Small business security
How to teach staff to spot scams without boring them
Annual training videos are easy to tick off and easy to forget. What actually changes behaviour is short, frequent reminders using real examples, a few clear rules, and making it completely normal to say “I think I clicked something”. Here’s how to do that in a small business, without a big budget.
The short version
What works
- Five minutes a month beats an hour a year.
- Use real scams your team has actually received.
- Thank people for reporting, especially when they made a mistake.
- Teach a handful of rules, not a hundred.
The rules that matter most
If staff remember only these, you’ve covered most of the risk:
- Verify payment changes by phone using a number you already have. See invoice scams.
- Never approve a sign-in prompt or share a code you didn’t ask for.
- Don’t enter your work password on a page you reached from an email link.
- Never install software because a caller or pop-up told you to.
- Report anything odd straight away, including your own mistakes.
Make it short and regular
- A monthly five-minute slot in an existing team meeting.
- One real example each time: a phishing email someone received, a scam text going around, a news story about a local business.
- A quick question: “What would you do if you got this?”
Use real examples
Real scams are far more memorable than generic ones. Keep a folder of suspicious emails and texts your team reports (with personal details removed), and use them. Good sources of current examples:
- Scamwatch news and alerts
- ASD alerts and advisories
- Our Help Centre guides, which are free to share with your team
Build a no-blame reporting culture
The most valuable security behaviour is fast reporting. That only happens if people aren’t afraid of looking foolish.
- Thank every report, even false alarms.
- Never punish someone for clicking and then reporting it.
- Make reporting easy: a report button in Outlook or Gmail, or one person to message.
- Share wins: “Sam spotted a fake invoice last week and saved us a lot of trouble.”
Leaders go first
If the owner or manager says “I nearly fell for this one”, it gives everyone else permission to admit uncertainty. Scams target managers too, often more than anyone.
Phishing simulations: use with care
Simulated phishing emails can help people practise, but done badly they create resentment. If you use them:
- Tell staff simulations will happen.
- Use them to teach, not to shame. Show what the warning signs were.
- Don’t use cruel lures like fake bonuses or redundancy notices.
Onboarding and role-specific training
- Cover the key rules in every new starter’s first week. See onboarding and offboarding.
- Give extra time to people who handle payments, payroll, customer data or admin accounts, who are targeted most.
Measuring progress
Simple signs things are improving:
- More reports of suspicious messages
- Faster reports after something goes wrong
- People checking payment changes without being reminded
Common questions
Do we need to buy a training platform?
Not necessarily. For a small team, regular conversations with real examples work well. A platform can help as you grow or if a client or insurer requires records.
How do we cover staff who don’t work in the office?
Use a short message in your team chat or email with an example and one question. Keep it brief.
What if someone keeps falling for things?
Support them with one-on-one help, and strengthen technical controls, like MFA and payment verification, so a single mistake can’t cause serious harm.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.