Think Before You Click: How Employees Can Spot Suspicious Messages

A message from your boss asks you to buy gift cards. A vendor sends “updated” payment instructions. A delivery notice says you must open an attachment immediately. Each could be legitimate, but each is also the kind of request an attacker may use to get past a busy employee.

Phishing can arrive by email, text, or even a message in a work app. It often tries to make a request feel routine or urgent enough that you act before checking it. CISA recommends teaching employees how to recognize and report these messages.

What should make you pause?

Watch for messages that:

• Ask you to change payment details, share a password, or provide sensitive information.
• Pressure you to act immediately or keep the request secret.
• Include an unexpected attachment, link, or sign-in prompt.
• Appear to come from someone familiar but use an unusual address or wording.

A convincing message may have no spelling mistakes at all. The request and its context matter more than whether the email looks polished.

A simple response that protects your business

If a request seems unusual, contact the sender through a phone number or communication channel you already trust. Do not use the contact information supplied in the suspicious message. If you clicked a link or shared information, tell your IT Support team promptly. A quick report gives them a better chance to investigate and limit any damage.

Employee awareness works best when reporting is easy and nobody feels embarrassed about raising a concern. A Managed Service Provider can help businesses reinforce that habit through security awareness training, phishing simulations, and clear reporting procedures.

If your team could use help building those practices, contact InTegriLogic at This email address is being protected from spambots. You need JavaScript enabled to view it. or 520-545-0691.