Look for the red flags: an unusual sender, a sense of urgency (“act now or your account will be suspended”), grammar or spelling errors, a mismatched display name vs the actual email address, suspicious links (hover before clicking), unusual attachments, and any request to bypass normal procedures (especially around payments).
Phishing is still the #1 attack vector against Australian small businesses. The tactics evolve constantly — modern phishing emails are AI-generated, perfectly grammatical, and often look identical to legitimate brand emails. The defence is a combination of: trained staff who know the red flags, technical controls that block known-bad senders, and a process that requires out-of-band verification for sensitive requests (especially payments).
(see above)
Our SMB1001 Cyber Essentials training course spends a full session on phishing — including hands-on phishing-spotting activities and a take-home checklist. Plus simulated phishing campaigns for managed-IT clients who want to track staff awareness over time.
Want to talk through this in your specific business context? The first 30 minutes is free — phone or Microsoft Teams. Book a free 30-min scoping call →
