Phishing Awareness Training for Small Business: How to Teach Staff to Question Every Email

SUMMARY

• Phishing awareness training teaches staff to pause and verify any email that asks them to click a link, open a file, or log in.
• Phishing is the most common attack on UK businesses. The government’s Cyber Security Breaches Survey 2025/26 found it hit 38% of them.
• The golden rule: never type a Microsoft 365 password after clicking a link in an email. Open Microsoft directly instead.
• The five-second check: Did I expect this? Who really sent it? Where does the link go? Why the rush? Would a real company ask for this by email?
• Make reporting easy and blame-free. If someone clicks, they should tell IT straight away.
• Training works best alongside technical protection such as MFA and an email filter.

Not long ago, a customer emailed us with a simple question. They wanted to know why a link in an email was not working.

They did not ask whether the email was genuine. They did not ask whether they should have clicked at all. Meanwhile, the link led to a page asking for their Microsoft 365 login details. It was a phishing attempt.

Nothing about that customer is unusual. They are busy, capable, and trusting. As a result, they did what most of us do with email every day: they assumed it was real.

At Shropshire Computers, we see this pattern regularly across local SMBs. That is why phishing awareness training matters as much as any firewall. This guide shows you how to teach your team to pause, question, and verify, in plain English and without a big budget.

Why Do Smart People Still Click on Phishing Links?

Phishing works because it targets habits, not intelligence. Attackers copy the emails people expect and then add a little pressure.

According to the UK Government’s Cyber Security Breaches Survey 2025/26, 43% of UK businesses experienced a breach or attack in the past year. Phishing was the most common type, affecting 38% of businesses.

Several everyday habits make staff easy targets:

• Speed: busy people skim emails and click on autopilot.
• Trust in logos: a familiar Microsoft or supplier logo feels safe.
• Fear of consequences: “your account will be closed” makes people act first and think later.
• Reluctance to ask: many staff worry they will look foolish if they question an email.

That last point is the most important. In our experience, the biggest barrier to good email security is not ignorance. It is the feeling that asking is awkward.

What Does a Fake Microsoft 365 Login Email Look Like?

Fake Microsoft 365 emails are among the most common phishing attacks we see. Their goal is simple: to get you to type your password into a page the attacker controls.

Common examples

• “Your password is about to expire.” The email offers a button to keep your current password.
• “Unusual sign-in activity.” The message urges you to verify your account at once.
• “A document has been shared with you.” The link opens a fake page asking you to sign in to view it.
• “Your mailbox is full.” The email asks you to log in to increase your storage.

In each case, the link leads to a page that looks like the real Microsoft sign-in. Once you type your details in, the attacker has them.

Why this matters so much

A stolen Microsoft 365 login gives an attacker access to your email, OneDrive, SharePoint, and Teams. From there, they can read client emails, send convincing fake messages to your contacts, and change invoice details. Consequently, one click can reach every part of your business.

What Warning Signs Should Staff Question in Every Email?

You do not need to turn your team into security experts. Instead, give them a short checklist they can remember.

Ask staff to pause on any email that does one or more of these things:

1. Arrives unexpectedly. Was I expecting this document, invoice, or request?
2. Creates urgency. Phrases like “within 24 hours” or “final warning” are pressure tactics.
3. Asks for a login. Real companies rarely ask you to sign in through an email link.
4. Comes from an odd address. The display name may look right while the actual address is not.
5. Hides the real link. Hover over any link, without clicking, to see where it really goes.
6. Asks for money or changed bank details. Always confirm these by phone, using a number you already know.

The one rule to remember: if an email asks you to log in, do not use its link. Instead, open your browser and go to Microsoft yourself. If the problem is real, you will see it there.

A genuine Microsoft sign-in page uses a Microsoft address, such as one ending in microsoftonline.com or microsoft.com. Therefore, staff should check the address bar before typing a password anywhere.

How Do You Train Staff to Question Emails and Links?

Good training is short, regular, and friendly. Here are seven steps that work for small teams.

Step 1: Explain why it matters, using real stories

Start with a true example, such as the customer story above. Real incidents land far better than statistics alone.

Step 2: Teach the “pause and question” habit

Give staff a simple prompt: “Stop, look, check.” Stop before clicking. Look at the sender and the link. Check with someone if anything feels off.

Step 3: Set one clear login rule

Agree one rule for the whole business: we never sign in through a link in an email. Staff use bookmarks or type the address instead. This single rule defeats most fake 365 emails.

Step 4: Make it safe to ask

Tell your team that checking an email is always welcome, even if it turns out to be genuine. Furthermore, never criticise someone for reporting a false alarm. People who fear embarrassment stop reporting.

Step 5: Give them an easy way to report

Choose one route, such as a shared mailbox, a Teams channel, or a “report phishing” button. Make sure everyone knows it. If you work with us, our team can also review anything staff are unsure about.

Step 6: Refresh regularly

A single session fades quickly. Instead, run a short 10-minute refresher every few months, and share a recent real example when one appears.

Step 7: Test the team with simulated phishing

Sending safe, fake phishing emails shows who needs more help. Treat the results as learning, not as a league table of failures.

Tip for Shropshire businesses: the NCSC offers free cyber security training for staff. It is a good low-cost starting point before you invest in anything paid.

What Should Staff Do If They Click a Link or Enter Their Password?

Sooner or later, someone will click. What happens next matters more than the click itself.

Tell your team to act fast, using these steps:

1. Do not panic, and do not hide it. Quick action limits the damage.
2. Tell IT straight away. Phone if you can, because speed matters.
3. Do not delete the email. IT may need it to investigate.
4. Change your password from a trusted device, but only as IT advises.
5. Let IT check your account. They can look for unusual sign-ins and suspicious forwarding rules.

If the email contained attachments or you downloaded something, say so. In addition, if the attack involved personal data, you may have reporting duties under UK GDPR. Our guide to what happens when a small business gets hacked explains the 72-hour rule.

You can also forward suspicious emails to the NCSC at report@phishing.gov.uk.

Why Isn’t an Email Filter Enough on Its Own?

Email filters block a huge amount of junk. Even so, a small number of convincing, targeted emails always get through.

Think of it as layers. Technical tools catch most threats, and trained staff catch the rest. For the best protection, combine:

• Multi-Factor Authentication (MFA) on every account, so a stolen password is not enough on its own.
• An external email filter such as IronScales, which adds a smarter layer on top of Microsoft’s built-in protection.
• Regular staff training, so the people at the keyboard act as your last line of defence.

For a full list of settings to check, see our Microsoft 365 security checklist.

The Bottom Line on Phishing Awareness Training

Phishing will not disappear. Fortunately, a team that knows how to pause and question is far harder to fool.

Here are the key takeaways:

• Phishing is the most common attack on UK businesses, affecting 38% in the latest government survey.
• Never log in through an email link. Go to the real site yourself.
• Make it safe to ask. Blame-free reporting catches problems early.
• Train little and often. Short, regular sessions beat one long annual one.
• Layer your defences. Combine training with MFA and email filtering.

If you would like help building phishing awareness training for your team, or checking how well your Microsoft 365 setup is protected, Shropshire Computers is here to help. We support local businesses to stay protected.

Book a cybersecurity consultation with Shropshire Computers

Frequently Asked Questions

What is phishing awareness training?

Phishing awareness training teaches staff to recognise and report fake emails, links, and messages. It covers warning signs, safe habits, and what to do after a mistake. Short, regular sessions work best for small businesses.

How often should small business staff do phishing awareness training?

Aim for a short refresher every three to four months, plus an introduction for every new starter. Frequent, brief sessions help staff remember what they learned. Sharing real examples between sessions keeps awareness high.

How can I tell if a Microsoft 365 login page is fake?

Check the address bar first. A genuine Microsoft sign-in uses a Microsoft address, such as one ending in microsoftonline.com or microsoft.com. If you reached the page through an email link, close it and open Microsoft yourself instead.

What should I do if I clicked a phishing link?

Tell your IT provider immediately and do not delete the email. If you entered a password, change it as advised and ask IT to check your account for unusual activity. Acting quickly greatly reduces the damage.

Does MFA stop phishing attacks?

MFA stops most attacks that rely only on a stolen password, so it is essential. However, it does not stop every phishing technique. That is why training and email filtering still matter alongside it.

Is phishing awareness training worth it for a very small business?

Yes. Attackers target small businesses because they often have fewer protections. A team of five can be compromised by a single click, so a short training session offers excellent value.

Should I discipline staff who click on a phishing email?

No. Punishing mistakes makes people hide them, which gives attackers more time. Instead, encourage fast reporting and treat each incident as a chance to learn.