A Message That Looks Real

On a particularly busy Monday morning at AK Jwwels, one of our employees receives a message, looking like it’s from a courier company, saying that a customer’s jewellery order can’t be delivered until they pay a small delivery fee, they need to click this link now. It looks legitimate, it has the courier company logo, a tracking number and looks very professional.

The email is a phishing scam actually, they want the employee to give them login credentials to steal payment information. If the employee doesn’t check the identity of the sender, the business risks losing access to important accounts, leaking information about customers and financial loss. (Federal Trade Commission [FTC], 2018).

What Is Phishing?

Phishing is a cyber-attack where scammers pretend to be a trusted organisation or individual to trick people into handing over sensitive information or doing something that benefits the scammers (National Institute of Standards and Technology [NIST], 2025). They are usually sent in emails, text messages, social media messages or on websites that are trying to look like real ones. The purpose of them is to get login details, passwords, payment information, and other sensitive business data.

For a small business like AK Jwwels, a phishing scam can lead to business operation disruption, leaked information about customers and damage of the customer trust of AK Jwwels(Federal Trade Commission [FTC], 2018). By understanding how phishing scams work, employees can learn how to stop them.

Why AK Jwwels Is at Risk

AK Jwwels relies on digital communication channels on a daily basis to communicate with its customers, suppliers and delivery people. Employees use Instagram, email and WhatsApp often; they send them to discuss custom jewellery orders, organise payments, and talk about when and where to deliver.

Sometimes, it’s difficult to tell if a message is real. Scammers take advantage of this as they can pretend to be a courier company, supplier or an existing customer and send them messages to steal information or redirect payments to their bank accounts. (Federal Trade Commission [FTC], 2018)

A successful phishing attack can result in financial loss, unauthorised access to the business’s accounts, leaked information, and damage to the customer trust Cyber Security Centre [ACSC], 2023) that AK Jwwels has built with its customers. All staff at AK Jwwels is expected to be alert to security issues like these.

How to Recognise a Phishing attempt

A phishing attempt aims to look convincing, so it might not be easy to tell if a communication is genuine or not. Employees should always pause and look out for potential phishing red flags before responding to emails, messages or social media messages.

Typical warning signs include(ACSC, 2023; IT Strategic, 2025):

• Unsolicited emails or messages, requesting urgent action
• Requests for a password, a one-time verification code or payment information
• An email address or username that is almost but not exactly right
• The URL on the page, which does not lead to the official website of a company
• Unexpected attachments from an unknown sender
• Grammar, spelling or formatting that is slightly off
• Requests to change payment or bank details, without confirmation from the person concerned

If any of these warning signs appear, employees should stop and confirm with the sender of the message.

What Employees Should Do

If an employee receives a message, do not open it, click on any link, or attachments before checking with the sender. Confirm the sender’s identity using an established contact method, such as a telephone number or the official website of the company or individual(Federal Trade Commission [FTC], 2018). Don’t share passwords, one-time verification codes or confidential business information with them via email or any other messenger service. Report the suspected phishing attack to AK Jwwels, who can take appropriate action. While these steps may seem straightforward, they can help safeguard AK Jwwels, its customers and its good reputation against phishing scams.

Key Takeways

Phishing attempts succeed because they can fool people into acting in the interest of the cyber criminals, but they can be prevented with employee awareness. By spotting warning signs, verifying questionable requests and reporting potential scams, employees can help AK Jwwels avoid becoming a victim of phishing scams, data leaks and loss of customers. Staying alert to phishing attempts and adhering to secure online practices will help to ensure that AK Jwwels stays safe.

References

Australian Cyber Security Centre. (2023). Small business cyber security guide. Australian Signals Directorate. https://www.cyber.gov.au/sites/default/files/2023-07/acsc_small_business_cyber_security_guide.pdf

Cybersecurity and Infrastructure Security Agency. (n.d.). Teach employees to avoid phishing. U.S. Department of Homeland Security. Retrieved July 26, 2026, from https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/teach-employees-avoid-phishing

Federal Trade Commission. (2018, November 29). Cybersecurity for small business: Phishing. https://www.ftc.gov/business-guidance/blog/2018/11/cybersecurity-small-business-phishing

IT Strategic. (2025, September 15). Top 3 small business cyber crimes & prevention tips. https://www.itstrategic.com.au/it-explainer/2025/9/15/top-3-cyber-crimes-impacting-small-businesses

National Institute of Standards and Technology. (2025). Phishing. U.S. Department of Commerce. https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/phishing

Cofense. (n.d.). 10 most common signs of a phishing email. https://cofense.com/knowledge-center/10-most-common-signs-of-a-phishing-email

Shcherbakova, T. (2021, January 11). Delivery payment fraud. Kaspersky Official Blog. https://www.kaspersky.com/blog/delivery-payment-scam/38281/