Phishing awareness skills
every employee needs

Security awareness is the everyday ability to recognise and resist social engineering. It covers phishing emails, smishing (texts and messaging apps), vishing (calls, now often with AI-cloned voices), QR-code phishing, fake login pages, business email compromise and invoice fraud, deepfake video and voice, malicious attachments and USB drops, and physical tailgating. It also includes secure habits: multi-factor authentication, password managers, updating devices, careful data sharing and quick reporting.

The threat is evolving fast. Verizon's 2026 Data Breach Investigations Report finds mobile devices are now a favoured target, with 40% higher click rates for mobile phishing, and notes attackers are using generative AI across many techniques.¹ CISA urges everyone to turn on multi-factor authentication, which stops many attacks that rely on stolen passwords.² In India, CERT-In's 2022 directions require organisations to report specified cyber incidents within six hours of noticing them, which makes fast employee reporting essential.³ The Anti-Phishing Working Group publishes regular reports tracking phishing trends.⁴ Awareness also opens doors: security analysts in India typically earn ₹6.5–7.2 lakh, according to AmbitionBox.⁵

Higher click rates for mobile phishing (Verizon DBIR 2026)

40%

CERT-In reporting window for specified incidents

6 hours

Typical security analyst pay in India (AmbitionBox)

₹6.5–7.2 lakh

Alert employee needed to stop a scam

1

Table: How security awareness is assessed (editorial summary)

Table: Clues in a business email compromise attempt (illustrative)

Table: How social engineering evolved (editorial summary)

• Recognise ten common phishing clues
• MFA on work and personal accounts
• A password manager in use
• Know how and where to report
• A verification habit for payment requests
• A verified security awareness certificate

Mention security habits where relevant to the role — for finance and admin roles especially: "Completed security awareness training; identified and reported a business email compromise attempt."

"How would you handle an urgent payment request from the CEO?"

Follow the normal approval process and verify through a known, separate channel.

"What makes a link suspicious?"

Lookalike domains, shortened URLs, mismatched text and destination, and unexpected requests to log in.

"What would you do if you clicked something suspicious?"

Report immediately, disconnect if advised and change passwords as instructed.

"Why is MFA important?"

It blocks most attacks that rely only on stolen passwords.

"How do you spot a deepfake call?"

Unusual requests, pressure and secrecy are bigger clues than audio quality; always verify independently.

• "How do employees report suspicious messages?" — process.
• "Is there regular awareness training?" — culture.
• "How are payment changes verified?" — controls.
• "Is MFA used for all systems?" — maturity.

Table: Roles where security awareness matters most and typical pay in India (AmbitionBox, October 2026; indicative)

Table: Everyday security tools and habits (editorial guidance)

Awareness is a skill for every role, and can lead into security:

• Security champion — helps colleagues in a team.
• Awareness coordinator — runs training and simulations.
• Security analyst — investigates reported phishing.
• Security awareness lead — human risk programmes.
• Security manager — wider security leadership.

1. Days 1–3: Learn — Study warning signs; set up MFA and a password manager.
2. Days 4–5: Practise — Review real examples; agree verification steps with your team.
3. Days 6–7: Prove it — Take the Security Awareness and Phishing Detection Certification.

Related: Cybersecurity Fundamentals, Privacy and Data Protection and AI Information Verification. Guides: cybersecurity fundamentals, data protection and AI information verification.

• Checking — sender, links and requests.
• Verifying — unusual payment or data requests.
• Reporting — suspicious messages.
• Protecting — passwords and MFA.
• Sharing safely — the right data with the right people.
• Locking — screens and devices.

"What's business email compromise?"

Impersonating executives or suppliers by email to redirect payments or steal data.

"Is it safe to scan QR codes?"

Only from trusted sources; check the destination URL before entering any details.

Table: A first-90-days plan for security champions (editorial guidance)

Champions make security practical. Share real examples (with sensitive details removed), make reporting easy and praise people who report. Work with finance or HR to make verification steps part of normal process.

Generative AI makes phishing emails fluent, personalised and free of the spelling mistakes people used to rely on. Voice cloning and deepfake video allow convincing impersonation of executives and family members. That means the old advice — look for bad grammar — no longer works. Focus on behaviour and process instead: urgency, secrecy, unusual requests and channel switching. Organisations are responding with stricter verification rules, code words for sensitive requests and AI-based email filtering. Employees who understand these patterns become an important part of defence.

Agree simple rules with your team: any change to bank details, any urgent payment and any request for sensitive data must be verified through a known contact method — a phone number from the company directory, not from the message. Use a second approver for large payments. If someone pressures you to skip the process, treat that as a red flag. Make it normal and respected to say, "I'll call you back to confirm."

"Only careless people fall for it." Well-crafted attacks fool experienced professionals; process protects everyone.

"Reporting a mistake gets me in trouble." Good organisations want fast reports; delays cause the real damage.

"Antivirus will catch it." Many scams involve no malware at all — just persuasion.

Good awareness programmes measure behaviour, not just course completion. The key measures are how many people report suspicious messages, how quickly they report and how many risky actions — clicks, credential entries, payment changes — happen in simulations and real incidents. Reporting rates matter most, because one early report lets the security team protect everyone else.

Simulations should be realistic but fair, followed by short, supportive learning rather than shaming. Role-specific exercises for finance, HR and executive assistants focus on the scams they actually face. Over time, organisations look for rising report rates and falling risky actions, especially for the most targeted teams.

• Trusting caller ID or display names.
• Using contact details from the message.
• Skipping MFA.
• Delaying reports out of embarrassment.
• Sharing data over informal channels.

Phishing trends come from Verizon's 2026 DBIR and APWG; MFA guidance from CISA; India's reporting requirements from CERT-In's 2022 directions; and India pay from AmbitionBox (read October 2026). The scenario, clue table and history are editorial. Science of Apps publishes the free test linked here. Last reviewed October 2026.

• Phishing — deceptive messages to steal data or money.
• Smishing / vishing — phishing by text or voice.
• Business email compromise — impersonation to redirect payments.
• Deepfake — AI-generated fake audio or video.
• MFA — multi-factor authentication.