BE
Bulk Equipment
Module 1 of 3
Getting started
Security Awareness Training

Phishing & Suspicious Messages

Learn to spot fake emails and text messages that try to steal your login credentials or personal information.

What is Phishing?

Phishing is when someone sends you a fake email or text message pretending to be a company or person you trust. The goal is to trick you into clicking a dangerous link, opening a harmful file, or giving away your password.

Why this matters to youYou use your work email and HR portal regularly. Attackers know this and send emails that look exactly like real HR notifications, password reset requests, or payroll updates to steal your credentials.

In this module, you will learn how to tell the difference between real and fake messages, and what to do if you receive something suspicious.

How to Spot a Fake Email

Phishing emails often look convincing, but they almost always contain clues. Here are the most important things to check:

1. Check the Sender Address Carefully

Look at the full email address, not just the display name. Fake emails often use addresses that look close to real ones but are slightly different.

Did you catch it?The address uses "rn" instead of "m" in "equipment." On a small screen, "rn" looks identical to "m." Always look closely at the full email address.

2. Hover Over Links Before Clicking

Move your mouse over any link (without clicking) to see where it actually goes. The real destination appears in the bottom corner of your browser. If the link address does not match what the email claims, do not click it.

3. Watch for Urgency and Threats

Fake emails try to make you act quickly before thinking. Messages like "Your account will be locked in 2 hours" or "Verify your information immediately" are designed to create panic.

Common urgency tricks"Your direct deposit has been suspended." "Action required: Verify your identity within 24 hours." "Unusual login detected on your account." These phrases are designed to scare you into clicking without thinking.

4. Look for Generic Greetings

Real emails from your company usually use your name. Phishing emails often say "Dear Employee" or "Dear User" because the attacker does not know who you are.

Real-World Examples

Here are examples of fake messages that target employees. Compare them to see what makes each one suspicious.

Fake HR Portal Login

Red flagsThe domain "hr-portal-update.com" is not your company's website. Uses "Dear Employee" instead of your name. Creates urgency with a tomorrow deadline and threat of cancellation.

Fake Password Reset

Red flags"bulkequipment-helpdesk.net" is not the real company website. "URGENT" in the subject and threats of losing all access are pressure tactics. Legitimate password resets come from your actual company IT system.

Text Message Phishing (Smishing)

Red flagsYour HR team will never text you asking to verify bank details through a link. Shortened URLs (bit.ly) hide the real destination. If there is a real payroll issue, HR will contact you through official channels or in person.

What to Do

If you receive a suspicious email or text:

  • Do not click any links or open any attachments in the message.
  • Do not reply to the message, even to say "stop" or "unsubscribe."
  • Report it to your manager or IT support. Forward the email if possible.
  • Delete it after reporting. Do not forward it to coworkers.

If you are unsure whether a message is real:

  • Go directly to the source. Open your browser and type the website address yourself. For example, go directly to your HR portal by typing the address you normally use.
  • Call or ask in person. Contact the person who supposedly sent the email using a phone number you already know (not one in the email).
The golden ruleWhen in doubt, do not click. Go directly to the website yourself or call the sender. A legitimate request will still be there when you verify it through a trusted channel.

If you already clicked a suspicious link:

  • Change your password immediately from a different device if possible.
  • Tell your manager or IT right away. The sooner they know, the faster they can protect your account and the company.
  • Do not feel embarrassed. Reporting quickly is the most important thing you can do.

Knowledge Check

Answer all 5 questions. Read each scenario carefully before choosing.

Passing score: 80% (4 out of 5)
Question 1 of 5
You receive an email from "HR Department" saying your benefits enrollment is about to expire. The email asks you to click a link to update your selections. The sender address is hr-updates@benefitportal-secure.com. What should you do?
Question 2 of 5
You get a text message that says: "BULK EQUIPMENT PAYROLL: Your direct deposit failed. Verify your bank details here: bit.ly/2kR9xM." What is the best course of action?
Question 3 of 5
You receive an email from your company's real IT email address with a normal subject line: "Scheduled maintenance this weekend. Email will be unavailable Saturday 2 AM - 6 AM. No action needed." What should you think about this email?
Question 4 of 5
What is the best way to check if a link in an email is safe before clicking it?
Question 5 of 5
You accidentally clicked a link in a suspicious email and entered your password on a page that looked like your HR portal login. What is the most important thing to do first?