Everything your team needs to know about phishing, AI scams and account safety — in bite-size lessons anyone can finish on a coffee break. Free for everyone. Share it with your whole company.
YOUR PROGRESS0/11 lessons
Progress is saved on this device.
Spotting phishing·2 min read
The 5-second check
Most phishing is caught by a quick habit, not expertise. Before you click anything in an email, run these four checks. It takes five seconds.
01
Who really sent it?Look at the email address, not the display name. "IT Service Desk" means nothing if the address is it-desk@random-domain.net.
02
Were you expecting it?Unexpected invoices, deliveries, refunds or shared files are the most common lures.
03
Where does the link go?Hover (or long-press on mobile) to see the real destination before clicking.
04
Is it rushing you?Deadlines, threats and "final reminders" are designed to stop you thinking.
DO THIS TODAYNext time an email asks you to click or pay, do the 5-second check before anything else.
Spotting phishing·3 min read
Lookalike domains
Attackers register domains that look almost identical to real ones. At a glance, your brain autocorrects them.
01
Extra wordsacme-support.net, acme-hr.co and acmeinvoices.com are not acme.co.uk.
02
Swapped lettersrn can look like m, l like I, and 0 like O. micros0ft and rnicrosoft fool people every day.
03
Different endings.co instead of .co.uk, or .net instead of .com, is a classic trick.
04
Subdomainsacme.co.uk.login-check.com belongs to login-check.com — read from the right.
DO THIS TODAYWrite down the real domains your company, bank and key suppliers use. Check against that list.
Spotting phishing·2 min read
Urgency & pressure
The single most reliable red flag isn't technical. It's emotional: the email wants you to act now, before you think.
01
Deadlines"Within 24 hours", "today only", "before your account is closed".
02
FearThreats of fines, lost access, legal action or missed deliveries.
03
Greed or curiosityRefunds, prizes, salary letters, confidential documents.
04
Secrecy"Keep this between us" is almost always a scam.
DO THIS TODAYWhen an email makes you feel rushed, that's your cue to slow down and verify.
AI-era scams·3 min read
AI-written phishing
AI tools let attackers write fluent, personalised emails in seconds, in any language. Bad spelling is no longer a reliable sign.
01
Perfect writingAssume scam emails will be well written. Judge the request, not the grammar.
02
Personal detailsYour name, role, manager and recent projects are easy to find online and drop into an email.
03
Thread hijackingAttackers may reply inside a real email thread from a compromised account.
04
ScaleAI makes targeted attacks cheap, so small businesses get them too.
DO THIS TODAYStop using "it had typos" as your test. Use sender, link, request and pressure instead.
AI-era scams·3 min read
Voice clones & deepfake calls
A few seconds of audio is enough to clone a voice. Scammers use it to call staff pretending to be a director or supplier.
01
Unusual requestsUrgent payments, gift cards or password resets by phone are red flags even if the voice sounds right.
02
New numbers"I'm on my personal phone" is a common setup line.
03
Call backHang up and call the person on a number you already have.
04
Agree a code wordSome teams use a simple phrase for verifying urgent requests.
DO THIS TODAYAgree with your team that payment requests by call or voice note are always verified by calling back.
AI-era scams·2 min read
QR code phishing
QR codes hide the link entirely and move you onto your phone, where security tools are weaker and URLs are harder to read.
01
In emailsA QR code asking you to "re-verify your account" is a lure.
02
On posters & parking metersFake stickers over real codes send you to payment scams.
03
Check the previewMost phone cameras show the URL before opening — read it.
04
Go directType the website yourself instead of scanning.
DO THIS TODAYNever scan a QR code in an email to sign in or pay.
Accounts & passwords·2 min read
Password managers
Reused passwords turn one breach into many. A password manager makes unique passwords effortless — and won't autofill on fake sites.
01
One strong master passwordA long phrase you don't use anywhere else.
02
Unique for everythingLet the manager generate them.
03
Autofill as a warningIf it won't fill, you might be on a lookalike site.
04
Share safelyUse shared vaults instead of sending passwords by email or chat.
DO THIS TODAYInstall a password manager and change your email password to a unique one first.
Accounts & passwords·3 min read
MFA & passkeys
Multi-factor authentication stops most account takeovers, even when a password is stolen.
01
Turn it on everywhereEmail, banking, accounting and admin accounts first.
02
Prefer an app or passkeyAuthenticator apps and passkeys beat text messages.
03
MFA fatigueNever approve a sign-in prompt you didn't start — even if it keeps coming.
04
Never share codesNo genuine company will ask you to read out a code.
DO THIS TODAYCheck MFA is on for your work email today.
Payments & fraud·3 min read
Invoice & bank-detail fraud
One of the costliest scams for small businesses: a supplier's "new bank details", sent from a real-looking or hijacked email.
01
Changed detailsAny request to change payee bank details is high risk.
02
Verify out of bandCall the supplier on a number from your records — not the email.
03
Two-person ruleHave a second person approve new or changed payees.
04
Small test paymentsDon't rely on them; scammers expect them.
DO THIS TODAYWrite a one-line rule: bank detail changes are always confirmed by phone.
Payments & fraud·2 min read
CEO & gift card fraud
A message "from the boss" asks for a quick favour: buy gift cards, pay an invoice, or send staff details. It's urgent and secret.
01
Personal email addressDirectors using Gmail or a new number for urgent requests.
02
Gift cardsNo legitimate business pays clients in gift cards.
03
Secrecy"Don't tell anyone yet" is the giveaway.
04
VerifyAsk in person or on a known channel.
DO THIS TODAYTell your team: the boss will never be upset you checked.
If it happens·2 min read
What to do if you clicked
Everyone clicks eventually. What matters is what happens in the next ten minutes. Speed beats embarrassment.
01
Don't enter anything elseClose the page. If you entered a password, change it now from a trusted device.
02
Tell someone immediatelyYour IT contact or manager. Early reports limit damage.
03
Check MFA promptsDeny anything you didn't start.
04
PaymentsIf you paid, call your bank straight away.
DO THIS TODAYSave your IT contact's details somewhere you can find them in a hurry.
Reading helps. Practice sticks.
Lureproof sends your team realistic practice phishing every month, so these lessons turn into reflexes.
