Chapter 13 — Phishing and the help desk

Lesson map

Lesson 13 published. Map, example, EX049.

flowchart TD
  N0["Learning outcomes"]
  N1["13.1 Reports"]
  N2["13.2 When someone clicks"]
  N3["13.3 Awareness"]
  N4["13.4 Blame-free reporting"]
  N5["Checking a reported email"]
  N6["Payment change requests"]
  N7["Measuring reports"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX049"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["13.1 Reports"]
  N2["13.2 When someone clicks"]
  N3["13.3 Awareness"]
  N4["13.4 Blame-free reporting"]
  N5["Checking a reported email"]
  N6["Payment change requests"]
  N7["Measuring reports"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX049"]

[Learning outcomes]
    |
    v
[13.1 Reports]
    |
    v
[13.2 When someone clicks]
    |
    v
[13.3 Awareness]
    |
    v
[13.4 Blame-free reporting]
    |
    v
[Checking a reported email]
    |
    v
[Payment change requests]
    |
    v
[Measuring reports]
    |
    v
[Worked example] --> [Exercise EX049]

Learning outcomes

You will (1) recognise phishing reports; (2) respond to clicks; (3) support staff awareness.

13.1 Reports

Staff forward suspicious emails to a report address. Nadia checks headers and links without opening attachments, and the supplier blocks the sender if malicious. Checking headers and links without opening attachments lets Nadia judge a message safely. If it is malicious, the supplier blocks the sender and searches for similar messages in other mailboxes. Nadia thanks the reporter and records the message and outcome, so patterns, such as a wave of fake revenue authority emails, become visible. Lena receives a monthly count of reported messages and how many were malicious, which shows whether the tax-season tips are working.

13.2 When someone clicks

If a staff member entered their password on a fake page, Nadia resets the password, checks for new email forwarding rules and confirms MFA was not approved by mistake. Speed matters, because an attacker with the password could read email or set up rules to forward it. In one case, a staff member reported entering their password on a fake page, and within twenty minutes the password was reset and a new forwarding rule found and removed. Nadia records what happened and checks the account again a week later.

13.3 Awareness

Short monthly tips cover tax-season phishing, which targets accountants with fake revenue authority messages. Tax season is when accountants expect messages from the revenue authority, so fake ones are more convincing. Monthly tips keep staff alert without overwhelming them. Each tip includes a real-looking example and what to check, such as the sender's address. Nadia writes the tips and Lena sends them. Staff can reply with questions, which help Nadia choose the next tip. Each tip fits in a few lines, because busy accountants in tax season are unlikely to read a long security email.

13.4 Blame-free reporting

Staff who report a click quickly get thanks, not blame, so they keep reporting. If staff fear blame, they may hide a click, giving an attacker more time. Thanking people who report quickly encourages others to do the same. Lena states this clearly at a staff meeting. The staff member who reported entering their password on a fake page was thanked, and their quick report meant the attacker's forwarding rule was found and removed within twenty minutes. Nadia's records of reported clicks describe what happened and what was done, without naming the staff member, so reports cannot be used against anyone.

Checking a reported email

When an email is reported, Nadia looks at the sender's real address, the reply-to address and where links point by hovering over them. Messages that pretend to be from the tax authority but come from unrelated domains are blocked. She records each report briefly, building a picture of what the firm receives.

She never forwards suspicious attachments to colleagues; the supplier handles analysis in its own safe environment.

She replies to every reporter with a short thank-you and the outcome, which teaches staff what to look for next time.

Payment change requests

Accountants are targeted with emails asking to change a client's bank details. The firm's rule is that any change to payment details is confirmed by phone using a number already on file, never one in the email. Nadia includes this rule in the monthly tip.

This is a process control, not a technical one, and it stops a fraud that no filter can fully catch.

Staff are encouraged to call back even when the request seems to come from a known client, because compromised client mailboxes are common.

Measuring reports

Monthly counts help Lena see whether awareness is working. Nadia records the number of reported emails, how many were genuinely malicious and how many clicks were reported. More reports with fewer clicks is a good sign; fewer reports might mean less phishing or might mean people have stopped bothering, so the count is read alongside the quality of reports. She avoids naming individuals in the figures, because the aim is to encourage reporting. After three months, reports have doubled and the time from a click to its report has fallen from hours to minutes, which limits damage.

Worked example

A staff member reports entering their password on a fake login page; within twenty minutes the password is reset and a new forwarding rule found and removed.

Synthetic case. Events are synthetic.

Errors and limits

Blaming staff discourages reporting, so problems are found later.

Exercises

• EX049 — After a click. List three actions after a password is entered on a fake page.
  Show marking criteria

  Rubric: 3 = reset, check forwarding rules, check MFA;; 2 = two;; 1 = one;; 0 = none.
• EX050 — Safe inspection. How should Nadia inspect a reported email safely?
  Show marking criteria

  Rubric: 3 = headers and links, no attachments;; 2 = carefully;; 1 = open;; 0 = none.
• EX051 — Seasonal risk. Why mention tax season in awareness tips?
  Show marking criteria

  Rubric: 3 = targeted phishing then;; 2 = relevance;; 1 = vague;; 0 = none.
• EX052 — Blame effect. Why thank people who report clicks?
  Show marking criteria

  Rubric: 3 = encourages fast reporting;; 2 = nice;; 1 = vague;; 0 = none.

Synthesis

Fast, blame-free reporting limits the damage of phishing.

Continue studying — chapter 13 of 18

← Chapter 12 (draft) · Course chapter index · Chapter 14 (draft) →