Update Details: A new Business Health and Compliance update has been issued on Spotting Phishing and Scams. The full article has been emailed to subscribers with the Business Health and Compliance preference and is available as a PDF on the Business Health and Compliance Updates page.
Why Spotting Phishing and Scams Matters
The phishing email that costs a business money rarely looks like a scam. It looks like a supplier writing to say their bank details have changed, or a director asking for a quick payment before a meeting. Phishing and social engineering work on people rather than on systems, and they arrive by text, by phone and in person as well as by email, which is why good technical security on its own doesn't stop them.
What the Phishing and Scams Update Covers
The update starts with a risk assessment: which channels reach your staff, who can make payments or change bank details, and what would happen if one convincing message got through. It then sets out where the exposure usually sits, from bulk phishing and fake login pages to targeted payment requests aimed at finance and senior staff, and the scams that come by text, phone call and QR code.
A proportionate set of controls follows, with the emphasis on simple checks that anyone can apply and nobody gets to skip, and on making it easy for staff to report a suspect message or a mistake. A closing section covers where ISO 27001 fits, and why significant risks belong on a risks register alongside everything else.
Getting the Full Phishing and Scams Update
The full update, along with the supporting documents and example risk assessment for managing phishing and social engineering, is provided to subscribers as part of the update service.
Business Health and Compliance updates are issued as part of the ISO and legal update service, so each issue is emailed to subscribers as it is published. Every issue is also listed on the Business Health and Compliance Updates page, where anyone can see what has been covered and alphaZ subscribers can download the updates in pdf format, for topic-specific training or for sending out to workers.
