Phishing awareness kit for small businesses

What's inside

1. Facilitator guide, 4 pages. How to prepare and run the session, minute by minute, with what to say and answers to the questions people usually ask.
2. Exercise, 11 pages. 12 messages to review in pairs: texts, WhatsApp chats, emails, a phone call, a payment QR code and transfer receipts. Most are fake, not all. The answers are on separate pages.
3. Poster, 1 page. Six short rules for the wall, by the till and near the computers.
4. Policy, 1 page. Your company's rules for payments, codes and reporting, with blanks to fill in and sign.
5. The first hour, 1 page. What to do, in order, when someone has already clicked, paid or given a code.
6. Quiz, 4 pages. Ten closing questions, the answer sheet and a certificate of participation.

Every part comes in Spanish and in English, as PDFs ready to print on letter-size paper.

Who it's for

Small businesses without an IT department: a shop, an office, a clinic, a distributor. Whoever runs the session doesn't need to know anything about technology. The guide says what to do and what to say, and the day before it takes about 20 minutes to prepare: fill in the policy, choose who receives reports and print.

The examples are the ones that reach businesses in Colombia and Latin America: a DIAN notice with an attachment, the boss writing from a "new number" to ask for gift cards, a parcel that needs a small payment, a payment QR code on the counter, a transfer receipt that never arrived. All brands, people and numbers in it are made up.

How the session goes

1. Opening and the four signs of a fake message: hurry, something unexpected, a request for something sensitive, and a sender or link that doesn't add up.
2. The exercise in pairs, then the review together.
3. The policy and the first-hour sheet: who to call, and what to do when it has already happened.
4. The quiz and the certificates.

Afterwards, the poster and the first-hour sheet go on the wall and the signed policy goes in the file.

Licence

For use inside your own organization: print as many copies as your team needs and run the session as often as you like. Please don't resell the kit or share the files outside your organization.

Buying it

The checkout is run by Polar, our reseller: it takes the payment, sends the receipt and gives you the download. We never see your card details. If a file doesn't open or isn't what this page describes, write to us and we'll fix it or refund you.

Every eThorns tool and guide stays free. The kit is for teams that want the session ready to run.

Free guides on the same topic

• G21Fake DIAN emails: how to spot them and check what you oweA message says you owe DIAN, face an embargo or your RUT will be suspended? How to check it, see your real tax status, and what to do if you clicked.
• G17Fake payment receipts: how shops can check they were paidA customer sends a transfer screenshot and says "I already paid". Why a receipt proves nothing, how to check in your app, and a routine for your shop.
• G16How to tell if a payment QR code is fake before you paySpot payment QR codes pasted over a shop's code or sent by chat, see who a QR really pays, check the name in your app, and what to do if you paid.
• G19Package held text scam: how to check a delivery messageA text says your parcel is held and asks for a small fee or your address? How to check it with the courier, read the link, and what to do if you paid.
• G1Is this link safe? How to check a link before you clickFind the real domain in a link, expand short links, spot look-alike letters and brand-new domains, and know what to do if you already clicked.
• G4How to spot a fake website and check if a store is legitCheck the address, the domain's age and the page itself to tell whether a website or online store is real, and what to do if you already paid.