opened, or was a link clicked?
- Was a file downloaded, opened, or executed?
- Were credentials, authentication codes, or sensitive information submitted?
- Was an unexpected MFA prompt approved?
- Was money sent or a payment instruction changed?
Preserve the message and relevant details using your approved reporting process. For work accounts and devices, involve IT rather than attempting recovery alone. Avoid forwarding suspicious attachments to colleagues or conducting your own investigation by revisiting the link.
[ ] Secure Compromised Accounts Beyond a Password Reset
Owner: Account holder and IT. Follow the provider’s recovery process. Changing a password is important, but it is not necessarily complete remediation.
Review and remove unauthorized sessions, recovery details, mailbox rules, and forwarding settings. Investigate suspicious application permissions and changes to authentication methods. Determine whether the attacker accessed sensitive information or sent messages to other people.
For Microsoft 365, administrators should follow Microsoft’s compromised-account response guidance, including containment and investigation across affected accounts and services. For other accounts, use the provider’s current instructions; the FTC’s account recovery guidance also covers important recovery checks.
[ ] Act Immediately on Possible Malware or Financial Loss
Owner: IT and finance. If malware is suspected, follow the organization’s device-isolation procedure and contact IT immediately. IT should coordinate investigation, update security tools, and run appropriate scans. A clean scan alone does not establish that an incident is resolved.
If money was transferred, contact the financial institution immediately to request available recovery measures. Do not wait for the internal investigation to finish. In the United States, report business email compromise to the FBI’s Internet Crime Complaint Center, or IC3. Recovery is not guaranteed, but delay can reduce available options.
Put the Checklist Into Operation
This is a recommended rollout, not a regulatory deadline. Assign named owners and confirm that each action works in practice.
- Today: Publish the reporting contact and payment-verification rule. Make clear that employees should report mistakes immediately.
- This week: Review MFA coverage, identify weaker authentication methods, and assign ownership of email authentication.
- This month: Rehearse a phishing incident. Confirm who handles account recovery, device investigation, internal communications, and bank contact.
Test a realistic scenario: an employee enters credentials into a fake sign-in page while finance receives altered payment instructions. Can both teams find the right help and act without improvising?
Make Safe Actions the Default
Phishing defense is not a contest to identify every fraudulent message. It is a discipline of protecting access, independently verifying consequential requests, and containing mistakes before they spread.
Start today: Choose an owner for each checklist item, close the most consequential gaps, and rehearse your response. The goal is a business that can handle a convincing deception without allowing it to become a major incident.