Brief: training video “How to spot a phishing email”
Goal and scope
A short training video for employees on how to spot a fraudulent email. The company has recently been receiving messages that pretend to come from Microsoft. Using one concrete example, the video should show what to look out for and what to do.
- Length: about 2.5 minutes.
- Presenter: an avatar who introduces himself as Honza, the person responsible for security.
- Visuals: illustrative images for each point, next to the avatar.
- Use: training for new employees and sharing with all colleagues.
Intro
Honza introduces himself and says he’ll show how to recognise a fraudulent email pretending to come from Microsoft.
Example of a fraudulent email
An employee receives an email about suspicious activity on their account. Unless they confirm their identity within 24 hours, the account will supposedly be blocked. The message looks like an official notice: the sender is Microsoft, the subject mentions unusual sign-in activity, it lists sign-in details and has a “Verify account” button. The video then goes step by step through the signs that give the fraud away.
1. Sender
Anyone can use Microsoft as the sender’s display name. The address looks right at first glance but hides one important difference: the letter “c” in Microsoft is actually a Cyrillic character. It looks almost the same, but it’s a different character and therefore a different web address. The homograph attack must be explained so that people without a technical background understand it. The video must not claim that the address looks like this in every app, because each program may display it differently.
2. Time pressure
The threat of a block within 24 hours is meant to make people act in a hurry and without checking. That’s exactly what scammers count on.
3. Link
The button offers to verify the account but can lead somewhere else entirely. The video shows that on a computer you just hover over the link without clicking and check its real address; on a phone you press and hold the link. For comparison, it also shows the genuine Microsoft 365 sign-in address.
4. Fake sign-in
The link may open a fake Microsoft 365 sign-in page. Anyone who enters a password or verification code there may hand them to attackers. Even the padlock in the address bar doesn’t guarantee you’re on the right site; it only means the connection is encrypted.
5. Spelling
The video dispels the idea that you can spot a fraudulent email by its spelling mistakes. Today such messages are often written flawlessly. It’s more important to check the sender, the links and any unexpected requests.
What to do
- Don’t click a suspicious link.
- Open Microsoft 365 directly through its known address or app.
- Report the email to the IT department.
- Anyone who has already entered their details tells IT immediately and follows their instructions.
Closing
A short outro with the easy-to-remember slogan “Don’t click. Verify. Report.”
Requirements for the examples
- All emails, addresses and pages in the video are for illustration only and clearly labelled as examples of fraud.
- No real employee addresses.
- Nothing that can be clicked.
Supporting materials
There are no graphics for the individual points. The supplier will create them.
