Recognize phishing and verify unusual requests
Treat unexpected messages that push urgency, secrecy, or money movement as suspicious — and verify through a known-good channel.
Why it matters
Phishing and social engineering remain common ways attackers steal credentials, install malware, or trick people into sending money. CISA advises skepticism toward unexpected email and similar messages.
Practical steps
- Pause on unexpected requests for passwords, MFA codes, wire transfers, gift cards, or urgent “CEO” instructions.
- Check the sender address carefully. Hover links (on a computer) before clicking; prefer typing known URLs yourself.
- Verify unusual requests by calling or messaging a known contact using a number or channel you already trust — not one supplied in the suspicious message.
- Do not enter credentials on a page you reached from an unsolicited link; navigate to the service directly.
- Report suspected phishing to your IT/security contact and delete or quarantine the message per policy.
When to contact Visnec
Contact Visnec after a suspected phishing click, if Microsoft 365 or email shows unusual sign-ins, or if you want phishing reporting and awareness built into your managed security scope.
Sources
- CISA — Good Security Habits (phishing) — reviewed 2026-11-04
- CISA — More than a Password (phishing-resistant MFA) — reviewed 2026-11-04