How It Works
The message looks right. The logo is real, the wording is close enough, the sender name is the owner's. It asks for something small and urgent: confirm a password, approve an invoice, buy gift cards for a client, click to see a shared document. The link goes to a copy of a real login page that keeps whatever is typed into it.
Nobody falls for the badly spelled ones anymore. The ones that work are specific: they name a real vendor, a real invoice number, a real person, pulled from the business's own website and social media.
The Version That Hits The Business Twice
Email forges the sender address as easily as a letter forges the return address. If a domain has no SPF, DKIM and DMARC records, anyone can send mail "from" it and most receiving servers will accept it. The business's customers get an invoice from the business's own address with a new bank account on it. The business did not send it, cannot stop it, and gets the blame.
Email authentication closes that door. With the three records in place and DMARC set to reject, a forged message claiming the business's domain is thrown away by the receiving server before anyone sees it. That is not optional anymore: Google, Microsoft and Yahoo now refuse mail from domains that lack it.
What To Teach Staff
Urgency is the tell. Any message that needs money, a password or a click right now gets a phone call to the person it claims to be from, on a number already known, not one in the message. Hover before clicking. Nobody legitimate asks for gift cards.
The Foundation Connection
Phishing protection on the business's own name is the Verified Identity layer of the Digital Foundation doing its job: SPF, DKIM and DMARC make the domain hard to impersonate, and that protects the customers as much as the business.
