Recognise the request behind the story
Look at what someone wants you to do, not only how convincing they sound. Requests include revealing a sign-in code, approving an unexpected login, installing support software or moving a conversation away from an established channel. A familiar business story can conceal an unfamiliar and unsafe action.
Attackers can build credibility from public information or earlier correspondence. They may create urgency, promise a benefit or claim an emergency. None proves fraud, but all justify verification before action. Staff should not need to decide with certainty that the person is malicious before pausing the request.
Verify identity independently
Pause and use a route you already trust, such as an internal directory or established supplier record. Do not rely on contact details supplied by the requester. Caller identification, display names and accurate knowledge of a project are not dependable identity checks.
Treat realistic audio and video with the same caution. Recordings and synthetic media can reproduce familiar voices or faces. Follow agreed approval rather than inventing personal questions during a pressured call. An independent callback works only if the number comes from a separate, trustworthy source.
Practise safe responses under pressure
Give staff language they can use: 'I need to verify this through our usual process.' Explain that legitimate colleagues and suppliers should expect checks. Provide an escalation route when delay is presented as dangerous, and ensure the response team can actually be reached during working arrangements.
Use scenarios involving telephone, messaging, physical access and email, not just links. Practise declining requests for passwords or authentication codes. Pair habits with restricted permissions and account safeguards. The process should limit the effect of a mistaken decision, not assume that no one will ever make one.
Report uncertainty without needing proof
Ask for the channel, time, requested action and anything already shared. Do not ask staff to keep engaging with a suspected attacker for evidence. A person who approved a login or installed a tool needs a clear immediate route to technical responders.
Preserve relevant messages where safe and follow the incident team's instructions. Avoid humiliation because people may delay disclosure when they expect criticism. Review which conditions made the request plausible and adjust controls. Compass is available now; this guidance promises no simulation or detection outcome on its own.