How to train employees to spot phishing (5 steps)

You do not need a big budget to cut your phishing risk. You need a plan people can follow. Here is how to train employees to spot phishing in 5 steps.

Step 1: What should you teach employees about phishing?

Teach four signs and one habit. CISA lists four signs of phishing. We teach them in plain words:

1. A rush or a threat. “Act now or lose your account.”
2. A request for money, logins or personal details.
3. A strange link. A shortened link you do not trust.
4. A lookalike address. A sender or link that imitates a real one.

Add one more habit from experience: an odd ask from someone you know, like the boss who wants gift cards or a vendor with a new bank account. Check it first.

CISA also warns that poor spelling is no longer a reliable sign, because AI can write clean messages. So teach the behaviour, not just the typos.

Step 2: How should employees report phishing?

Give them one place to report, and make it safe. Choose a “report phishing” button, a shared inbox, or a name on a sticky note. NIST’s small business guidance says to teach employees to report suspected or actual incidents, including if they think they already fell for one.

Then say thank you every time, even when it is a false alarm. People hide a click when they fear blame, and hidden clicks do the most damage.

Step 3: What is the check-first habit?

When a message asks for money, a password or a bank detail change, do not use the link or number in it.

• Contact the person with a number or site you already have.
• Ask a second person to approve any payment change.
• If in doubt, ask. Asking is never wrong.

This stops most business email scams. See Business email compromise: how small firms get tricked.

Step 4: How do you practise with safe test emails?

Send a fake email, in a calm moment, and teach right after a click. A short video is good. Practice is better. A safe test email lets staff meet a fake with no real risk.

A free way to start: request a free phishing risk test for up to 25 staff. For ongoing practice, see our phishing simulation program. For test ideas, read phishing test ideas for offices. Start with one scenario and one habit.

Step 5: What should you measure?

Measure whether people report, not only whether they click.

Measure	Why it helps
Report rate	Shows people are looking and speaking up
Click rate	Shows who needs more help
Time to report	Shows how fast you can respond
Repeat clickers	Shows who needs a short follow-up lesson

If the report rate goes up and the click rate goes down, your training is working.

Short and often beats long and rare

A simple yearly rhythm

• Week 1: 15-minute kickoff for all staff.
• Every month: one 5-minute lesson and one practice email.
• Every quarter: look at the numbers and pick one topic to fix.
• Every year: refresh the checklist and save the records.

What about a team that is not on email all day?

Teach the same signs for texts, calls and QR codes. NIST reminds us that email is not the only way to get phished. See text and QR code scams and how often to train.

Common mistakes

• One long talk a year, then nothing.
• Shaming the person who clicked.
• Testing with no lesson after the click.
• Counting clicks only, and ignoring reports.
• No record of who was trained and when.

Want a ready-made list? Use our security awareness checklist. Prices and plans are on our pricing page, or book a free demo.

Looking for the platform side? Skillermatic, which powers our training, has a buyer guide to security awareness training platforms.