Guides
Part of How to decide what a phishing message actually wants from you
Phishing scams policy template with the blanks filled in
A phishing policy a small team will follow: the verification rule, the payment change clause, a no-blame reporting route, and the response order.
Most anti-phishing policies fail the same way. They tell staff to be vigilant, get read once during onboarding, and give nobody anything to do at the moment it matters.
A policy that works is short, names specific actions, and removes ambiguity about what the organization will never ask for. Below is a phishing policy template with the blanks filled in, written for a team of 5 to 50 people.
The defaults are real: named password managers, a named reporting channel, a dollar threshold for second approval, and a 12-month review cycle. One blank stays open, the legal name on your invoices. Delete what does not apply and keep the finished document to a page or two.
What to take away
- The policy's real job is to make one behavior normalstopping and checking, without needing permission.
- Publish what your organization will never do. Ambiguity is what the attack runs on.
- Reporting a mistake must cost nothing, or people will hide it while the damage grows.
- The filled-in defaultsBitwarden or 1Password for passwords, Slack for reports, $10,000 for second approval, 12 months for review.
1. Scope and owner
State who this covers and who owns it.
This policy applies to everyone working for or with the Company, including contractors and temporary staff, on any device used for work. It is owned by the operations lead and reviewed every 12 months, or after any incident.
Name a role rather than a person, so it survives someone leaving. "The Company" means the legal name on your invoices and offer letters, pasted into the header once.
2. The verification rule
This clause does most of the work. If you keep one section, keep this one.
Verification Rule Decision Path
- Request arrives by message, call, or email
- Asks for payment, details, password, code, install, access
- Verify using contact details we already hold
- Never use contact details supplied in the request
- Applies regardless of who it appears to come from
- If verification impossible and urgent, role approves exception
- Exception reason is recorded
Any request that arrives by message, call, or email is verified using contact details we already hold, never contact details supplied in the request itself. That covers requests for a payment, a change to payment details, a password, a one-time code, an installation, or remote access.
It applies to every sender and caller, including the founder, the operations lead, and anyone writing from a company email address.
Add the exception path underneath, or people will route around the rule when it blocks something legitimate.
Where verification is not possible and the matter is genuinely urgent, the operations lead may approve an exception and records the reason.
3. What we will never ask for
The Company will never ask you for a password or a one-time code. We will never send new bank details by email. We will never ask for remote access to your device from a call you did not make. No one will ask you to keep a payment or a request secret from colleagues.
Put the customer-facing version on your site and in your order confirmations, where it is read at the moment it is useful. Take Five, the UK banking fraud campaign run by UK Finance, publishes a comparable list for retail customers.
4. Payments and payment changes
The clause that protects the largest single loss.
Payment Change Verification Checklist
- Change to bank details confirmed by telephone
- Use number held in our own records
- Confirmed by person other than request receiver
- Payments above amount require second approver
- New payees set up only from written request
- Written request verified in same way
A change to a supplier's or an employee's bank details is confirmed by telephone, on a number held in our own records, before the change is made. The call is made by a person other than the one who received the request.
Payments above $10,000 require a second approver. New payees are set up only from a written request verified in the same way.
Set the threshold to a number that is meaningful for your size. Check the callback limit your bank sets for outgoing transfers and use the lower of the two numbers.
The FBI's Internet Crime Complaint Center tracks business email compromise as one of its highest-loss categories, with reported losses in the billions of dollars. A $10,000 second-approver rule blocks the common case.
5. Passwords, keys, and the authentication baseline
Authentication Baseline Requirements
- Every work account uses a unique password
- Password stored in approved password manager
- Multi-factor authentication required on all work accounts
- Phishing-resistant method used for email, admin, money accounts
- Backup codes held by role
Four password managers publish small-team plans with a shared vault, an admin console, and per-user billing. Bitwarden Teams lists at $4 per user per month billed annually. 1Password Business lists at $7.99 per user per month billed annually.
Keeper Business lists at $3.75 per user per month, and Dashlane Business sits near $8. All four prices are as of 2026, so confirm the current rate on the vendor page before you buy.
For the second factor, Microsoft Authenticator and Google Authenticator are free and take a few minutes to enroll. A hardware key is stronger: Yubico's YubiKey 5 NFC lists around $55, and Google's Titan Security Key around $30 to $60. Buy two per administrative user and keep one offsite.
The public guidance behind that baseline is CISA's advice on turning on multi-factor authentication.
6. Reporting
Make it one action and name the route.
Reporting a Suspicious Message
- Report anything suspicious immediately to route
- Report whether or not you interacted with it
- If you clicked, typed, paid, or installed, report straight away
- Do not attempt to fix it first
- No discipline for reporting a mistake or harmless item
- Delay is the only failure recognized
Report anything suspicious to the #phishing channel in Slack, or to the reporting address named in your email client, immediately, whether or not you interacted with it.
If you clicked, typed, paid, or installed anything, report it straight away and do not attempt to fix it first. No one is disciplined for reporting a mistake, or for reporting something that turns out to be harmless. Delay is the only failure this policy recognizes.
Both major mail platforms handle the first step for you. Outlook's Report Message add-in and Gmail's Report phishing option file the message with its headers intact, which is what a responder needs to trace it.
That last sentence matters more than the rest of the document. A team that hides clicks is worse off than a team with no policy.
7. Response
Keep it to the sequence people will follow under pressure.
Incident Response Sequence
- Preserve message and screenshots before deleting
- If money moved, role contacts bank immediately
- If credentials entered, change password and end sessions
- Check recovery contacts, forwarding, filters, apps
- If software installed or remote access allowed, disconnect device
- Hand device to role
On report, preserve the message and any screenshots before deleting anything. If money moved, the operations lead calls the bank immediately. If credentials were entered, change the password and end all sessions.
Check recovery contacts, forwarding rules, filters, and connected applications on the affected account. If software was installed or remote access was allowed, disconnect the device and hand it to the operations lead.
The reasoning behind that ordering, and what each step is protecting, is in phishing scams. External reporting routes, and which body handles what, are collected at USAGov's page on where to report a scam.
In the United States, the FBI's Internet Crime Complaint Center at ic3.gov takes internet crime reports, and the FTC at ReportFraud.ftc.gov takes consumer fraud. The UK route is Action Fraud, and Australia's is Scamwatch.
8. What gets recorded
Every report is logged with the date, the channel it arrived on, what was requested, what if anything was done, and the outcome. The log is reviewed every quarter to see what is reaching people and what our controls are missing.
Count reports rather than counting failures. A rising number of reports is usually good news about the culture, not bad news about the threat.
9. Training and simulated phishing exercises
Two lines are enough here.
Everyone receives a short briefing on joining and a refresher every 12 months. Simulated exercises, where used, are run to test controls and are never used to identify or penalize individuals.
An exercise that produces a list of people to embarrass will make the reporting clause in section 6 worthless within a month.
Simulation platforms such as KnowBe4, Proofpoint, and Cofense bundle fake-message campaigns with a reporting button. Small-team plans typically run $15 to $40 per user per year in most markets.
10. Review
This policy is reviewed every 12 months and after any incident. Changes to how the Company verifies requests are communicated to staff and customers directly, through channels they already use, and never through a link in an unexpected message.
Adapting this honestly
Two cautions. First, none of the above is legal advice, and requirements around reporting, personal data, and payment fraud differ by jurisdiction and sector, so check your own obligations with someone qualified rather than assuming a template covers them.
Second, a policy is not a control. It only works with unique passwords, strong second factors, a monitored reporting route, and the account hygiene in the social media account security audit for public-facing accounts.
The personal version of the same rules, for people you cannot write policy for, is in phishing scams rules.
Common questions
How long should the finished policy be?
One or two pages. Anything longer will not be read, and the parts that matter are sections 2, 3, and 6.
Do small teams need this?
Small teams need the payment clause most of all. They usually have no second approver by default, so one person can move money alone.
Should we run simulated phishing exercises?
Only if the results are used to fix controls rather than to name people. Handled badly they train staff to distrust internal communication, which is exactly the wrong outcome.
What about staff who are impersonated to customers?
That is a separate problem with its own response, and it is covered in impersonation scams. Publishing the section 3 list to customers is the cheapest thing you can do about it.
Who should own this if we have no security team?
Whoever controls payments and account administration, because those are the two things the policy protects. Name the role in writing so it is not left to whoever notices.
