Phishing and deepfakes: the rule and training that protect a team

• Writing Messages in fluent Portuguese, with the tone and signature of the person they impersonate.
• Cloned voice A short clip of public audio (an interview, a LinkedIn video) is enough to have a manager "call" asking for a payment.
• Video Faces synthesised in real time have already been used in video calls to approve transfers at European companies.

The technique varies; the pattern does not. There is always urgency and there is always hierarchy: someone with authority demands something immediate, outside the usual process.

Confirm through another channel. Training only to recognise fraud fails, because some of it is impossible to recognise. Protection has to work even when nobody is suspicious: every payment, change of bank details or release of sensitive information is validated through a second channel, with a contact already on record.

The supplier sent a new IBAN? Call the number in the contract. The CEO asked for a transfer on a video call? Call their mobile. When the rule has no exceptions, not even for management, the perfection of the impersonation becomes irrelevant. More detail in the article on the altered-IBAN invoice fraud.

Little time, often

Two hours a year are forgotten within a month. What works is 15 to 20-minute sessions every two or three months, each on one topic: email, phone, video calls, social media, USB sticks and files. With real examples, ideally attempts the company itself received, without identifying anyone. Nobody remembers a slide; everyone remembers the fake utility email that reached the colleague at the next desk.

Simulate to teach, not to shame

Anyone who falls for a simulation gets a brief explanation straight away, never public criticism, because fear makes people hide mistakes. The main indicator is the reporting rate, not just the click rate. A team where 5% click and 60% report is safer than one where only 2% click but nobody says anything. Start with one simulation per quarter and raise the bar gradually.

Reporting must be instant

A button in Outlook, or an internal address everyone knows. And a reply the same day saying whether it was fraud. Without feedback, the habit dies within weeks; with feedback, employees become the organisation's fastest alarm.

Protocol for fake voice and video

• Start from the right assumption Recognising the voice or face no longer proves identity.
• Recognise the signs A request outside the process, urgency, secrecy, refusal of the normal channel. They help, but they are not enough.
• An exit line "I'll confirm with you through the usual contact", and end the call. If management says it during training, nobody will be afraid to use it.
• A verbal code A word agreed between management and finance for any request for money. It costs nothing and it works.

• Finance and accounting Because of transfers.
• HR Personal data and requests to change the salary account.
• Reception and executive assistants Diaries and requests made on behalf of others. In the embassies, hotels and clinics we manage, reception is often the first door they try to open.
• Management Receives the most elaborate attacks and is the least present at sessions.

People are the last barrier, not the first. Before them: an email filter that flags external senders and blocks executable files; SPF, DKIM and DMARC, so it is hard to send email in your domain's name; and MFA on every account, so a stolen password is not enough. Add managed firewalls and the protection of Microsoft 365 for business.

With DataRoad managed cybersecurity we prepare the first session, launch the first simulation, activate one-click reporting and fine-tune filters and MFA, reducing the volume of fraud that reaches your employees. DataRoad has never suffered a security incident in 11 years. Request a no-commitment proposal.

More than 10 workstations · support contract · remote, on-site and phone support. Call +351 211 459 950 * or write to sales@dataroad.pt.

*Call to a Portuguese landline.