Don't Take the Bait: Recognize Phishing and Scams

A fake purchase order. A last-minute change to delivery instructions. An urgent call or email from a vendor. Across today's interconnected businesses and supply chains, seemingly routine communications can have consequences that extend far beyond an inbox.

Phishing is no longer just about avoiding a questionable link or a poorly written email. Attackers are actively impersonating legitimate organizations, exploiting established business relationships, and manipulating the day-to-day processes that keep products and services moving. Artificial intelligence is making these schemes even more convincing, helping scammers craft realistic messages, impersonate voices, and scale their tactics across multiple channels.

Recent government warnings illustrate these concerns. In September 2025, the USDA warned produce sellers about an increase in reported scams in which criminals impersonate legitimate buyers to divert shipments of fruits and vegetables without payment. In April 2026, the FBI warned of a surge in cyber-enabled cargo theft involving phishing emails, compromised carrier accounts, and fraudulent shipping instructions. 

Whether through spear phishing (targeted attacks tailored to specific individuals or companies), whaling (schemes focused on C-level executives and high net-worth leaders), smishing (text-based scams relying on false urgency), or vishing (voice calls designed to trick victims into handing over sensitive data), digital deception leads to real-world losses.

This Cybersecurity Awareness Month, the goal is simple: strengthen your ability to recognize scams, verify unusual requests, most importantly – don’t take the bait!

The Fundamentals: Recognize, Verify, Report

Phishing defense doesn't require everyone to be a technical expert. It starts with recognizing when a request feels off and knowing the right steps to take.

1. Question Unexpected Requests & Urgent Demands. Scammers use artificial urgency to bait victims. Be cautious with anything sudden or unexpected: invoices, last-minute changes to payment details or shipping instructions, or requests for sensitive credentials. An email claiming a payment must be sent immediately or a caller requesting quick action should always prompt extra scrutiny.
   

2. Verify Through a Trusted Channel. Always check the source of a communication before taking action. Whether dealing with a buyer, supplier, transportation partner, or colleague, confirm requests using a known phone number or official communication channel. Never rely solely on the contact details or links provided within the message itself.
   

3. Think Beyond Email. Threats can come via texts, phone calls, QR codes, social media, and more. Attackers often target multiple channels to build credibility — whether it's a smishing text, a vishing call from "tech support," or a targeted spear phishing attempt — so treat unusual requests with equal caution regardless of how they arrive.
   

4. Protect Credentials and Verification Codes. Never share passwords, one-time passcodes, MFA verification approvals, or recovery details when the request is unexpected. Be particularly wary of anyone claiming to offer technical assistance who asks you to approve an unexpected login or modify account settings.
   

5. Report Suspicious Activity Quickly. Don't let a questionable message slip through the cracks. If a text, email, or voice message feels "phishy," report it through your organization's IT reporting process and delete it. Early reporting helps contain threats and prevents further losses, even if a link was already clicked.
   

Beyond the Fundamentals: Securing Supply Chains and Workflows

Effective phishing defense goes beyond filtering suspicious messages. It requires enabling safeguards that protect workflows, vendors, and financial transactions from increasingly sophisticated tactics.

1. Strengthen Identity and Access Controls

Phishing-resistant authentication (such as FIDO2 security keys and passkeys) provides critical defense against credential theft, but strong logins are only part of the equation. Scammers often attempt to bypass controls by impersonating employees, vendors, or IT support to request credential resets or access changes. Organizations should enforce strict verification requirements for account recovery, restrict changes to authentication settings, and monitor for unusual login attempts.

2. Keep Supplier and Payment Scams Off the Menu

Business email compromise (BEC) and vendor impersonation both exploit standard business routines like purchase orders, onboarding forms, and payment approvals. A convincing invoice or purchase agreement doesn't guarantee a legitimate transaction. Establishing independent verification procedures for new accounts, secondary approvals for financial transactions, and mandatory checks for updated banking details drastically reduces exposure to financial fraud.

3. Protect Logistics, Shipping, and Operational Workflows

Phishing schemes often attempt to hijack physical operations. Cargo theft and logistics scams can involve attackers posing as freight brokers, dispatchers, or carriers to alter pickup locations and redirect valuable shipments. Verifying changes to shipping instructions, confirming carrier credentials, and establishing clear authorization protocols before releasing goods can help keep physical inventory secure.

4. Prepare for AI-Enabled Scams and Synthetic Impersonation

Generative AI allows attackers to eliminate misspellings, match professional communication styles, generate synthetic voice audio for vishing, and build believable impersonations. Attackers may also use technical prompts (such as ClickFix) to trick employees into running malicious code under the guise of troubleshooting. Because traditional warning signs like poor grammar are becoming less common, organizations must verify all sensitive actions rather than relying on visual cues alone.

Don't Feed the Attackers and Don't Take the Bait.

Phishing succeeds when attackers successfully exploit trust, urgency, and daily routine. While technology and AI continue to make these attempts more persuasive, the core objective remains unchanged: getting someone to act before verifying.

Organizations cannot rely on individuals spotting every sophisticated scam. Maintaining strong verification standards and encouraging fast, detailed incident reporting helps stop suspicious requests before they cause operational or financial harm.

Verify before you pay, ship, or share. Whether a request comes from a familiar supplier, a trusted carrier, or someone claiming to provide technical support, a little extra scrutiny can prevent a lot of trouble.