Training people for the AI era of scams
Old awareness training said 'look for typos'. New training teaches people to check requests, report fast, and never feel ashamed. Here's how to update it.
In 60 seconds
Training people for the AI era of scams
Old awareness training said 'look for typos'. New training teaches people to check requests, report fast, and never feel ashamed. Here's how to update it.
Update the message
- "Look for spelling mistakes"
- "Scams sound unprofessional"
- "You'd recognise your boss's voice"
- "Clicking means you failed"
- Check the sender's real domain and the link destination
- Watch for risky requests: money, codes, passwords, access, data
- Voices and faces can be faked; verify by callback
- Report fast, especially if you clicked; that helps everyone
Realistic simulations, done ethically
- Get approval from leadership, HR and legal, and tell staff that simulations happen (not when).
- Avoid cruel lures, such as fake bonuses, fake layoffs, health scares or personal tragedies.
- Don't use a real vendor's or government agency's identity without permission; use made-up but realistic scenarios.
- Never simulate voice clones of real colleagues without their clear consent and a strong reason.
- After a click, show a short, kind lesson, not a public list of names.
Make reporting easy
- 1
One button or one address
A "Report phishing" button in email, or one clear contact. Put it on posters and the intranet. - 2
Fast thanks
Reply to every report, even if it was safe. People keep reporting when they feel heard. - 3
Share what you learn
A short monthly note: "Here's what we saw, and who helped catch it." - 4
Report after mistakes
Say clearly: if you clicked or paid, tell us at once and you won't be blamed.
Short, regular drills
Measure what matters
| Measure | Why it matters |
|---|---|
| Reporting rate | Shows people notice and act. More reports means faster response. |
| Time to first report | The first report lets the team block a campaign for everyone. |
| Click rate | Useful, but depends on how hard the test was. Don't use it alone. |
| Verification in real processes | Are bank changes actually verified by callback? This is the real goal. |
| Reports after a mistake | Shows people trust the blame-free culture. |
Watch and read more
Lab
A six-month awareness plan for the AI era, with ethical rules for simulations and a way to measure success.
The problem
Design a six-month awareness plan for your team or a made-up 100-person company with an office, a warehouse and remote staff.
- Topics: one short topic per month (for example: AI phishing, fake invoices, voice clones, QR codes, fake job offers, MFA prompts).
- Format: for each month, choose a short activity (5-minute team talk, quiz, tabletop drill, simulation).
- Ethical rules: write at least 4 rules for your phishing simulations, including which lures you will never use.
- Reporting: describe how people report, and how they get thanked.
- Measures: choose 3 things you will measure and explain why each is useful.
Don't run any real simulation without approval from leadership, HR and legal.
You are done when
Hard questions
Try to answer before you reveal. If you can answer these, you understood the lesson.
Q1Your click rate dropped a lot after three months. Why might that be misleading?Reveal
The simulations may have become easier or predictable, or people may simply recognise the simulation sender. It also says nothing about real-world behaviour, like verifying bank changes. Look at reporting rates, time to first report, and whether real processes (callbacks, second approvals) are actually followed.
Q2How would you include warehouse and field staff who rarely use email?Reveal
Use the channels they do use: short in-person talks at shift start, posters in local languages, WhatsApp-style scenarios, and examples like fake calls from 'head office' asking for stock transfers or UPI payments. Give them one simple way to report, such as calling a named supervisor. Security is for everyone, not only desk workers.
Questions people ask
Aren't phishing simulations a form of tricking our own staff?
They can feel that way if done badly. Done well, they're like fire drills: announced as a programme, approved, kind in tone, and followed by learning, not blame. Avoid lures that exploit fear or personal hardship.
Should we use AI to write our simulation emails?
You can, since attackers do too, and it helps you create realistic, varied examples. Review every email yourself, keep it within your ethical rules, and never include real personal data.
How often should we train?
Short and regular works better than long and rare. Many organisations use brief monthly or quarterly activities, plus extra sessions for high-risk teams like finance, HR and the helpdesk. Choose a rhythm your people can keep up.
What if a senior leader keeps failing simulations?
Treat it the same way as anyone else: private, supportive coaching. Leaders are high-value targets, so consider extra protections for them too, such as passkeys and strict callback rules.
Lesson test
5 questions. Get 3 right (60%) to pass and complete this lesson.