Spot what does not fit

Unexpected context matters as much as an unfamiliar sender.

Pause when a message asks you to act quickly, share credentials, approve a sign-in you did not start, open an unexpected attachment, or transfer information outside the normal workflow. Check whether the sender details and request fit the conversation you were already having.

A familiar display name is not enough to verify a request. Do not use a link or phone number supplied in a suspicious message to check whether it is genuine.

Compare the request with the context

Fictional Northstar Works examples.

Expected work request

You are already discussing a meeting agenda with a colleague. A message asks for the agenda section you agreed to prepare, and the request matches the conversation.

  • Check the recipient before sending.
  • Share only the agreed material using an approved method.

Unexpected high-pressure request

A message claiming to be from a senior colleague demands a password and a full project file immediately, though you were not expecting either request.

  • Do not reply with credentials or open the message's links.
  • Verify through a known work channel and use the approved reporting route.

Make a safe decision

If the message remains suspicious, use your organization's approved reporting route.

  1. 1

    Pause

    Do not click, reply, open an unexpected attachment, or approve an unexpected sign-in.

  2. 2

    Verify separately

    Contact the person through a work channel you already know, not details supplied by the message.

  3. 3

    Report through the approved route

    Use the organization's suspicious-message reporting process. If you already entered account details or approved a prompt, go to Urgent help.