After this training, you will recognize a fraud attempt in e-mail, text message, instant messenger and telephone conversation - and if something goes wrong, you will know what to do in the first minutes.
The attacker does not have to create a perfect message. All it takes is a moment of rush, routine or curiosity. Your job is not to become a detective. You are to interrupt the machine and check the request through a secure channel.
Phishing is not a spelling test. A good scam message may look error-free, know the context of the company, and come from a compromised, real account.
"Until 2:00 p.m.", "the account will be closed", "the president is waiting".
The boss, bank, human resources, administrator or well-known contractor.
Fear, opportunity, curiosity, helping someone, or wanting to avoid trouble.
“Is this message trying to get me to act faster than I would normally make this decision?”
The letter "l" instead of "i", the note "support" or the real name before a foreign domain are supposed to look familiar.
In the address, the part immediately before the ending counts, e.g. example.com. The padlock means encryption, not the integrity of the site.
The invoice number, boss's name and company footer may come from previous correspondence.
Instead of a link, open a familiar application, bookmark or manually entered address.
The short form hides the details. An unknown number may use a supervisor's name and a photo from the Internet.
The number on the screen can be faked. A real IT department doesn't need your password or MFA code.
QR is a link that cannot be seen until scanned. The poster in the office can also be changed.
Your friend's account may have been taken over. Judge an unusual request by the action it leads to - not just by the person on the screen.
The message promises a document → an HTML attachment or link opens a login page → the page captures the password → the scammer asks for MFA approval or uses a hijacked session.
.zip, .7z, .js, .exe, .iso and double extensions require special care. Don't try to "check" them yourself.
It may look like a form or login screen. Just because a file opens in a browser does not make it safe.
A document requesting "content inclusion" should stop the process and go to review.
Deny the request. Don't approve just to be on the safe side. Report a series of notifications as a possible password compromise.
In Business Email Compromise, the fraudster impersonates a contractor or decision-maker. The purpose is to transfer, change the account, disclose data or circumvent the procedure.
Call the number previously saved in the system or contract. Do not use the number provided in the suspicious message.
Don't bypass acceptance, limits, or the two-eyes rule. Job pressure is no exception.
In a case revealed by the US Department of Justice, fake emails, invoices and documents led two large technology companies to transfers exceeding $100 million. This was not a "naive user", but a convincing imitation of a normal business process.
CERT Polska described a campaign from 2025 in which the e-mail contained an HTML file. When opened, it displayed a fake email login screen. Lesson: an official topic and a familiar screen do not confirm authenticity.
In other campaigns observed by CERT Polska, simple, office topics led to archives and malicious files. Lesson: a routine document name can be more effective than a sensational promise.
In 2024, American authorities described a company that sent approximately $5.4 million following a message with an address confusingly similar to the contractor's address. Quick reporting allowed the authorities to trace and secure the funds. Lesson: Independent verification saves money, and quick reporting has real value.
None of these attacks required magical technology. Everyone performed a familiar action: logging in, opening a document or making a payment. Therefore, your best defense is a safe way to do something, not a list of "suspicious words."
Close the page, do not enter anything and report the link immediately. The click itself does not mean failure - silence makes it harder to respond.
Contact IT/SOC immediately through a known channel. Change your password via a secure route as directed by the company; do not approve further MFAs.
Stop working and call support. Do not remove traces or attempt to "clean" the computer yourself. Disconnect the network in accordance with the company's procedure.
Call your manager, finance, bank and security team immediately according to the incident plan. Minutes can be the difference between getting your funds back.
To pass: at least 10/12 answers and all four critical questions. After checking, you will see explanations.
The participant has completed this training and demonstrated the ability to recognise, verify and respond safely to phishing attempts.
This certificate confirms the skills demonstrated during the training; it does not guarantee protection against every future attack.