Guide
How to Stop Phishing and Scam Emails From Hurting Your Team
Filters catch most scams, people catch the rest. Make it easy and safe for staff to stop, check and report.
Why it matters
Email filters catch most scams, but the rest land in front of busy people. The scams that cost small organizations real money are rarely clever. They rely on urgency, a familiar name and someone too rushed to check.
Step by step
- Print the scam poster and post it where people work.
- Agree that any bank detail change or urgent payment is confirmed by phone on a known number.
- Run a short session on current scams: fake invoices, MFA prompts, AI voice calls, QR codes.
- Thank people who report, even false alarms. Never shame a click.
- Check that SPF, DKIM and DMARC are set up for your email domain.
Common mistakes
- Training once a year and never talking about scams again
- Shaming people who click, so nobody reports
- Changing bank details because an email asked
- No SPF, DKIM and DMARC on your email domain
Free tools for this
Stop. Check. Report. Scam poster
Eight red flags and three steps. Print it and post it near desks.
MFA Readiness Checklist
Get every person ready for MFA, with the methods ranked strongest first.
A real case
Agencies facing a statewide MFA requirement
- Situation
- Energy assistance agencies across California must use MFA for ServTraq and CALIHEAPApply starting in January.
- What was done
- Spoke at the ServTraq Innovation Summit on why security starts with MFA, and published a free readiness checklist for agencies.
- Result
- Agencies have a free, practical checklist to get their staff ready ahead of the deadline.
Questions people ask
Can scammers fake the voice or video of our director?
Yes. The FBI has warned that criminals use AI to clone voices and create video to impersonate people staff trust. For any urgent request for money or data, hang up and call back on a number you already have, and agree on a code phrase for emergencies.
Someone says they are from IT and asks for a code or an MFA reset. What now?
Stop. Real IT staff never need your code. Hang up and call IT back on a known number. Attackers also call help desks pretending to be staff, so whoever resets passwords or MFA should confirm identity through a second channel first.
Are QR codes safe to scan?
Treat a QR code like a link from a stranger. Be careful with codes in emails, texts and on stickers placed over real ones, such as on parking meters. If a code asks you to sign in or pay, go to the site yourself instead.
What is business email compromise, and how big is the risk?
A scammer takes over or imitates an email account, then asks for a payment, a bank detail change or gift cards. The FBI 2025 Internet Crime Report counted about $3 billion in reported losses from it in one year. The best defenses are cheap: MFA on email, DMARC, two people to approve payments, and a phone call to a known number before any bank change.
Not sure where to start?
One conversation and a straight answer about where your organization stands. No cost, no commitment, no pitch.