Four Dodgy Messages, Fifteen Minutes: A Scam-Lure Fire Drill for Small Teams

Most small teams have had the same conversation. Someone forwards a suspicious text, everyone agrees it looks dodgy, and a note goes out saying 'be careful out there'. Then nothing changes until the next one lands.

The problem is not that people don't know scams exist. It is that scam messages arrive when someone is busy, half-looking at a phone, and trying to get a parcel redirected or a tax form finished. Awareness is not the same as practice. A short drill is.

Why a 15-minute drill beats another poster

A poster tells people what to fear. A drill tells them what to do. For underdog defenders in small organisations, the aim is not to turn everyone into a security analyst. It is to make one or two responses automatic: stop, check the sender or number, and report it through a route that actually gets looked at.

This exercise is deliberately small. You need four example messages, a meeting room or video call, and someone to keep time. No live links. No real phishing. No blaming anyone for clicking the wrong thing in a hypothetical.

The four lures UK teams actually see

Use screenshots or plain-text mock-ups. Do not send live links, even in a drill, because someone will click them out of habit and that is not the lesson you want.

1. The fake Royal Mail or courier text

A text says a parcel is held because of an unpaid fee. The link asks for card details or a small payment. Ask the team: what is the sender's full number? Does the link domain look like the real courier? Would a courier ask for card details by text? What do you do with the message?

The practical answer is simple: do not use the link. Track the parcel through the retailer or courier's own app or website. Report suspicious texts to 7726, the free reporting service used by UK mobile networks.

2. The HMRC refund email

An email claims a tax refund is waiting and asks you to 'confirm your details'. HMRC refunds are not claimed through a link in an unexpected email. Log in to the official government service separately if you want to check. Forward suspicious emails to [email protected].

Ask the team: what is the display name, and what is the actual email address? Does the message use urgency and a deadline? Does it ask for information HMRC already holds?

3. The energy rebate or bill phishing message

A message says your organisation is due a rebate or that your energy account is about to be restricted unless you update payment details. Small teams often have one person who pays the bills, so this one lands with real force. The safe route is to log in to the supplier's known account page or ring the number on a recent bill, not the number in the message.

4. Companies House impersonation

A fake notice claims a confirmation statement is overdue, a director has changed, or company details need urgent verification. It may link to a lookalike site asking for login details or payment. Check Companies House directly through gov.uk, not through the email link. Report suspected impersonation to Companies House and, if money or credentials have been lost, to Action Fraud.

Run the drill: a simple agenda

• 0–2 minutes: explain that this is a practice exercise and no one is being tested personally.
• 2–7 minutes: show each lure for about a minute. Ask three questions: what gives it away, what would you do first, and who would you tell?
• 7–12 minutes: compare answers. Focus on the safe route, not on who spotted the most clues.
• 12–15 minutes: agree one change to make reporting easier, and one mail-filter or account setting to check.

Keep it conversational. The moment it feels like an exam, people stop saying what they really think.

The boring mail-filter checks worth doing afterwards

A drill should end with a small bit of plumbing. You do not need an enterprise security team to do these checks.

• Confirm whether your domain has SPF, DKIM and DMARC records. NCSC Mail Check is a free starting point for UK organisations.
• Turn on external sender banners in Microsoft 365 or Google Workspace if you have not already. They are not perfect, but they slow people down.
• Look for obvious lookalike domains and display-name spoofing. If your finance inbox regularly gets messages from a supplier domain that is one letter off, that is worth blocking or flagging.
• Check mailbox rules. If an account is compromised, attackers often add forwarding or deletion rules. Review them quarterly.
• Make reporting easy. A dedicated 'report suspicious email' mailbox or button is better than 'tell Dave in IT', especially when Dave is on leave.

Free tools help, but the habit matters more than the tool. A mail filter that nobody reviews is just a comfort blanket.

What to measure without turning it into a compliance project

You do not need a dashboard. Count a few things: how many people knew the reporting route, how many spotted the fake domain, and whether the team agreed on who owns suspicious messages. Then fix one gap.

If people say 'I would just delete it', that is your gap. Deleting is not reporting. The next person may not be so lucky.

The underdog takeaway

Small organisations do not need a full phishing simulation platform to build scam-resistant habits. They need four realistic examples, a safe space to hesitate, and a reporting route that does not disappear into a void. Fifteen minutes, once a quarter, is enough to start. The parcel you didn't order is a good place to begin.