Do not rely on everyone spotting every scam

The best defence is not expecting every employee to spot every scam perfectly. A better approach is to create a simple business process.

Password resets, payment changes, supplier bank details and urgent access requests should all have a second check. If a caller claims to be from a bank, supplier, IT provider or mobile network, staff should feel confident ending the call and using a known trusted number instead.

Practical checks to start with

Directors can help by making the rule clear: nobody gets blamed for pausing and checking.

  • Create a second-check rule for payment changes
  • Never reset passwords from a phone call alone
  • Train staff to pause and verify urgent requests
  • Keep supplier contact details in a trusted source
  • Record suspicious calls and patterns

How IT Life-Raft can help

IT Life-Raft helps small businesses connect practical managed IT support, cybersecurity, Microsoft 365, AI and automation into a simpler operating model. That means fewer unknowns, clearer priorities and support that is easier to act on.

These checks work best when they are reviewed regularly rather than treated as a one-off task. A short monthly review can often spot gaps before they turn into urgent support requests.

A common mistake is waiting until there is a visible problem before reviewing the process. By that point the business may already be dealing with downtime, lost time, confused staff or avoidable recovery work. Another mistake is treating technology as separate from how the business actually works. IT support, cybersecurity, backups, automation and documentation all affect customer service.

What to do next

Write down which requests need secondary approval, brief staff on the rule, review recent near misses and use IT support to tighten account and payment controls.