How pressure changes a decision
Social engineering targets trust and workflows. A message may request changed payment details, a one-time code or an urgent attachment opening. Identify the requested action and required authority instead of relying on spelling mistakes.
Familiar names, logos, voices and context can be imitated. High-risk requests need an independent confirmation point. Use an established directory or a previously saved contact, not a new phone number or link supplied by the message.
Further reading: CISA: Recognize and Report Phishing
Make pausing part of normal work
When suspicious, do not enter credentials, share codes or ask others to try the attachment. Report through the organization’s process and preserve the necessary message. If interaction already occurred, state when and what happened so responders can decide whether session revocation or other actions are needed.
One clue usually does not prove malicious intent. Report a request requiring independent verification without making unsupported accusations about the sender. The goal is to let legitimate work proceed through a verifiable process.
Example: a manager requests new payment details
A fictional message claims a manager is in a meeting, demands an immediate supplier payment-account change and supplies a new number for confirmation.
Urgency and authority pressure the recipient to bypass procedure. Calling the number in that message leaves both interactions controlled by the same untrusted source.
Conclusion: Verify through the established directory and payment-change process before changing details.
Tabletop exercise: choose an independent check
Analyze the fictional message only; contact no real person and make no payment.
- Identify the exact requested action and impact.
- Compare the supplied number with an established directory and mark the independent route.
- Write a pause-and-report note naming what needs confirmation.
Expected result
The established directory provides an independent source; the number in the message does not.
Check your work
Would your verification process still apply if the message had perfect grammar?
Finish and clean up
Save the exercise note without storing or sharing real personal data.