Cybersecurity Awareness: Phishing, Passwords and MFA
Spot phishing, use strong unique passwords with a manager, turn on MFA and report incidents fast.
Content changes frequently. Phishing techniques change quickly. Check your organisation's current guidance and official advisories.
Why it matters
Most cyber incidents start with a person clicking, sharing or reusing a password. Simple habits block most attacks.
Who it's for: All staff, especially those with access to control systems, CCTV or access-control software.
Learning objectives — by the end you can:
- Identify five phishing warning signs.
- Explain why MFA matters.
- Know how to report a suspected phish.
Key terms
- Phishing
- A message pretending to be trusted to trick you into clicking, paying or sharing.
- MFA
- Multi-factor authentication — a second proof beyond your password.
- Password manager
- Software that creates and stores unique strong passwords.
Lesson notes
Warning signs
- 1Urgency or threats ('account closes today').
- 2Unexpected attachments or links.
- 3Sender address that doesn't match the name.
- 4Requests for passwords, codes or payment changes.
- 5Too-good-to-be-true offers.
Good habits
Use long passphrases, unique for each account, stored in an approved password manager. Turn on MFA everywhere it's offered — preferably an app or security key. Never share MFA codes. Report anything suspicious using your organisation's report button or IT contact.
Video lesson
Video to be added
A verified video from an official or reputable channel has not yet been selected for this topic. The text lesson above covers the full content.
Search YouTube for related videosPractical story: The 'urgent invoice' from the CEO
Fictional teaching example
Situation. A finance assistant received an email appearing to be from the CEO asking for an urgent supplier payment.
Known facts
- The reply-to address was a lookalike domain.
- The message said 'don't call, I'm in a meeting'.
Decisions
- The assistant verified by phoning the CEO's known number.
- Reported the email to IT.
Outcome. No payment was made; IT blocked the domain for all staff.
Lessons
- Verify using a known channel.
- Urgency is a red flag.
- Reporting protects colleagues.
Worked example
Worked example: analysing a message
| Clue | Observation | Verdict |
|---|---|---|
| Sender | it-support@micr0soft-help.co | Lookalike — suspicious |
| Request | 'Confirm your password here' | Never legitimate |
| Tone | 'Within 1 hour or locked' | Pressure tactic |
Practice exercise
List the steps you would take after accidentally clicking a phishing link and entering your password.
Quiz
Sign in to save quiz results.
References
- Official guidanceUK NCSC — Phishing guidance
- Official guidanceCISA — Secure Our World
- Official guidanceCERT-In
Verify current editions and applicability. Standards are copyrighted; consult licensed copies for exact requirements.
Report an issue with this contentRelated topics
Privacy & Data Protection
DPDP Act, 2023 — Awareness for Workplaces
Understand the core ideas of India's Digital Personal Data Protection Act, 2023: notice, consent, purpose limitation, minimisation, rights and breach readiness.
AI & Digital
AI Literacy and Responsible Generative AI at Work
Write better prompts, verify outputs, protect confidential data and watch for bias when using generative AI.
Governance & Compliance
Information Security and ISO/IEC 27001 Awareness
Understand what an Information Security Management System (ISMS) is and how physical security teams contribute to it.