Secure business email: How to avoid falling for phishing

Over 90 per cent of cyber attacks start with an email. Phishing messages are now so sophisticated that even experienced users can fall for them. How to spot a fraudulent email, how to technically secure company mail and why staff training is indispensable?

What is phishing and what does it look like

Phishing is a fraudulent technique where an attacker sends an email that appears to be a legitimate message from a bank, supplier, colleague or service you use. The aim is to persuade you to click on a link, open an attachment or enter your login details.

Typical signs of a phishing email:

• Urgency: Your account will be blocked within 24 hours or Verify your identity immediately.
• Suspicious sender address: At first glance it appears legitimate, but on closer inspection it contains a typo or uses a different domain (e.g. Firma@security-banka.cz instead of firma@banka.cz).
• Links leading elsewhere: The link text says "www.banka.cz", but the actual address leads to a completely different server.
• Attachments: Unexpected attachments, especially files with extensions.exe,.zip,.docm or.js.
• Grammatical errors: Even though modern phishing is often flawless, unusual phrasing or incorrect diacritics sometimes appear.

Examples from practice

The most common phishing scenarios we see with our clients:

• False invoice: Email with attachment "Faktura_2026.pdf.exe" from a seemingly known supplier.
• Password reset: A message styled like Microsoft 365 with a login link that leads to a fraudulent website.
• CEO fraud: Email allegedly from the company director requesting an urgent money transfer.
• Delivery of the parcel: Notification from Ceska posta or the courier service with a link to track the parcel.

Technical security: SPF, DKIM and DMARC

In addition to staff training, there are technical measures that significantly reduce the number of phishing emails reaching your employees' inboxes.

SPF (Sender Policy Framework)

SPF is a DNS record that specifies which servers are authorised to send emails from your domain. If someone sends an email appearing to come from your company but originating from an unauthorised server, the recipient can reject it or mark it as spam.

DKIM (DomainKeys Identified Mail)

DKIM adds a digital signature to every outgoing email. The recipient can verify that the message has not been altered in transit and that it genuinely originates from your domain.

DMARC (Domain-based Message Authentication)

DMARC combines SPF and DKIM and defines what should happen to emails that fail verification. You can set them to be rejected, moved to spam, or simply monitored. DMARC also sends you reports on who is attempting to send emails from your domain.

All three technologies should be configured by every company. They protect not only you but also your business partners from fraudulent emails impersonating your address.

Staff training: The most important defence

Technical measures capture a large proportion of threats, but never all of them. The last line of defence is always the human element. Effective training should:

• Apartment: short and practical (20-30 minutes), not an all-day seminar.
• Include realistic examples: show employees actual phishing emails.
• Repeat regularly: once every quarter or every six months.
• Includes simulation, send a test phishing email and monitor who clicks. No penalties, but with education.
• Apartment accessible to everyone: from reception to management.

What to do if someone clicks

It is important to create an environment where employees are not afraid to report a mistake. If someone clicks on a suspicious link or opens an attachment:

1. Report immediately to the IT department or the IT administrator.
2. Do not delete the email. IT will need it for analysis.
3. Disconnect the computer from the network if it behaves suspiciously.
4. Change passwords for all accounts that may have been compromised.

Having a clear procedure for reporting incidents is crucial. The sooner you are informed of the problem, the less damage it will cause.

Supplementary measures

• Two-factor authentication (2FA): Even if an attacker obtains the password, they cannot log in without the second factor.
• Spam filter: A quality spam filter catches most phishing attempts before delivery.
• Limitations on attachments: Block dangerous file types (exe, js, vbs) at the email server level.
• Regular audits: Verify that SPF/DKIM/DMARC records are correctly configured.

Summary

A secure corporate email rests on three pillars: technical security (SPF, DKIM, DMARC), regular employee training and a clear procedure for reporting incidents. None of these pillars is sufficient on its own, but together they form an effective defence against phishing.