A few years ago we taught employees to recognise phishing emails by simple signs: spelling mistakes, awkward language, a generic greeting such as “Dear customer”, a suspicious sender address. It worked because most emails were machine-translated and written by people who did not speak the recipient’s language.
In 2026 that rule no longer works. AI language models write fluently in your language, match the tone of a company’s public texts, and know what your manager is called and when the annual close takes place. An email that would once have looked like an obvious scam now looks like an ordinary request from a colleague.
In this article we describe what current emails look like, which scenarios are most common in the companies we work with, which technical controls stop most of them before they reach an employee, and how to train people so that they report instead of hiding.
Why the old signs no longer work
Four things have changed.
Language. A model produces an email without errors, with correct grammar and company jargon. If you publish news or job ads, it will copy your style.
Context. From social networks, the company website and public registers, an attacker learns within minutes who the finance manager is, who the accountant is, and who is a new employee (and therefore does not yet know the usual processes). The email addresses the person by name and mentions a real project.
Scale. Previously a personalised email required human time, so it was reserved for large companies. Now personalisation is automatic, so a company with 15 employees receives an email of the same quality as a bank.
Channels. The email is increasingly only the beginning: it is followed by a Teams message, a phone call or an SMS, so that the request looks confirmed from several sides. An employee who is used to checking only email does not verify the other channels.
The conclusion for training: stop teaching people to look for mistakes. Teach them to recognise the situation: an unusual request, urgency and a change of channel.
Three scenarios we see most often
Executive impersonation
An accountant receives an email from the “director”: I am in a meeting and cannot talk, an invoice for a partner needs to be paid urgently, I am attaching it, confirm when done. The sender address is either very similar to the real one (one letter differs) or genuine, but with a changed reply address (Reply-To). Increasingly the email is continued with an SMS or even a phone call with a synthesized voice of the executive. A sign worth remembering: a real executive who needs an urgent payment will call personally. An email that asks you not to call is already suspicious.
Changed bank details
A supplier you have worked with for a year sends an email: our bank account has changed, please send future payments to the new one. Often the email comes from the supplier’s real mailbox, because the attacker first broke into the supplier and read the correspondence for several weeks. They know which invoices are expected and when.
QR codes
An email with a QR code: your Microsoft 365 password is about to expire, scan the code and renew it. Mail filters check links, but a QR code is an image, and the link inside it is invisible to the filter. The employee scans it with a phone, which is often not company-managed and has no protection, and lands on a fake login page. HTML attachments and links to legitimate file-sharing services that host a fake login form work in a similar way: the filter sees a known domain and lets the email through.
What they have in common: none of the scenarios needs a technical vulnerability. They only need one person in a hurry.
Technical controls that stop most of them
The employee should be the last line of defence, not the first. For our clients we implement as standard:
- Email authentication: SPF, DKIM and DMARC with a reject policy for your domain. This prevents emails being sent in your name from foreign servers and, conversely, lets your filter reject emails impersonating suppliers who have protected their own domain.
- Microsoft 365 anti-phishing protection: link rewriting and checking at click time, opening attachments in an isolated environment, detection of executive impersonation by name similarity, and a warning banner on external emails. We describe this on the Microsoft 365 security page.
- Multi-factor authentication with phishing-resistant methods and conditional access through Microsoft Entra ID. Even if an employee enters a password on a fake page, the attacker cannot sign in without the second factor.
- A report button in the mail client. One click on “Report phishing” sends the email to our team, which checks it and, if needed, removes it from all mailboxes. This is the most important control for culture: reporting must be easier than ignoring.
- A payment process outside email. A change of bank details is confirmed by a call to a known number, not by replying to the email. This is a finance rule, not an IT rule, but it stops the most damage.
None of these controls works one hundred percent, but together they reduce the number of emails reaching the employee so far that the rest can be discussed in training as concrete examples, not abstract threats. For mobile devices on which QR codes are scanned, the same applies through device management and browser protection on the phone.
Simulations and training without shaming
Phishing simulations, where the company sends employees fake emails and measures who clicked, are useful but often done badly. Badly looks like this: an unannounced simulation with a very convincing email, a public list of people who clicked, mandatory training as a punishment. The result is that employees fear the IT department and, when they really do click a real email, stay silent, which is the worst thing that can happen.
In our experience a different approach works:
- First announce that simulations will take place and explain why. Surprise is not the goal.
- Measure not clicks but the share of reports. The goal is for more people to press “Report”, not for fewer people to click the link.
- Show the person who clicked a short explanation right away, on the spot: what was unusual in the email. Two minutes at that moment are worth more than an hour of training a month later.
- Publish results only at department or company level, never by name.
- Keep training short and frequent: 10 minutes every quarter with real examples from your own mail, not an hour-long lecture once a year.
- When an employee reports a real email, thank them publicly. It is the only way to get more reports.
In a real incident the first reaction matters most: an employee who called within 10 minutes and said “I think I entered my password” gives time to change the password and terminate sessions. One who stayed silent for two days does not.
That is why the first rule we repeat in every training is: nobody is punished for reporting their own mistake. When employees believe this, an incident costs hours, not weeks.
Where to start
- Check your domain’s DMARC policy. If there is none, or it is set only to monitor, anyone can write in your name.
- Enable the report button for everyone and agree who reviews the reports the same day.
- Confirm with the finance department a written rule: bank details are changed only by a call to a known number.
- Plan the first simulation with an advance announcement and a short explanation for those who click.
- If you have nobody to look after this continuously, email protection configuration, review of reports and quarterly simulations are included in our managed IT services, and we carry out a broader assessment of people and processes as an IT security audit.
