Phishing & Mobile Money Fraud: 30-Minute Training

The most advanced firewall in the world cannot stop an employee who is convinced to hand over a password, approve a payment or install a harmful file. Scammers know this, which is why phishing and payment fraud remain among the most common ways businesses lose money and data.

The encouraging part is that awareness works. A short, practical session that shows people what these messages actually look like can prevent many incidents. Here is a plan you can run in 30 minutes.

What phishing is

Phishing is a message designed to trick someone into doing something harmful: clicking a link, opening an attachment, sharing a password or code, or sending money. It arrives by email, SMS, WhatsApp, phone call or social media, often pretending to be someone you trust.

Variations your team may meet:

• Email phishing: fake login pages, fake delivery notices, fake storage-full warnings.
• Business email compromise: a message that appears to come from a director, supplier or client asking for an urgent payment or a change of bank details.
• SMS and WhatsApp scams: links or requests that appear to come from banks, mobile money services, utilities or colleagues.
• Voice scams: callers claiming to be from IT, a bank or a telecom, asking for codes or PINs.
• Mobile money reversal scams: someone claims money was sent to you by mistake and pressures you to send it back.
• Fake invoices: realistic bills for services you never ordered, or genuine-looking invoices with altered account details.

The red flags that give most scams away

Teach people to look for these:

1. Urgency or pressure. "Act now," "account will be closed," "the director needs this in 10 minutes."
2. Unusual requests. A request that does not match how the person normally works with you, such as a sudden payment outside the normal process.
3. Change of payment details. Any message saying bank or mobile money details have changed.
4. Requests for codes or PINs. Real organisations do not ask you to read out or forward verification codes or PINs.
5. Mismatched sender. A display name that looks right but an address that is slightly off or from a free email service.
6. Suspicious links. Hover or long-press before clicking. The real destination may differ from the text shown.
7. Unexpected attachments. Especially zip files, documents asking to "enable content," or invoices you were not expecting.
8. Poor wording or odd formatting. Not always present, since scammers are improving, so do not rely on this alone.
9. Too good to be true. Prizes, refunds, bonuses or job offers nobody asked for.

The golden rule: verify through a second channel

If a message asks for money, credentials or a change in how you work, confirm it through a different, trusted channel. Call the person on a number you already have, not the one in the message. Walk to their desk. Ask in your internal chat.

This single habit defeats most business email compromise and mobile money scams.

A 30-minute session plan

Minutes 0 to 5: Why this matters. Explain that everyone is a target, including small teams, and that reporting mistakes quickly is safer than hiding them. Make it clear nobody will be punished for reporting a suspicious message or for clicking and then speaking up.

Minutes 5 to 15: Show real-style examples. Display three to five realistic samples: a fake supplier invoice, a fake "your mailbox is full" login page, a WhatsApp message from a "boss" asking for airtime or payment, and a call from a fake bank agent. Ask the group to spot the red flags.

Minutes 15 to 22: Walk through the golden rules. Verify requests through a second channel. Never share codes or PINs. Never approve payments or details changes on a message alone. Report first, delete second.

Minutes 22 to 28: Practise reporting. Show exactly how to report: who to tell, how to forward a suspicious email, and what to do if they already clicked or replied.

Minutes 28 to 30: Recap. Hand out a one-page summary and agree a named person to contact.

What to do if someone has already clicked or paid

Speed matters. Give staff a simple script:

1. Tell the named contact straight away. Do not wait or try to fix it alone.
2. Disconnect the device from Wi-Fi or network if you opened a file or entered a password.
3. Change the password of any account involved, from a different clean device, and sign out other sessions.
4. Contact your bank or mobile money provider immediately if money was sent, since quick action gives the best chance to stop or flag a transfer.
5. Keep the evidence: the message, sender details, links and times. Do not delete it.
6. Check for further damage: unusual email forwarding rules, new devices, or unexpected logins.

If customer or staff personal data may have been exposed, review your obligations under the Data Protection and Privacy Act with your legal adviser.

Controls that make staff training work better

Training helps most when technology reduces how many bad messages arrive and limits the damage of mistakes:

• Email filtering to catch many phishing and malicious messages before they reach inboxes.
• MFA so a stolen password alone is not enough.
• Endpoint protection to block malicious files and links.
• Payment controls, such as two-person approval for payments above a set amount and a call-back rule for any change of bank details.
• Least-privilege access so one compromised account cannot reach everything.
• Regular backups so an infection does not mean permanent loss.

A one-page staff reminder you can print

• Stop. Think. Does this request feel urgent or unusual?
• Never share passwords, PINs or verification codes with anyone.
• Check the sender and the link before you click.
• Confirm payment or detail changes by calling a known number.
• Report anything suspicious to [name / contact] immediately.
• Clicked by mistake? Tell us at once. We will help, not blame.

Keep it going

One session is a start, not a finish line. Repeat a short refresher every few months, share examples of real attempts as they arrive, and consider occasional simulated phishing tests with a clear, supportive follow-up.

Need help protecting your team?

Backspace helps businesses combine staff awareness with the technical controls that back it up: email and endpoint protection, MFA, network segmentation and backups. A free site assessment will show where your biggest exposure is.

Book a free site assessment or call +256 786 394 913.