Training should build habits, not fear: pause, verify on a second channel, and report without blame when something feels off.
False urgency and fake authority
Messages like “your account closes in one hour” or emails that look like the CEO demand a fast reaction so judgment switches off. The clear policy is: no critical process is completed only by clicking a link in email.
Almost-right domains and links
An extra character, a strange subdomain or an opaque shortener deserve opening the site by typing a known URL or using a saved bookmark—not the message’s link.
Requests for codes or MFA
No legitimate party asks for your authenticator app code over chat. If they do, it is almost always an attacker in the middle of an attack.
Short drills and immediate feedback keep reflexes sharp without overwhelming the organization.