Phishing protection combines account controls, email filtering and staff procedures for checking unusual requests. No single filter or training session can identify every malicious message, so prepare a clear reporting and response process.
Reduce account takeover risk
Use MFA, review suspicious sign-ins and disable unused accounts. Protect privileged identities and investigate unexpected mailbox rules.
Verify payment changes
Confirm banking-detail changes through a trusted existing phone number. Staff need a clear route to report suspicious messages without delay.
Practical decision guidance
Use an independent verification step for sensitive requests such as new banking details or password resets. A reply to the same suspicious email is not independent verification. Give staff a known reporting route and avoid punishing prompt reports of mistakes, which can delay containment.
Applying this to your business
Illustrative example: a supplier email asks accounts staff to use a new bank account. Confirm the change using a previously recorded telephone number and follow an approval process. This remains necessary even if the message appears inside a familiar email conversation.
Before you proceed
- Create a simple suspicious-email reporting route.
- Verify payment changes through trusted contacts.
- Practise account-compromise response.
Discuss email security and staff awareness with ITC Systems. Call 031 001 7028 or email [email protected].
Related service: https://itcsystems.co.za/cyber-security/
Related guide when published: https://itcsystems.co.za/blog/microsoft-365-security-south-africa/
CISA — StopRansomware Guide: https://www.cisa.gov/stopransomware/ransomware-guide