A suspicious email arrives during a busy afternoon. It appears to come from a regular supplier, asks for a quick change to payment details, and sounds perfectly reasonable. But the employee reading it hesitates since something feels unusual…but the owner is busy and there is no obvious person to ask. Should they reply, forward it to a colleague, or leave it until tomorrow? That uncertainty is a useful place to make a small improvement. Give everyone a clear answer to one question: “If a message feels suspicious, who do I contact and how?” A simple reporting routine helps staff turn uncertainty into action.
Make reporting part of everyday work
Small businesses often depend on informal communication. People ask questions across the shop floor, call the owner between jobs, or leave a note for the next shift. A security reporting routine should fit that environment. It needs a named person, a familiar contact method, and a backup when the first person is unavailable. New Zealand’s National Cyber Security Centre recommends making it easy for staff to report suspected problems and near misses. Its guidance also warns that punishing mistakes can encourage people to hide issues rather than report them. For a small business, this means making two expectations clear: staff should raise concerns promptly, and the person receiving them should respond constructively.
Choose one contact and a backup
First; decide who receives reports. This might be the owner, an office manager, or someone who coordinates with your external IT provider.
Then name a backup. A routine that depends on one person answering immediately will struggle when that person is serving customers, driving, or taking leave.
Also choose a contact method staff already know. For urgent concerns, a phone call or an in-person conversation may be appropriate. A dedicated email address or an existing reporting button can work when someone monitors it and knows how to respond.
Make the instructions easy to find during a normal working day. Include them in staff induction and keep the contact details somewhere accessible without relying entirely on the email account that might be affected.
If your email system has a reporting button, confirm where reports go and who reviews them. Staff should understand whether pressing it alerts your business, your IT provider, or only the email service.
Explain what to do while waiting
“Report anything suspicious” leaves an important question unanswered: what should the employee do next? Give staff a short, practical rule: Pause the requested action, contact the designated person, and wait for verification. While a message is being checked, staff should avoid clicking its links, opening its attachments, replying to it, or following instructions to share information or make changes. They should not need to prove that a message is fraudulent before raising a concern. An unexpected request or an unexplained change is enough reason to ask. Avoid encouraging people to circulate suspicious messages among colleagues for opinions. Use the agreed reporting method and keep the original message available for whoever investigates it.
Example: a supplier changes payment details
Imagine a small repair business receives an email that appears to come from a familiar parts supplier. The message says the supplier has changed banks and asks the business to update its records before paying the next invoice. It includes a normal-looking signature and refers to an existing order. The employee handling the inbox notices that the request is unusual.
With a clear routine, the next steps are straightforward:
- The employee pauses the requested change.
- They contact the designated manager using the business’s usual contact method.
- The manager checks with the supplier using a phone number already held in trusted records.
- The business updates its records only after verification and its normal approval process.
The contact details supplied in the suspicious message should not be used to verify that same message. Treat a request to change payment details as a reason for a separate check, even when the sender’s name looks familiar. The employee’s role is to raise the concern; the person responsible for approval handles the verification.
Make it safe to say “I already clicked”
Sometimes the concern comes after someone has opened an attachment, entered a password, or followed an instruction. Your routine must cover that situation too. Tell staff to report immediately and explain what happened. Useful information includes which message was involved, approximately when they interacted with it, and whether they entered information, downloaded something, or approved a request. The first response should help the person provide those facts. A calm “Thank you for telling me quickly” is more useful than criticism. The responsible person can then involve your IT provider or follow the business’s incident response procedure. If a payment may have been sent fraudulently, contact the bank promptly through a known official channel. Staff should not delay reporting while trying to solve the problem themselves.
Close the loop
A report should receive an acknowledgement. Let the employee know that someone is checking it and whether the requested action must remain on hold. Once the concern is resolved, explain the outcome where appropriate. Even a legitimate message can reveal a weakness in your routine. Perhaps a supplier’s request was unclear, or staff could not reach the backup contact. Use that information to improve the process. If the same question keeps appearing, clarify the instruction that causes uncertainty.
Try a ten-minute team exercise
At your next staff meeting, describe the supplier example above. No live suspicious message is needed. Ask everyone:
- Who would you contact first?
- How would you contact them?
- What would you do if they were unavailable?
- Which action would you pause?
- What would change if you had already clicked a link?
Compare the answers. If people name different contacts or cannot identify a backup, you have found something specific to fix. Write down the agreed routine, share it with everyone, and repeat the discussion with a different example at a later meeting.
Your next small improvement
Before the end of the week, choose a primary contact, a backup, and a reporting method. Make sure every employee can find those details and understands that uncertainty is enough reason to ask. Then check that the people receiving reports know how to obtain help. A useful reporting routine connects a moment of doubt with someone who can act. Keep that connection clear, accessible, and supportive.