Attackers don't need to break your firewall if someone simply hands them a password. That is why phishing remains one of the most common starting points of real breaches, and why it is the first thing we test in a social engineering assessment.
You don't need to be technical to stop it. Before you click, reply or scan anything, run through these five questions. It takes about ten seconds.
1. Who really sent it?
Ignore the display name; it can say anything. Look at the actual email address, and especially the part after the @. Attackers register look-alike domains that are one letter off, add a word such as "-support" or "-secure", or use a free email service while claiming to be your bank, a government portal or your CEO.
Red flag: a "Microsoft" email from micros0ft-account.com, or your "manager" writing from a personal Gmail address.
2. Is it trying to rush or scare you?
Urgency is the attacker's favorite tool, because people who are rushed don't check. "Your account will be suspended in 2 hours", "Unpaid traffic fine", "Final notice", "The CEO needs this before the board meeting." Real organizations rarely threaten you into acting within minutes.
Rule: the more urgent a message feels, the more carefully you should check it.
3. Where does the link actually go?
On a computer, hover over the link without clicking and read the address that appears. On a phone, press and hold. If the destination does not match the organization exactly, don't open it. Be especially careful with pages that ask you to log in: a fake Microsoft 365, banking or delivery login page is the most common phishing trap.
Safer habit: instead of clicking, type the website address yourself or use the official app.
4. Were you expecting this attachment or QR code?
Unexpected invoices, "shared documents", voicemail files and HTML attachments are classic malware and credential traps. QR codes in emails or printed letters ("scan to pay your fine", "scan to update your account") are increasingly used because they bypass link checks: the link is hidden in an image and opens on your phone, which often has weaker protection.
5. Is it asking for something unusual?
Passwords, verification codes, gift cards, a change of bank details, a request to move the conversation to WhatsApp or a personal number. Legitimate IT teams never ask for your password or your one-time code. Your bank will never ask you to read out an OTP.
The phishing messages we see most in the region
- Fake delivery notices asking for a small "customs" or "redelivery" fee by card
- Fake government or traffic fines with a payment link
- Fake Microsoft 365 or Google login pages to steal work accounts
- Fake invoices or changed bank details from a "supplier" (see our guide to fake invoice fraud)
- "CEO" messages on WhatsApp asking an employee to buy gift cards or make an urgent transfer
Many of these arrive in Arabic as well as English, and they are often well written. Spelling mistakes are no longer a reliable sign.
What to do if you clicked
- Don't panic, and don't hide it. Fast reporting limits the damage.
- Tell your IT or security team immediately, including what you clicked and anything you typed.
- Change the password you entered, from a different, trusted device, and anywhere else you reuse it.
- Disconnect the device from the network if you opened an attachment, and let IT check it.
Organizations should make reporting easy and blame-free. A team that reports a mistake within minutes is far safer than one that never clicks but never reports either.
Turn this into a habit across your company
One article helps, but habits come from practice. Our awareness sessions, in Arabic and English, show staff real examples from the region, and our phishing simulations measure whether the lessons stuck. Talk to us about a program for your team.
