--- title: "Phishing and deepfakes | DataRoad IT" description: "The fake email has no typos and the call has the director's voice. Prepare your team with one rule, short sessions and simulations. No-obligation proposal." language: en url: https://www.dataroad-it.com/en/phishing-deepfakes-team-awareness-plan/ source: https://www.dataroad-it.com/en/phishing-deepfakes-team-awareness-plan/ publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal --- > The fake email has no typos and the call has the director's voice. Prepare your team with one rule, short sessions and simulations. No-obligation proposal. # Phishing and deepfakes: the rule and training that protect a team At a glance For decision-makers short on time. - 01 Payments and new IBANs are always confirmed via a second channel, to a known contact. - 02 15 to 20-minute sessions every 2 or 3 months and one simulation per quarter. - 03 Measure the reporting rate, not just the click rate; reporters get a same-day reply. - 04 Email filtering, SPF, DKIM, DMARC and MFA come before training. ### In this article **A single transfer authorised by mistake can cost more than an entire year of managed cybersecurity.** In 2026, fraud arrives by email with no mistakes, by phone with the director's voice and by video call with the right face. The effective defence against phishing and deepfakes is no longer teaching people to spot typos. It is a second-channel confirmation rule, short and frequent training with real cases, simulations without punishment and a report button answered the same day. This is the model DataRoad - IT Services and Consulting applies in its clients' managed cybersecurity. ## How has fraud against businesses changed? - **Writing** Messages in fluent Portuguese, with the tone and signature of the person they impersonate. - **Cloned voice** A short clip of public audio (an interview, a LinkedIn video) is enough to have a manager "call" asking for a payment. - **Video** Faces synthesised in real time have already been used in video calls to approve transfers at European companies. The technique varies; the pattern does not. There is always **urgency** and there is always **hierarchy**: someone with authority demands something immediate, outside the usual process. ## Which rule neutralises any impersonation? Confirm through another channel. Training only to recognise fraud fails, because some of it is impossible to recognise. Protection has to work even when nobody is suspicious: **every payment, change of bank details or release of sensitive information is validated through a second channel, with a contact already on record**. The supplier sent a new IBAN? Call the number in the contract. The CEO asked for a transfer on a video call? Call their mobile. When the rule has no exceptions, not even for management, the perfection of the impersonation becomes irrelevant. More detail in the article on [the altered-IBAN invoice fraud](https://www.dataroad-it.com/en/email-fraud-changed-iban-ceo-fraud/). ## Which training will your team actually follow? ### Little time, often Two hours a year are forgotten within a month. What works is 15 to 20-minute sessions every two or three months, each on one topic: email, phone, video calls, social media, USB sticks and files. With real examples, ideally attempts the company itself received, without identifying anyone. Nobody remembers a slide; everyone remembers the fake utility email that reached the colleague at the next desk. ### Simulate to teach, not to shame Anyone who falls for a simulation gets a brief explanation straight away, never public criticism, because fear makes people hide mistakes. The main indicator is the **reporting** rate, not just the click rate. A team where 5% click and 60% report is safer than one where only 2% click but nobody says anything. Start with one simulation per quarter and raise the bar gradually. ### Reporting must be instant A button in Outlook, or an internal address everyone knows. And a reply the same day saying whether it was fraud. Without feedback, the habit dies within weeks; with feedback, employees become the organisation's fastest alarm. ### Protocol for fake voice and video - **Start from the right assumption** Recognising the voice or face no longer proves identity. - **Recognise the signs** A request outside the process, urgency, secrecy, refusal of the normal channel. They help, but they are not enough. - **An exit line** "I'll confirm with you through the usual contact", and end the call. If management says it during training, nobody will be afraid to use it. - **A verbal code** A word agreed between management and finance for any request for money. It costs nothing and it works. ## Who in the company is the favourite target? - **Finance and accounting** Because of transfers. - **HR** Personal data and requests to change the salary account. - **Reception and executive assistants** Diaries and requests made on behalf of others. In the embassies, hotels and clinics we manage, reception is often the first door they try to open. - **Management** Receives the most elaborate attacks and is the least present at sessions. ## Which technical protection should be in place before training? People are the last barrier, not the first. Before them: an email filter that flags external senders and blocks executable files; SPF, DKIM and DMARC, so it is hard to send email in your domain's name; and [MFA on every account](https://www.dataroad-it.com/en/mfa-business-14-day-plan/), so a stolen password is not enough. Add [managed firewalls](https://www.dataroad-it.com/en/managed-firewall-services-portugal/) and the protection of [Microsoft 365 for business](https://www.dataroad-it.com/en/microsoft-365-management/). ## Frequently asked questions ### How often should training take place? Every two or three months, in short sessions, with one simulation per quarter. This rhythm gives better results than one long annual session. ### Don't simulated attacks create a bad atmosphere? No, as long as they are not used to punish. A two-minute explanation for those who click and public recognition for those who report turn the subject into a normal conversation. ### How do I know whether my boss's voice on the phone is fake? You don't, and you don't need to. End the call and ring the usual number, or ask for the agreed verbal code. ### Does the law require staff training? For entities covered by NIS2, yes: cybersecurity training is required, including for management bodies; GDPR calls for appropriate organisational measures. For everyone else, it is simply the measure with the best return for its cost. ## Want to put your team to the test? With [DataRoad managed cybersecurity](https://www.dataroad-it.com/en/managed-cybersecurity-services/) we prepare the first session, launch the first simulation, activate one-click reporting and fine-tune filters and MFA, reducing the volume of fraud that reaches your employees. DataRoad has never suffered a security incident in 11 years. Request a no-commitment proposal. **More than 10 workstations · support contract · remote, on-site and phone support.** Call +351 211 459 950 * or write to sales@dataroad.pt. **Call to a Portuguese landline.* Chosen by respected and international companies ★★★★★ 5,0 · 52 Google reviews ★★★★★ 5,0 · 52 Google reviews DataRoad ## Related articles [Managed IT and cybersecurityTeams on the move: securing laptops, phones and public Wi-FiThe real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/managed-cybersecurity-travelling-teams/)[Managed IT and cybersecurityExternal attack surface: what the internet sees of your companyAutomated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …12 October 2026 · 5 min read](https://www.dataroad-it.com/en/external-attack-surface-managed-cybersecurity/)[Managed IT and cybersecurityNOC and managed cybersecurity: who watches your SME, and whenThe question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …12 October 2026 · 6 min read](https://www.dataroad-it.com/en/noc-managed-cybersecurity-sme/)[Managed IT and cybersecurityMicrosoft 365 security: the 10 controls that are yoursIn Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/microsoft-365-managed-cybersecurity-shared-responsibility/)[Managed IT and cybersecurityGDPR and managed cybersecurity: 10 technical controls to proveWithout documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/gdpr-managed-cybersecurity-10-technical-measures/)[Managed IT and cybersecurityExposed passwords: audit your domain and close the door in 5 daysThe risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every accoun…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/company-credentials-data-breach-check/)[Managed IT and cybersecurityAsset inventory: the basis of IT estate management and NIS2Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/it-asset-inventory-management-nis2/)[Managed IT and cybersecurityBreak-glass accounts in Microsoft 365: your company's insuranceA locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/microsoft-365-break-glass-accounts/)[Managed IT and cybersecurityWindows 365 for business: when a cloud PC cuts costsA cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/windows-365-business-cloud-pc-costs/) Numbers you can verify **11** years in business **232** clients **< 10 min** average response time **15+** IT vendor certifications **10+** Countries with clients supported **5.0 ★** 52 Google reviews Transparency ## What many providers hide, we publish. [See plans and prices →](https://www.dataroad-it.com/it-unlimited/) - **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200. - **No lock-in** Annual contract, no lock-in and no joining fees. - **Everything in writing** What is included, the scope and the price, before you sign. - **Support without counted hours** Remote and phone in every plan; on-site support from Premium. Partners and certifications DataRoad · Managed cybersecurity ## One StepAhead of IT. Security is proven over years, not promises. Managed firewalls, MFA, endpoint protection and tested backups, the same standard for every client. - **11** years in business, since 2015 - **0** DataRoad security incidents in 11 years - **5 ★** on Google · 52 reviews We do **IT** right. DataRoad IT Unlimited ## Does your IT depend on a single person? Documentation, inventory and one contact who answers for everything. [Request a proposal, no commitment →](https://www.dataroad-it.com/en/#contact)+351 211 459 950 **Call to a Portuguese landline · More than 10 workstations · support contract · remote, on-site and phone support[Not sure what you need? Talk to the assistant →](https://www.dataroad-it.com/en/#assistente) --- Versão HTML desta página: https://www.dataroad-it.com/en/phishing-deepfakes-team-awareness-plan/