Phishing at work: an October response plan

What the figures actually say

The Commission published its Eurobarometer summary on 30 September and updated it on 1 October 2026: three in four EU employees encountered suspicious messages or links; 39% reported phishing. On perceptions, 83% considered cyberattack consequences serious and 48% said they could recognise an AI-generated fake video.

These are respondents' answers, not a measured intrusion rate. The summary does not justify attributing the findings to Portugal; this article gives no sample size or collection period that it has not verified.

Make the month an operational opportunity

ENISA describes European Cybersecurity Month as an annual awareness campaign for citizens and organisations. In Velqory's interpretation, October is useful for reviewing a specific task, not merely distributing a poster.

An urgent invoice does not validate new bank details

Velqory's proposed internal rule: a change in bank details deserves verification separate from the incoming request. This is an operational recommendation, not a legal obligation or a measured result.

Velqory's adaptation is to pause the change or payment and call a supplier contact recorded before the message arrived. Do not use the number supplied in the suspicious request. Confirm the beneficiary, change and document with an authorised person; record who answered and the conclusion.

Introduce a second check for bank-detail changes, separate from the person entering them. If the supplier cannot be confirmed, keep the payment paused and refer the exception to the finance owner. A familiar voice or image should not waive the procedure.

Report without exposing the team again

The official publication record for NIST SP 800-61 Rev. 3, published in April 2025, places preparation, detection, response and recovery within risk management. The workflow below is Velqory's original adaptation, not a transcription of the framework: start with an easily located internal channel and a known recipient and deputy.

Include sender, time, subject, actions already taken and whether credentials were entered or authentication approved. Use the organisation's safe mechanism to preserve the message and headers; do not forward it to curious colleagues.

The recipient should acknowledge the report and explain the next action. Employees do not need to prove an attack occurred. Value rapid reporting and avoid exposing names in public rankings of mistakes.

If account access is suspected

This is Velqory's operational recommendation, not an incident account. If you entered credentials on a suspicious page or approved an unexpected request, contact the responsible team immediately through a trusted channel.

The team should assess access suspension, revoke suspicious sessions and access where technically possible, preserve logs and examine recovery methods, forwarding rules and granted permissions. Change exposed credentials from a trusted device and verify enrolled factors.

If an attachment was executed or malware is suspected, also refer the device for technical assessment; changing a password may not solve that problem. If payment occurred, alert finance and contact the bank through a known channel. Do not promise recovery of funds.

Resistant authentication, controlled recovery

CISA's October 2022 factsheet recommends phishing-resistant MFA, including FIDO/WebAuthn. It distinguishes this from codes and notifications susceptible to phishing and recommends phased migration.

Velqory proposes starting with administration, email and payment accounts. Check compatibility, user support and a safe alternative for losing an authenticator. Do not disable existing protection while preparing migration.

Test recovery using an exercise account and identity confirmed through an independent procedure. Protect backup authenticators and document exceptions with an expiry and owner. Phishing resistance is not immunity to fraud, malware or session abuse; the financial procedure remains necessary.

A 30-day employer matrix

The following days are internal targets proposed by Velqory, not legal deadlines. Use authorised scenarios without collecting real passwords or sending test payments.

Measure capability, not blame

In the final review, check whether reporting reached a recipient, the financial decision was recorded and recovery used a trusted channel. More reports may indicate greater participation; alone, that proves neither more attacks nor better protection.