Training staff to verify a caller before acting on a request

Teach staff one rule for phone and chat requests: never act on a sensitive request using only the channel it arrived on. Verify by contacting the person through a method you already have on file. CISA's phishing guidance says the same: do not use anything in the suspicious message to verify it.

The threat

Callers impersonate executives, vendors and employees to get password resets, payment changes and data. Urgency is the main tool. CISA lists strange or unexpected requests and urgent language meant to rush you among the signs of phishing, and the same signs apply by phone.

The one routine

For any request that changes money, access or data:

1. Pause. Say "I will call you back to confirm."
2. Look up the person's number from your own directory, not from the message or caller ID.
3. Call back and confirm the request.
4. Record that you verified and how.

CISA's guidance describes looking up a sender's phone number with a search engine or using a contact method you already have on file.

Where to apply it

• Help desk: password resets and multi factor changes. Require callback to the number in the directory or manager approval.
• Finance: bank detail changes or urgent transfers. Callback to a number from the original contract.
• Support: account email changes and data exports.
• Executive assistants: requests that claim to come from the boss.

Make it socially safe

Staff fear annoying a senior person. Give them cover: leaders announce that they will always be verified and thank people who do. Write a script: "Our policy is that I verify all payment changes. I will call you back in a minute."

Practice it

Run a short role play. One person plays an urgent caller, another practices the script. Do it for ten minutes at the start of a team meeting. Repeat each quarter with a new pretext.

Add technical backing

• Block password reset by phone alone.
• Require a second approver for payment changes.
• Log reset requests and review unusual ones.

What if they were fooled

Provide a no blame route to report quickly. CISA advises changing passwords immediately if you suspect phishing and then reporting. Speed matters more than embarrassment.

Quick check

Sources

• CISA, Teach employees to avoid phishing

Last reviewed: 19 October 2026.