Before anyone gets phished

Firewalls are not where this goes wrong. A person reads a message, believes it, and does one reasonable thing. The rest follows from there.

The message arrives inside a normal workday. It names a real invoice, a real vendor, a real deadline. It asks for one small action.

The same shapes come up again and again.

• A look-alike domain, one character off the real one.
• An invoice with new bank details, inside a thread you recognise.
• A login page that renders perfectly and lives somewhere else.
• A note from a colleague's real account, sent while they slept.

The message gives you a reason to skip the step you would normally take. Notice the hurry, and the rest follows. Urgency is the tell.

When a message asks for money, access or a credential, confirm it somewhere else. Use a number you already had, not the one in the message. Call, do not reply.

This habit holds even when the forgery is perfect. Nothing else does.

A password can be typed into the wrong page. A passkey is bound by the browser to the site that created it, so a look-alike cannot use it. That is the whole difference.

A code read off a screen can be repeated to whoever asked for it. A passkey or a hardware key cannot travel down a phone line. Second factors are not equal.

Email, the domain registrar, the payment tools, and anything that can reset another account. Start where the damage is largest.

Someone will click, and the plan matters more than the blame. Say so before it happens.

• Write down the time, the message, and exactly what was clicked.
• Change the password on that account, then sign out every session.
• Re-enrol the second factor from a device you trust.
• Check for new mail rules, forwarding addresses and connected apps.
• Tell finance before the next payment run, if money was named.
• Tell the team what the message looked like, the same day.

Mail rules are the part people miss. Someone reading your mail will often set one, so the replies never reach you. Look there first.

A test does not stop the message from arriving. It finds the door the message aims at.

• The session that never expires, on a laptop somebody shares.
• The password reset that trusts an email address alone.
• The admin page that sits one guessed link away.
• The API that answers for any customer id, not only yours.

The message is not fixable. Those are.

People click on a bad day, in a busy week, in a real thread. The controls that hold are the passkey, the second channel and the session you can revoke. Awareness alone does not.

The examples in these notes are illustrative. Nothing here describes a client engagement.