BRITECITY
Phishing Awareness Training · Protecting Your Business
Make IT Easy
Today’s Agenda
What it is, why it works, and how attackers think
BEC, spear phishing, smishing, vishing, and more
How to read an email like a security pro
Habits that stop attacks before they start
What to do — and what NOT to do
The Threat
Phishing is a cyberattack where criminals impersonate trusted sources to steal credentials, money, or data. It works because it exploits human behavior — not just technology.
Attackers create urgency, impersonate authority figures, and exploit trust. Your brain is wired to respond to these triggers — and attackers know it.
Common hooks: password reset required, invoice overdue, package undeliverable, account suspended, unusual sign-in detected.
Common Scam Types
Mass-sent emails impersonating banks, vendors, Microsoft, or IT. Low personalization, high volume.
Targeted attack using your name, role, or company. Much harder to spot. Often impersonates your CEO or IT.
Attacker hijacks or spoofs a real email thread. Targets finance teams with fake wire transfer or invoice requests.
Phishing via text message. Fake shipping alerts, bank OTPs, HR notices. Tap = compromise.
Phone-based attack. Caller claims to be IT support, IRS, or your bank. Designed to create panic and urgency.
Highly targeted phishing aimed at executives (CEO, CFO). Higher stakes, more sophisticated, often involves wire transfers.
Red Flags
Dear Valued Customer,
Your account has been flagged for unusual activity. You must verify your identity immediately or your account will be permanently deleted.
[Click Here to Verify Now]
Real-World Scams
Attacker poses as a vendor or exec and requests an urgent payment change. Finance receives a nearly identical email domain. Funds are wired before anyone checks.
"Your account shows a security breach — please click this link to reset your password immediately." Often spoofs Microsoft, Google, or your IT provider.
A document "requires your signature" via a spoofed link. The sign-in page harvests your Microsoft 365 or Google credentials.
"Hey, I'm in a meeting and need you to buy $500 in gift cards and email me the codes. Keep this between us." Targets assistants and finance staff.
Best Practices
Got a wire transfer request? Unusual login link? Call the sender directly using a number you already have — never one in the email.
Hover over any link to preview the real URL. If the domain doesn't match exactly, don't click.
Multi-factor authentication stops 99% of credential-based attacks even if your password is stolen.
Urgency is a manipulation tactic. Legitimate requests follow process. If someone pressures you to skip steps, that's a red flag.
Don't delete. Don't ignore. Report it to your IT team so patterns can be identified and threats blocked for everyone.
If You’re Targeted
Quick Reference
BRITECITY
Your techTEAM is here to help keep you protected.
Forward it to your IT team immediately. Don’t delete it. Don’t ignore it.
We’d rather get 10 false alarms than miss one real threat.
When in doubt — reach out.
Make IT Easy