Phishing: A Guide for Every Employee, and for Whoever Runs the Training

This guide has two parts. Part one is for every employee; print it or forward it as is. Part two is for the IT or HR person who has to run the training.

Part 1: For employees

What it looks like

Phishing is any attempt to get you to click a link, open a file, type a password or send money. It doesn't only come by email:

• Emails claiming to be from a bank, Microsoft 365, a courier or a supplier
• SMS, WhatsApp or LINE messages with a link
• Phone calls claiming to be the bank, a government office or "IT support"
• QR codes leading to a fake login page
• Emails pretending to be a director or supplier, asking to change the bank account for payments (called BEC)

That last one does the most damage, especially for companies that buy from Thailand and China and pay across the border regularly. Attackers often read a compromised supplier's mailbox for weeks, then send their message exactly when you are expecting an invoice.

Signs to stop and think

You don't need to see all of them. One is enough reason to stop and check.

Newer tricks to know about

The old advice, "look for spelling mistakes", no longer works. Attackers now write in fluent Lao, Thai and English with AI tools. Watch for these instead:

• QR codes inside a PDF or image, so the email filter never sees a link. "Scan to re-activate your mailbox" is the usual line.
• Fake login pages that pass MFA. You type your password and your code, the fake site relays both to the real one and takes over your session. If the address bar is wrong, don't type anything, even if you have MFA.
• "Enter this code" requests. A message asks you to type a short code on a real Microsoft or Google sign-in page. That code gives the attacker's device access to your account. Never enter a code you didn't request yourself.
• Callback scams. An "invoice" for a subscription you never bought, with a phone number to cancel. The person who answers walks you into installing remote-control software.
• Cloned voices. A short voice note or call that sounds like a director asking for an urgent transfer. Hang up and call back on the number you know.

Reading one message together

Picture an email that arrives on a Friday at 16:40, from your regular supplier's name, saying their bank account has changed, with a PDF "updated invoice" attached. Four signs: a deadline right before the weekend, a sender address that differs by one letter, a change of bank details, and a request to reply only by email because "the phone line is down". Any one of them is a reason to call the supplier on the number you already have.

What to do

Stop. Urgency is the scammer's main tool. Five minutes spent checking has never ruined a deal.

Verify another way. Call a number you already have, or the one on the official website. Not the number in the suspicious email.

Report it. Use the Report Phishing button in Outlook or Gmail, or forward it to IT. Your report may protect ten colleagues who received the same message.

If you already clicked

• Typed a password: change it now and ask IT to sign out all your sessions.
• Opened a file: unplug the network cable or turn off Wi-Fi, then call IT. Don't shut the PC down yourself.
• Sent money: call your bank immediately. The chance of stopping a transfer is highest in the first hour.

Don't be embarrassed and don't wait. Everyone has nearly clicked at some point. Reporting fast always helps more than hiding it.

Part 2: For whoever runs the training

What works

Short and frequent. Ten to fifteen minutes a month sticks better than a three-hour seminar once a year.

The languages staff actually read. In many Lao organizations, staff read Lao, Thai and English to different levels. Content and test emails should come in all three, because real phishing does.

Familiar examples. Parcel notices, bank alerts, invoices from Thai suppliers and WhatsApp messages from "the boss" land better than examples from other countries.

Simulations without punishment. When someone clicks a test link, show a short explanation page on the spot. Punishing or naming people makes them stop reporting, which is the last thing you want.

Focus on the people being targeted. Finance, procurement, HR and executives deserve extra sessions and harder simulations.

What to measure

Report rate matters more than click rate. No organization gets clicks to zero, but if someone reports within ten minutes, IT can pull that message from every mailbox before anyone else opens it.

Training alone isn't enough

Training lowers risk, it doesn't remove it. Pair it with technical controls: MFA on every mailbox, email filtering that checks links at click time, DMARC on your domain, and finance procedures that don't depend on email.

The single procedure we recommend most: any change to a supplier's bank details must be confirmed by phone to a number already on file, and approved by two people. It costs nothing and stops most BEC fraud.

Keep attendance lists, topics and the results of each simulation round. Compared over a year, they show whether the program is actually working and which groups need more attention.

A 12-month program that fits a small IT team

When a report comes in: the first 30 minutes

The report button only helps if someone acts on it. A short routine for IT:

1. Check the message headers and the real link or attachment, in a safe way.
2. Search every mailbox for the same sender or subject and remove the copies.
3. Block the sender domain or the link at the email filter.
4. Ask who clicked or replied. Reset their passwords and revoke their sessions.
5. Check their sign-in logs, and look for new mailbox rules that forward or hide mail. Attackers create these within minutes of getting in.
6. Thank the person who reported it. That one sentence decides whether they report next time.

Start with one simulation

The quickest way to find out where you stand is one test phishing round in Lao or Thai that looks like what your staff really receive. Tell us how many staff you have and which languages they work in; we'll design the first round and a 15-minute session to walk through the results.