Back to Phishing

To keep a copy, print this page or save it as a PDF from your browser.

Salmini Checklist1 page

Communication Security · Phishing

Phishing checklist

Who leads Whoever looks after digital security Name

Use it when

everyone should know the payment rule and the five habits, someone new is joining, or a convincing fake has just done the rounds.

The payment rule

New bank details, a new payee or an urgent payment? Call first, on a number you already have, before any money moves. The director included.

Five habits for everyone

Pause when a message pushes you. Deadlines, threats and prizes are there to stop you thinking.
Check who really sent it. Read the full address, not just the name shown.
Look before you open a link. Hover over it, or press and hold on a phone, to see where it goes.
Confirm unusual requests another way, on a number you already have.
Report it, even after clicking. An early report protects the whole team.

Two signs people miss

A “security” alert that asks you to approve an app. Approving it can hand over your email.
A familiar voice asking for money. Voices can be copied with AI, so call back on a number you have.

If someone already clicked

Tell your security champion straight away, even if you’re not sure.
Keep the message. Don’t delete it or forward it.
Typed a password? Change it now, and anywhere else you used it.
Money gone? Call the bank, then follow the Clicked a bad link playbook.

Where we report

Report suspicious messages to
Backup if they can't be reached

Take care: Thank everyone who reports, false alarms included. Fear of blame is what keeps clicks hidden.

Started Done Review again