Online Course · Cybersecurity
Phishing 03: Email Phishing Awareness Training
Email is where many attacks begin. This module trains employees to slow down, inspect the clues and report suspicious messages before anyone clicks, pays or logs in.
Phishing Awareness Training Online, Focused on the Inbox
Phishing is a scam in which an attacker pretends to be a trusted person or organization to get someone to click a link, open an attachment, hand over a password or send money. This module of our phishing awareness training online concentrates on email, the channel most employees use every working day.
Learners study real-world patterns: the fake shipping notice, the urgent message from an executive, the shared document that asks for a login, the vendor whose bank details have "changed". By the end, they have a short checklist they can apply to any message that feels off.
Red Flags the Course Teaches
- Sender addresses that look close to a real domain but are slightly misspelled or use a free email service
- Urgency or threats, such as accounts being closed, deadlines in hours, or a boss who needs something right now
- Links whose real destination, shown on hover or long-press, does not match the text
- Unexpected attachments, especially compressed files, macros or documents asking you to enable content
- Requests to change payment details, buy gift cards or bypass normal approval steps
- Generic greetings, odd grammar or a tone that does not match the supposed sender
Types of Email Phishing Covered
-
Bulk phishing
Mass emails impersonating banks, delivery companies or popular services.
-
Spear phishing
Messages tailored to a specific person using details from social media or the company website.
-
Whaling
Attacks aimed at executives and others with authority to approve payments or access.
-
Business email compromise
Impersonation of a leader or supplier to redirect wire transfers or invoice payments.
-
Credential harvesting
Fake login pages for email, file sharing or payroll systems designed to capture passwords.
What to Do With a Suspicious Email
-
Pause
Do not click, reply, download or forward it to coworkers.
-
Verify separately
Contact the supposed sender using a phone number or address you already have, not one in the message.
-
Report it
Use your organization's report button or send it to the designated security contact.
-
Own a mistake quickly
If you already clicked or entered a password, report it right away so the account can be secured.
Who Should Take It
Anyone with a work email address. Finance and accounts payable staff, executive assistants, HR and payroll teams deserve particular attention because they handle money and personal data that attackers want. Field and plant employees who read email on a phone are also targets, and small screens make it harder to inspect links.
This course is part three of our phishing series. It builds on general concepts from Defining Cybersecurity and connects to social engineering awareness, which covers phone, text and in-person manipulation.
Building a Reporting Habit
The goal is not employees who never make mistakes; it is employees who report quickly and without fear. Leaders can support that by thanking people for reports, including false alarms, and by sharing anonymized examples of messages that were caught.
Assign the module online, record completions, and repeat phishing awareness on a regular schedule because attackers keep changing their tactics.
Email Phishing FAQs
Can a phishing email come from a real coworker's account?
Yes. If an account is compromised, attackers can send messages from it. That is why unusual requests should be verified even when the sender looks legitimate.
Is clicking a link always dangerous?
Not always, but some links lead to pages that steal passwords or download malware. Treat any link in an unexpected message with caution and report it.
What if I entered my password on a fake page?
Report it immediately and change the password as directed by IT. Multi-factor authentication, covered in our strong passwords course, limits the damage.
Do phishing simulations help?
Many organizations combine courses like this with simulated phishing emails to give people safe practice. If you run simulations, use them to coach rather than punish, so employees keep reporting.