At 4:47 on a Monday, Marta received a message that appeared to come from her director. It did not request an outrageous transfer or contain a clumsy threat. It simply asked her to bring forward a supplier review because “the committee needs to close today.” Marta knew that phrase, knew the committee met on Tuesdays, and had a queue of twelve legitimate matters in front of her. What stopped the transaction was not a recent awareness campaign or a gift for spotting spelling mistakes. It was an ordinary work detail: any change to a supplier bank account required a request in the purchasing tool, and that request automatically alerted two people outside the director’s reporting line.
That small bit of friction can look like bureaucracy when everything is calm. In practice, it is a way of sharing doubt. Digital fraud that speaks like us succeeds when it gets one person to resolve a seemingly ordinary emergency alone. Once the first burst of cybersecurity enthusiasm has faded, the challenge is not remembering a slogan. It is deciding which rules still protect someone who is rushed, wants to help, and is acting in good faith toward the voice on the screen.
Imitation exploits how work is designed#
For years, people were taught to look for visible tells: an unusual sender, a blurry logo, an awkwardly translated sentence. Those clues still matter, but they are no longer enough. Someone impersonating a colleague may have watched public posts, organizational charts, leaked invoices, or forwarded conversations. They can write in the team’s polite register, name a real project, and choose the hour when everyone is trying to finish something. The message does not need to be perfect; it needs to fit well enough into a crowded routine.
For years, people were taught to look for visible tells: an unusual sender, a blurry logo, an awkwardly translated sentence.
That is why it helps to stop asking, “Can this person spot a scam?” The more useful question is, “What can this person do without anyone else seeing the decision?” If one email can change banking details, disclose a client list, or grant temporary access, the system gives too much authority to a single coincidence. Training can sharpen judgment, but it should not be the final barrier between an imitated identity and an irreversible action.
Marta did not have to prove that she was cleverer than an attacker. She could say, “I’ll handle it through the purchasing workflow,” without challenging her director or accusing anyone. That distinction matters. A defense that requires arguing about the authenticity of every message turns verification into a social confrontation. A defense built into the process makes checking possible without humiliation, because the rule is the same even when the message is entirely genuine.
Build routes that do not rely on the incoming channel#
An organization needs to separate receiving an instruction from authorizing an action. The first may arrive by email, chat, phone, or meeting. The second should happen through a known route, with a record and a second check proportionate to the likely harm. This does not mean turning every small purchase into an endless case file. It means identifying decisions that change money, access, data, or reputation, and giving them a path that is independent from the message that triggered them.
A change to payment details is a simple example. The request can start a review, but it should never complete the change by itself. The team verifies the information against a phone number already stored in the contract, not a number contained in the email; checks that the request belongs to an existing order; and records who confirmed it and when. For a small supplier, the process may be a call and a short record. For larger sums, it may include dual approval and a hold before the first payment. The scale should answer the risk, not the anxiety of looking controlled.
The same separation is useful for password resets, new accounts, and sensitive document sharing. A manager’s message may explain why something is urgent, but it cannot replace confirmation inside the identity system. A file sent through chat may begin a discussion, but it should not be the only place from which personal information is shared. These distinctions are not distrust of people. They protect people from having to be correct every time while under pressure.
Make the pause a practice, not an act of heroism#
“Take your time” is not much help to someone with five minutes to answer a client. A useful pause needs a concrete shape. Some teams create three fixed questions for every unexpected request: What action would change after I respond? Why must it happen today? Which independent channel can confirm the instruction? Those questions fit on a note beside a screen or in an approval form. Their value is that they do not require anyone to remember a huge catalogue of threats.
An organization can also agree on phrases that reduce social pressure. “To protect both sides, I’ll confirm this through the usual channel” works better than “I don’t trust this email.” “I need to open the ticket before granting access” keeps a requester from feeling that their authority is being challenged. Language matters because scams exploit the wish to appear quick, obedient, and capable. When a team has a respectful, repeatable response, pausing stops being an individual oddity.
Not every emergency is false. That is exactly why a good procedure must let real emergencies move forward. There may be an on-call contact, a rapid approval path, and a way to document an emergency intervention afterward. The difference is that the exception is declared and reviewed; it is not hidden inside a persuasive message. When any urgency can bypass controls, an attacker only has to learn how to sound urgent.
Rehearse the edges of the process#
The most useful exercises do not surprise staff just to count who failed. That approach can teach people to hide mistakes. It is more valuable to rehearse scenes that reveal where the process is ambiguous: a director writing from another country, a supplier changing domains after a merger, an intern asked to download a list, or a technician requesting access while a service is down. The point is to see which route the team would follow and where it needs a clearer rule.
After an exercise, ask what made verification difficult. Perhaps contractual phone numbers are out of date. Perhaps nobody knows who can approve an exception. Perhaps the purchasing tool is so slow that people avoid it. These findings are not moral failures by participants; they are design work. A control that only works in a presentation but blocks the real workday will eventually be surrounded by workarounds.
Recording decisions supports learning without turning records into surveillance. It is enough to note the type of request, the verification point used, the time it took, and the improvement proposed. There is no need to retain private conversations or attach a doubt to a particular person. A few monthly reviews can reveal patterns: account changes that always arrive on Fridays, permissions granted without expiry, or teams without a second contact route.
Care for the person who raises a hand#
Trust erodes when reporting a suspicion brings embarrassment, blame, or an unfair assessment. The person who received Marta’s message might instead have been someone who already clicked, disclosed data, or started a payment. At that point, the most useful response is to reduce harm and preserve information: alert the appropriate team, stop what can still be reversed, note the facts, and decide what communication the supplier or financial institution needs. Looking for a culprit before understanding the scope usually delays containment.
Care does not mean ignoring responsibility. It means separating deliberate conduct from an error made easier by a confusing system. If a procedure is bypassed repeatedly, it may need training, better tools, or clearer limits. But a culture that punishes every admission receives incidents late, when they are more expensive and harder to investigate. Trust grows when someone can say, “This does not add up,” or “I made a mistake,” and knows they will be supported in acting.
It also matters to communicate what was learned without dramatizing it. A short notice can explain that an impersonation occurred, which route caught it, and what will change now. It need not reproduce the fraudulent message or expose anyone. In that way, the episode leaves a specific improvement instead of feeding the sense that fraud is a mysterious force that requires distrusting everything.
Measure whether protection survives the campaign#
When an awareness initiative ends, many organizations count how many people completed a course. That is useful information, but it does not answer the decisive question: how many sensitive actions have an independent check that works under normal conditions? A sample of supplier changes, new accounts, file shares, and exceptional payments can be reviewed. Teams can measure how long legitimate confirmations take and how many exceptions remain undocumented. The purpose is not to create an obedience score; it is to find where a person is once again alone in front of a plausible imitation.
The next step for a team is not another poster. It is choosing one routine decision and tracing it from start to finish. Who can initiate it? What data changes? What evidence is kept? Who confirms it through a different channel? How is a real emergency handled? If any answer depends on “the person noticing,” there is a chance to redesign.
After enthusiasm passes, what remains is the architecture of small gestures: opening the ticket, calling the known number back, asking for a second look, admitting doubt. That is where resilience is decided. Mature security does not demand heroes who never make a mistake; it creates conditions in which a copied identity cannot govern an important decision on its own.
