60% of successful cyberattacks exploit human error. Training your teams is your first line of defence. Here's how to implement it.
What is phishing?
Phishing is a technique where an attacker sends a fraudulent email pretending to be a trusted entity (bank, supplier, tax authority, management) to:
- Steal login credentials
- Trigger a fraudulent bank transfer
- Install malware on the computer
In Cameroon, the most common phishing scenarios:
- Fake email from a "bank" asking to verify account details
- Fake invoice from a "supplier" with modified bank details
- Fake email from "management" asking for an urgent transfer
Why employees click
It's not stupidity, it's psychology. Attackers exploit:
- Urgency: "Your account will be blocked in 24h"
- Authority: "Message from the Managing Director"
- Fear: "Suspicious activity detected on your account"
- Greed: "You have won a prize"
Under time pressure, even a vigilant employee can make a mistake.
The 5 signs that reveal a phishing email
Train your teams to systematically check:
Sign 1: The sender's email address
A legitimate email from your bank comes from @yourbank.cm, not @yourbank-secure.net or @gmail.com. Always check the full address, not just the display name.
Sign 2: Generic greeting
"Dear customer" instead of your name? Suspicious. Legitimate companies personalise their communications.
Sign 3: Sense of urgency
"Act immediately", "Your account will be suspended". This is psychological pressure to prevent you from thinking.
Sign 4: Suspicious links
Before clicking, hover over the link to see the real URL. Does it match the supposed sender's site? When in doubt, don't click.
Sign 5: Request for sensitive information
No legitimate bank, supplier or authority asks for passwords or full bank details by email.
How to structure a training session
Phase 1: Awareness (30 minutes)
Present real phishing examples seen in Cameroon. Show the team how to identify the warning signs. Use screenshots of real fraudulent emails.
Phase 2: Practical exercise (45 minutes)
Send a simulated phishing email to your team (without warning). Note who clicks, who reports it. No punishment — it's a learning exercise.
Phase 3: Personalised debrief (30 minutes)
Review the results with the team. Explain what signs they should have spotted. Congratulate those who reported correctly.
Phase 4: Procedure (15 minutes)
Establish a clear procedure: "If in doubt, I forward to IT/management before clicking." One email address or WhatsApp contact for suspicious reports.
Practical tools
- GoPhish (free): simulates phishing attacks to test your teams
- KnowBe4: paid platform, very complete for ongoing training
- Simple checklist: laminated card on each desk with the 5 signs to check
Results at Unadresse clients
After our phishing awareness sessions:
- −80% reduction in clicks on simulated phishing emails
- ×4 increase in suspicious email reports
- 0 successful attacks via phishing in the 6 months following training
Frequency and renewal
A single training session is not enough. Plan:
- Initial training: 2 to 3 hours for all staff
- Quarterly simulation: test via simulated phishing
- Annual refresher: update on new attack techniques
- Welcome training: for every new employee
Conclusion
Cybersecurity begins with your employees. The best firewall cannot prevent a motivated user from clicking on a malicious link. Awareness training is your most profitable cybersecurity investment.
At Unadresse, our security awareness workshops are included in the Business and Corporate cybersecurity packages. Contact us for a free demonstration.
