Phishing training for employees: how Québec businesses can stop the click

Most cyberattacks on small businesses do not start with a hacker breaking through a firewall. They start with an email, a text or a phone call that convinces someone on the team to click a link, open an attachment or send a payment. That is phishing, and it works because it targets people, not systems.

The good news: people can learn to spot it. Here is what to teach, how to practise and what to do when someone does click.

Why phishing still works

Modern phishing messages are well written, often in good French, and increasingly personalized with details found online: your suppliers, your colleagues' names, the software you use. AI tools have made them cheaper to produce and harder to tell apart from real messages.

The most common scenarios for Québec businesses:

• Fake invoices or payment changes: a "supplier" announces new banking details.
• CEO fraud: an urgent message from "the boss" asking for a transfer or gift cards.
• Account alerts: a fake Microsoft 365, Google or bank login page.
• Delivery and government texts: a parcel waiting, a tax refund, a fine to pay.

The warning signs to teach

Train everyone to pause when a message has one or more of these traits:

• Urgency or pressure: "today", "immediately", "your account will be closed".
• A request that breaks the usual process: new banking details, a payment by gift card, a password requested by email.
• A sender that is almost right: an address with one extra letter, or a display name that does not match the address.
• A link that does not go where it says: hover over it (or long-press on a phone) before clicking.
• An unexpected attachment, especially a compressed file or a document asking to "enable content".

And one rule above all: verify through another channel. If a supplier changes their banking details, call them at the number you already have, not the one in the email.

Why one-off training is not enough

A yearly presentation fades within weeks. What changes behaviour is regular, short practice:

• Short modules of a few minutes, spread over the year.
• Realistic simulations: harmless fake phishing emails sent to the team, to see who clicks and teach on the spot.
• No blame: the goal is to learn, not to punish. People who are afraid of being blamed hide their mistakes, and hidden mistakes are the expensive ones.
• Track progress: the click rate on simulations and, more importantly, the reporting rate, how many people flag suspicious messages.

What to do after a click

Make the response plan simple and known by everyone:

1. Report it immediately to your IT contact or manager. Speed matters more than anything.
2. Change the password of the affected account and turn on two-factor authentication if it is not already.
3. Disconnect the device from the network if a file was opened.
4. Call the bank right away if a payment was made.
5. Report the fraud to the Canadian Anti-Fraud Centre. Suspicious texts can be forwarded to 7726.

If client or employee personal information may have been exposed, Law 25 applies: the incident must be recorded, and if it presents a risk of serious injury, the Commission d'accès à l'information and the people affected must be notified.

Technical protections that back up training

Training reduces clicks; technology reduces the damage when one gets through:

• Two-factor authentication on email and every important account.
• SPF, DKIM and DMARC on your domain, so criminals cannot easily send email in your name.
• Up-to-date devices and software, and backups stored separately.

How NeoLabs helps

We deliver phishing simulation training with our partner SensibiliseMoi, a free Québec cyber awareness program, and secure the technical side: email authentication, website security and access. Book a free call to set up a program for your team.