Employee Awareness · Guidance From ESI and FPOV
Cybersecurity best practices matter most in the moments that feel ordinary.
A payroll email asks you to confirm your banking information. A familiar voice requests an urgent payment. A QR code opens a login page that looks legitimate.
Would you pause—or proceed?
You do not need to become a cybersecurity expert to make safer decisions. You need reliable habits and a clear way to report something that seems wrong.
This guide adapts our partner FPOV’s 20 practices for workplace and personal use. Start with one habit today, then return to the others.
Build Safer Habits
10 Cybersecurity Best Practices to Follow
Use these habits when checking messages, signing in, sharing files, or working away from the office.
01Verify Unexpected Emails Before You Respond
An email can display your manager’s name without coming from your manager. Requests involving passwords, payments, payroll, or urgent account changes deserve extra attention.
Check the full sender address and whether you expected the request. A familiar logo or polished writing does not establish authenticity.
Take Action: Verify unusual requests through a known phone number, an established internal channel, or your organization’s approved process.
02Download Only From Trusted Sources
An unexpected attachment might look like an invoice, résumé, shipping notice, or shared file. Confirm the sender and purpose before opening it.
Take Action: When asked to update an account, open the official website or app yourself. Verify unexpected files before downloading them.
03Use Strong Passwords and Multifactor Authentication
Give every account a long, unique password. Use an employer-approved password manager for work credentials. For personal accounts, a long passphrase can be easier to remember than a short, predictable string.
NIST’s consumer password guidance recommends at least 15 characters. Turn on multifactor authentication (MFA) wherever available, and use passkeys or phishing-resistant options when supported by your organization.
Take Action: Start with your email account. Confirm that it has a unique password and MFA enabled.
04Follow Remote-Access Rules When Traveling
Working from a hotel or coffee shop should not mean improvising how you access business systems.
Most modern websites encrypt traffic, but encryption does not make a fraudulent website trustworthy. A VPN also cannot prevent you from giving information to a scammer. The FTC’s public Wi-Fi guidance explains this distinction.
Take Action: Use company-approved remote-access tools, including a VPN when required. Verify the network and website before accessing sensitive information.
05Inspect QR Codes Before Opening Links
QR-code phishing, or quishing, can send you to a fake payment or login page. Scammers may cover a legitimate code with their own or send an unexpected code by email or text.
Take Action: Preview the destination and check the domain. If uncertain, use the organization’s official website or app instead. See the FTC’s QR-code scam advice.
06Hang Up and Call Back
A familiar voice is not enough to verify an urgent request. AI tools can imitate voices, including those of people you know. The FTC recommends contacting the person through a number you already know.
At work, follow established approval procedures. At home, FPOV suggests a private family safe word as an additional check.
Take Action: End unexpected calls requesting money or confidential information, then verify the story independently.
07Share Sensitive Information Securely
Payroll records, employee information, customer details, and financial documents require careful handling. Even when email is encrypted in transit, a message can reach the wrong recipient, be forwarded, or become accessible through a compromised account.
Take Action: Use approved secure-sharing systems and check recipients and attachments before sending. Explore ESI’s guide to payroll and employee data security risks for more workplace examples.
08Limit What You Share Publicly
Birthdays, family relationships, travel plans, and workplace details can help a scammer make a request more believable. Deleted posts may still exist in screenshots or saved copies.
Take Action: Review who can see your posts, avoid revealing account-recovery answers, and help children understand what is safe to share.
09Monitor Financial Accounts and Credit Reports
Unfamiliar transactions or accounts can be signs of identity theft. Review statements, enable transaction alerts, and check your credit reports.
A credit freeze can help prevent new credit accounts from being opened in your name. Parents and guardians can also explore protection for children through the FTC’s child identity-theft guidance.
Take Action: Investigate unfamiliar activity promptly using the institution’s official contact information.
10Back Up Important Information Safely
A lost device, hardware failure, accidental deletion, or ransomware incident can interrupt access to important files. Keep personal backups protected with strong authentication.
Take Action: Follow your organization’s storage and backup procedures for business files. Avoid copying confidential information into personal accounts.
Reduce Everyday Exposure
10 Cybersecurity Mistakes to Avoid
Small shortcuts can undermine good precautions. Replace these behaviors with safer routines.
11Sharing Passwords or Verification Codes
A colleague who needs access should receive an individual account or approved delegated access. Sharing a login weakens accountability.
Better Habit: Use authorized sharing features. Keep passwords, recovery codes, and MFA verification codes private.
12Reusing Passwords Across Accounts
A stolen password may be tried on your other accounts. Small variations of the same password can also be predictable.
Better Habit: Give every account a unique password. Prioritize email, financial accounts, and workplace systems.
13Trusting Everything You See or Hear Online
Photos, recordings, videos, and written messages can be manipulated. Urgency and a recognizable identity do not establish that a sensitive request is legitimate.
Better Habit: Verify important claims independently before sharing them. Confirm requests through a trusted channel before sending money or information.
14Replying to Suspicious Texts
Fake delivery notices, toll-payment requests, and account alerts can lead to fraudulent websites or further contact with scammers.
Better Habit: Avoid replying or opening unexpected links. Check the official app or website, and use your phone’s reporting or blocking options.
15Delaying Software and Security Updates
Security updates address vulnerabilities that attackers may exploit. An update you keep postponing may contain an important fix.
Better Habit: Enable automatic updates on personal devices where appropriate. Follow IT instructions for work devices and report update problems.
16Leaving Devices Unlocked or Unattended
An unlocked phone or laptop can expose messages, documents, and business accounts. Physical security matters even during a brief break.
Better Habit: Lock your screen whenever you step away and keep devices secure in shared or public spaces.
17Using One Email Address for Everything
Using your work email for shopping, social platforms, and unrelated subscriptions can blur account ownership and add unnecessary messages to your inbox.
Better Habit: Keep work and personal accounts separate. For personal use, consider separate addresses or aliases for less important signups.
18Skipping the Basics When You Are Busy
Reading a warning once does little if everyday habits remain unchanged. Busy periods are precisely when a reliable routine helps.
Better Habit: Make verification, strong authentication, updates, and careful sharing part of normal work.
19Becoming Complacent About New Threats
Scammers change their methods. Recognizing one phishing message may not prepare you for a convincing phone call or fraudulent QR code.
Better Habit: Participate in training and review new guidance from your IT or security team.
20Waiting for an Incident to Prepare
When you suspect a compromised account, you should not have to search for the right reporting contact.
Better Habit: Know your organization’s reporting process before you need it. Report concerns promptly, even if you are unsure what happened.
Start Today
Your Five-Minute Cybersecurity Checklist
You do not have to change everything at once. Choose one improvement now.
- Confirm that MFA is enabled on your email account.
- Replace a reused password with a unique one.
- Save your organization’s security-reporting contact.
- Check for pending updates on personal devices.
- Review how you verify payment or payroll-change requests.
Already clicked a suspicious link or shared information? Contact your IT or security team immediately and follow their instructions. Explain what happened so they can assess the situation.
Turn Awareness Into Routine
Help Your Team Put These Habits Into Practice
Employees need more than a reminder to “be careful.” They need clear procedures they can follow under pressure.
Use this guide to start a short team discussion:
- How do we verify requests to change payment or payroll details?
- Where should employees report suspicious messages?
- Which systems are approved for sharing sensitive records?
- Can employees find these instructions quickly?
Reinforce the answers regularly and encourage prompt reporting. An employee who raises a concern gives your team an opportunity to investigate sooner.
Build reminders into onboarding and your employee training plan. Share one cybersecurity practice at a time rather than expecting everyone to absorb the entire guide at once.
A Practical Next Step for Employers
Strengthen How Your Team Handles Employee Information
Cybersecurity habits connect to everyday HR and payroll decisions: who can access records, how changes are verified, and how employees receive guidance.
Talk with ESI about your HR, payroll, and employee communication needs. Existing clients can contact their ESI representative about using this guide in team communications.
Schedule a Conversation With ESI →For technical security questions or a suspected incident, contact your organization’s IT or security provider.
Common Cybersecurity Questions
What Should I Do First to Improve My Cybersecurity?
Start with your email account: use a unique password and enable MFA. Then learn your workplace reporting process and how to verify unexpected requests involving money or sensitive information.
Does MFA Mean I Can Stop Worrying About Phishing?
No. MFA adds protection, but you still need to verify requests and avoid sharing codes or approving unexpected sign-in prompts. Ask your IT team about phishing-resistant options. CISA explains stronger MFA methods.
How Can Managers Reinforce Cybersecurity Best Practices?
Explain approved verification and reporting procedures, revisit them during onboarding and team meetings, and make reporting easy. Use this article as a shared reference and cover one habit at a time.
Make your next action a safer one. Bookmark this guide, share it with your team, and choose one practice for your next meeting.
Adapted by ESI from cybersecurity guidance provided by our partner, FPOV, with additional reference to public guidance from NIST, CISA, and the FTC. Follow your organization’s security policies and reporting procedures.
