TRAINING AND AWARENESS · CYBER-MED
Phishing: urgent does not mean genuine.
An unusual payment request can become a practical training exercise: pause, verify through known contact details and know where to report a concern.
One message, one decision
“Our bank account has changed. Make the payment immediately.” This is a fictional training example: the recipient should be able to verify the request before changing a payment instruction.
Pressure to decide quickly may reduce the time spent checking. Report Fraud advises breaking off suspicious contact and verifying directly with the organisation through contact details known to be correct.
Three steps to practise
The organisation should define its reporting channel: staff need to know whom to contact and what to describe. The internal procedure coordinates checks and any next steps.
- Pause before using links, phone numbers or instructions in the suspicious message.
- Verify with the supplier through a trusted contact already known to you.
- Report the concern through the designated internal channel, including if a link has already been clicked.
From theory to everyday work
A training session can reproduce this case without real names, bank details or documents. The exercise tests responsibilities and steps: who confirms the request, who receives the report and what check comes before payment?
Cyber-Med offers training adapted to the organisation’s roles and activities. The aim is to make these steps clear and practical, maintained alongside the other security measures.
Sources and further reading
NCSC — Reporting suspicious emails
These sources are UK institutions. General verification guidance is used; UK reporting channels do not replace an Italian organisation’s procedures. Sources checked on 10/10/2026.
Scopri il servizio Cyber-Med ↗
The topic in 35 seconds
Silent educational video with Italian on-screen text. Italian and English subtitles and transcript are available.
Read the transcript
- 00:00–00:07 Urgent does not mean genuine. Fictional example: a message demands an immediate bank account change.
- 00:07–00:14 Do not follow a suspicious link. An unusual request needs verification before acting.
- 00:14–00:21 Use known contact details. Call the supplier on a verified number, not one supplied in the suspicious message.
- 00:21–00:28 Do you know whom to contact? Use your organisation’s internal reporting channel, including if you have clicked.
- 00:28–00:35 From concern to procedure. Practise these steps with cases suited to your team. info@cyber-med.it
View the carousel: 5 cards
