A request arrives from the CFO to change a supplier’s bank information before the end of the day. The writing looks familiar and the sender address appears correct. Before anyone changes the account, one control still works: call the CFO using a number already on file.

That step costs almost nothing, yet it interrupts a common fraud pattern. It also illustrates a broader point. People should not be expected to identify every convincing message on sight; they need a simple way to verify sensitive requests.

Phishing no longer stays in email

Microsoft reported detecting approximately 8.3 billion email-based phishing threats in the first quarter of 2026. QR-code phishing was the fastest-growing attack vector by the end of that quarter. Employees are also seeing fake CAPTCHA pages that ask them to paste commands, help-desk impersonation in Teams and fraudulent voice calls.

Ten habits that reduce the chance of a mistake

1. Pause when a message creates urgency. A short delay is often enough to notice something that does not fit.
2. Verify requests involving money, access or sensitive data through a second channel. Use contact information you already trust, not the number supplied in the request.
3. Use a password manager and a unique password for each account. Password reuse turns one compromised account into several.
4. Use MFA and reject any sign-in prompt you did not initiate. Repeated prompts are not a reason to approve one.
5. Treat a QR code like any other link. Check the destination before signing in or entering information.
6. A legitimate verification page should not ask you to paste a command into your computer. Close the page and report it.
7. Confirm unexpected help-desk outreach through the normal support channel before installing software or granting access.
8. Use only approved AI tools, and keep confidential information out unless the policy clearly allows it.
9. Install updates promptly and lock the screen whenever the device is unattended.
10. Report suspicious activity even when you are uncertain. Early reporting gives the security team a chance to protect other users.

The organization has responsibilities too

Awareness works best when the organization makes the secure action easy: practical training, simulations followed by coaching, one familiar reporting method and leaders who follow the same rules.

We use phishing simulations and continuous learning internally to see where awareness, reporting and response can be strengthened. The purpose is improvement, not embarrassment.

Production asset: Embed the “10 habits” infographic and phishing quiz.

Five ideas to carry beyond October

• Leadership: name an owner, rank your critical systems, rehearse the bad day.
• CMMC: the pause changed who checks, not what you owe. Keep your SPRS score honest.
• AI: find what’s in use, write one page, limit access.
• Critical infrastructure: Reduce, Replace, Recover.
• People: ten habits, backed by an organization that makes them easy.

Cybersecurity Awareness Month ends, but these habits should not. The 10-question Cyber Check provides a quick look at where an organization may need to focus next. It is available at svam.com/cybersecurity-awareness-month/.