Businesses can protect employees from phishing outside email by applying the same verification process to every communication channel. A request should not be trusted simply because it arrives through a text message, phone call, QR code, social media account, or workplace chat.
These channels often feel faster and more personal than email. Employees may respond quickly because the message appears to come from an executive, vendor, bank, delivery company, or familiar coworker.
The risk is current. The FBI’s 2025 Internet Crime Report recorded 191,561 phishing and spoofing complaints, making it the most reported cybercrime category that year. In March 2026, CISA and the FBI also warned that attackers were using phishing campaigns to compromise commercial messaging accounts and then contact additional victims from trusted accounts. (ic3.gov)
The solution is a simple rule: pause, verify through a separate trusted channel, and report anything suspicious.
What does phishing outside email look like?
Phishing is an attempt to make someone reveal information, approve a request, open a harmful link, or provide access by pretending to be a trusted person or organization.
Outside email, it may appear as:
A text claiming an account has been locked
A phone call requesting a password or verification code
A QR code leading to a fake login page
A message from an executive requesting an urgent payment
A workplace chat asking an employee to review a document
A social media message from a vendor or coworker
A fake customer-support alert directing the employee to call a number
CISA’s phishing guidance recognizes that attackers use text messages and collaboration platforms such as Teams, Slack, Signal, WhatsApp, and iMessage, not only traditional email. (CISA)
The channel may change, but the pressure tactics are usually familiar. The message creates urgency, asks for secrecy, warns of a consequence, or presents an unexpected opportunity.
Email security can inspect suspicious messages, links, attachments, and sender information before they reach an employee. It cannot fully protect personal text messages, phone calls, social media accounts, or every external messaging application.
Workplace messaging can also feel safer than email because employees associate it with coworkers. However, a legitimate account may be compromised. The attacker can then read conversations, view contacts, and send believable messages from someone the employee recognizes.
The March 2026 CISA and FBI advisory reported that compromised commercial messaging accounts were being used to continue phishing other contacts. This means a familiar profile, existing conversation, or correct display name is not enough to prove that a request is legitimate. (CISA)
Employees need guidance that focuses on the request itself, not only the platform that delivered it.
The verification step should match the possible business impact.
Payment or banking request
Call the vendor or employee using a previously confirmed number. Require a second person to approve new payment instructions or changes to banking details. The FBI recommends confirming payment requests and account changes directly with the person making the request. (FBI)
Password reset
Open the company’s official application or type the known website address into the browser. Do not use the link in the message. Employees should never share passwords or one-time authentication codes with someone who contacts them unexpectedly.
Account alert
Check the account through the official application or a bookmarked website. Do not call the number included in the alert unless it matches a number the business has already verified.
Executive message
Contact the executive through the company directory, a known phone number, or another internal channel. Urgency, confidentiality, or seniority should not bypass approval procedures.
Unexpected link or document
Ask the sender whether they intended to share it. Confirm through a different channel before opening it, especially when the message requests a login.
QR code
Treat the QR code as a hidden link. The Federal Trade Commission warns that malicious QR codes can direct users to imitation websites that steal login or financial information, or may lead to malware. (Consumer Advice)
Employees should know exactly where and how to report a suspicious request. The process should be visible, simple, and available from mobile devices.
A report should include:
A screenshot of the message
The sender’s name, number, or username
The time the message was received
The platform where it appeared
Whether the employee clicked, replied, scanned, downloaded, or shared information
Employees should not delete the message until the security contact confirms that the necessary details have been recorded.
When someone reports after clicking, the response should focus on speed rather than blame. The employee may need to disconnect the device, change a password through an approved process, revoke active sessions, or contact the bank.
For suspected financial fraud, the FBI advises contacting the financial institution immediately and reporting the incident to the Internet Crime Complaint Center. Rapid reporting may support attempts to recover transferred funds. (FBI)
Use a simple three-step process for any unexpected request involving money, credentials, access, sensitive information, or urgent action.
1. Pause
Do not click, scan, call, reply, approve, or provide information immediately. Urgency should increase verification, not remove it.
2. Verify separately
Contact the person or organization through information the employee already trusts. Use a saved phone number, the official company application, a known website, or an established internal contact.
Do not use the phone number, website, QR code, or account details contained in the suspicious message.
3. Report
Send the message to the company’s designated IT or security contact. Reporting allows the business to warn other employees and determine whether an account or device has been compromised.
CISA advises users to resist urgent requests, avoid clicking suspicious links, and report suspected phishing attempts. (CISA)
Employees are more likely to follow a security process when it fits how they actually work.
Start by creating clear rules for high-risk requests:
Payment changes require independent verification
Passwords and authentication codes are never shared
Executives cannot bypass approval procedures through text or chat
Unexpected QR codes and links must be verified
Suspicious messages should be reported immediately
No employee will be punished for reporting an honest mistake quickly
Training should include realistic examples from multiple channels, not only email screenshots. Show employees what a fake text, voice message, QR code, workplace chat, and social media request might look like.
Businesses should also reduce unnecessary exposure by enabling multifactor authentication, limiting who can approve payments, reviewing messaging-app access, and removing accounts that are no longer needed.
The goal is not to make employees suspicious of every message. It is to give them a repeatable process for requests that could expose money, information, accounts, or business systems.
