Move beyond spelling mistakes and examine the sign-ins, file handling and approvals that a persuasive message tries to trigger.
A polished message can still ask for an unsafe action
An invitation to review a file looks ordinary. It uses a colleague’s name and refers to a familiar project. The next step is a sign-in page. Before judging the writing, ask why the message needs you to authenticate through that particular route.
AI can help criminals produce convincing messages at scale. That does not mean every polished message is suspicious or that every phishing email uses AI. The practical response is to make sensitive actions follow trusted routes regardless of how persuasive the message appears.
Review the three decisions after a message arrives
- Sign-in: will the recipient enter credentials or approve authentication?
- File handling: will they open, download or enable something?
- Business approval: will they disclose information, change a record or authorise a payment?
For each decision, identify the expected channel and the person who owns the process. A message can cross teams: an accounts colleague may receive a file that leads to an IT account issue. Make the reporting path work across those boundaries.
Make the approved route easier to find
Provide known bookmarks or links within an approved business portal for frequently used services. Help staff understand how to reach a shared document through the service itself. When someone is unsure, they should be able to ask without being pushed to follow the message link.
Keep guidance short and tied to actual tasks. A finance user and a service-desk analyst need different examples. Use the tools they see every day, and explain the business action that requires extra checking.
Check technical coverage and recovery routes together
An account review should consider sign-in protection, privileged access, recovery procedures and what happens after a user reports a suspicious approval. A strong initial sign-in control can be undermined by a weak reset process.
Ask your technical team which events are visible and who receives them. Confirm how a suspected account compromise is investigated and how sessions or access are handled. The right action depends on the environment; avoid a universal instruction that could interrupt essential services without coordination.
Give people a useful reporting experience
A reporting button or inbox is only the beginning. Decide who monitors it, how a report is acknowledged and how urgent concerns reach the right person. Staff should know how to report when they have already clicked or entered information.
Keep the initial report practical: the original message, what action was taken and approximately when it happened. Do not ask people to forward suspicious files widely. Give the response team a way to request additional evidence through an appropriate channel.
Measure whether the process works
Use a tabletop discussion to trace one example from receipt to resolution. Can the employee find the reporting route? Does someone own the next action? Can the technical team identify the affected account? Does the business know when normal work can resume?
Record improvement actions with owners and review dates. Awareness training is useful, but a working process also needs accessible tools, timely responses and leadership support for pausing an unusual request. Review the process after incidents and meaningful system changes.
Take the next step
Turn these questions into a focused discussion with the people responsible for your systems and business processes. Explore our related guidance or talk to a security specialist.
Further reading
FBI/IC3 guidance on AI-assisted fraud and NCSC assessment of AI and cyber threats.