Rules
Part of How to decide what a phishing message actually wants from you
Phishing rules for a team: sign-off, exceptions, no blame
Phishing rules that survive a busy day: a sign-off amount, a named approver for exceptions, a no-blame way to report a click, and an agreed family question.
A household or small team rulebook usually fails in three places: nobody can approve an exception, nobody dares admit a click, and nobody agreed the amount that needs a second signature. The rules themselves can be short. The arrangements around them decide whether they survive a busy day.
What to take away
- Keep the rulebook to one page and fewer than ten rules. A long list is a list nobody remembers.
- Name one person who approves exceptions, and say what evidence that person needs.
- Pick a sign-off amount in advance and stick to it. Most of the value is in the pause.
- Say in writing that reporting a click is never punished.
One page, three things made explicit
A rulebook nobody has read is decoration. Keep it to one page, and make three things explicit: what your side will never do, how to report a mistake, and the path for an exception.
Writing the one-page rulebook
- State what your side will never do
- Set a no-blame way to report a mistake
- Name who approves exceptions and evidence
Write the rules while nothing is happening. Under pressure people follow a rule they already have and improvise a bad one if they do not. A policy template with the blanks filled in saves starting from an empty page.
Three tests every rule must pass
Most household advice fails at least one of three tests, so check each draft rule against all of them before it goes on the page.
Three tests for a usable rule
- Testableyou can tell if you followed it
- Survives new tacticsroutes and requests
- Costs littlecheap enough to keep
- It is testable.You can tell whether you followed it. "Be careful with links" cannot be checked; "I open banking through the app, never from a message" can.
- It survives new tactics.Rules about spelling mistakes and odd greetings expired years ago. Rules about routes and about what is being requested do not, because the request is the part that cannot change.
- It costs little to follow.A rule that is expensive gets abandoned on the first busy day. Hanging up and calling back costs a minute, which is why it holds.
Who signs off, and above what amount
Pick one amount above which a second person signs off, write it on the page, and do not renegotiate it case by case. In a household or a small team, the pause is where most of the value sits.
The number matters less than having one. A figure agreed in advance is a rule; a feeling at the moment of payment is not.
| Situation | What the page says | Who confirms |
|---|---|---|
| Bank details change | Confirm by phoning a number already held, before paying | The named approver |
| A fee to release a parcel, refund, prize, job or loan | Do not pay; the fee is the shape of the scam | Nobody needs to |
| A request to move money to keep it safe | Refuse; no genuine fraud team asks for it | Nobody needs to |
| Payment above the agreed amount | Second person signs off | The second person |
| Insistence on a method with no dispute route | Pause; the insistence is the information | The named approver |
Money is where the loss becomes permanent, so these five rules are written out in full rather than left to judgment.
Money rules to write down
- No payment details change from a message
- Nothing gets paid to release something
- No moving money to keep it safe
- Payment method is a decision, not detail
- Second person signs off above agreed amount
The consumer regulator's own summary of the same patterns, written for people rather than for teams, is the FTC's page on how to avoid a scam.
What your side will never do
Tell customers and staff plainly what your side never does. A small business that says it never asks for codes, never emails new bank details, and never calls asking for remote access removes the ambiguity that the scam needs.
Code and credential rules
- Unprompted code means change that password
- Nobody ever receives a code from you
- Passwords typed only via your own route
- A manager that declines to fill is an answer
The same statement works in the other direction. Nobody ever receives a code from you, and there is no legitimate exception, which is what makes it a good rule. Nothing gets installed because a message asked for it, and there is no remote access to a device from an inbound contact.
A password manager that declines to fill a page is giving an answer, so nobody copies the credential across to make the page work. CISA's guidance on strong passwords explains why a manager beats memory.
Reporting a click without blame
Say in writing that reporting a click is never punished. The alternative is people hiding it while the damage grows, and a no-blame route is worth more than any amount of training.
The response to a click is time-sensitive, in the way set out in scam reporting and recovery. So name who hears the report and what that person does first.
An exception path with a named approver
Every rule needs an exception path, because a rule that genuinely blocks something legitimate will otherwise be broken quietly. Name who can approve the exception and what evidence they need, before the day it comes up.
Evidence means a callback, not a persuasive message. The approver reaches the requester on a number already held, and the exception is granted only after that call.
Keep a one-line record of each exception on the same page: who asked, who approved, what was checked. A rule with a visible trail of exceptions can be improved. One that is broken in silence cannot.
An agreed question for family and small teams
A voice is a claim about identity, not proof of one, and video is now in the same category. So agree a question in advance: something an outsider could not answer and that is not published anywhere.
Rules for familiar voices
- Money, codes or secrecy gets a callback
- Agree a question in advance with family
- Secrecy voids the request on its own
- A request for money, codes, or secrecy gets a callback, whoever appears to be asking and however they sound.
- Use the question without apology. Real relatives and colleagues accept being asked.
- Secrecy voids the request. Genuine processes survive being discussed with your bank, your colleagues, or your family.
When a rule feels inconvenient
The moment a rule feels annoying is usually the moment it is doing its job. Real organizations tolerate being called back, real colleagues tolerate a phone call, and real deadlines survive a five minute delay.
Pressure to skip your own rule, from anybody, for any reason, is the strongest single signal available to you. It is worth more attention than the wording of the message. Print that sentence on the page.
Common questions
Who should approve exceptions?
One named person, agreed before anything happens. The approver checks by callback, and the first line of the rulebook says who it is.
What amount should need a second signature?
Whatever the household or team agrees in advance. Pick a number and stick to it, because the pause is where the value is.
How long should the rulebook be?
One page and fewer than ten rules. The money and code rules carry most of the weight.
Does the rulebook cover the boss or a senior relative?
Yes. Pressure to skip a rule from anybody is a signal, and the exception path exists so that nobody has to break a rule quietly.
Someone I know is asking me to break a rule. Now what?
Treat the account as unverified until you have reached the person another way. A message from a friend's account is a message from whoever controls it, which is the subject of impersonation scams.
Which single rule does the most work?
Never verifying a message using contact details the message supplies. It is set out in phishing scams, and every callback on this page relies on it.
