The CharlesWorks Corner

What To Do When You Receive One?

Do not reply. Do not pay. Do not click links. Do not open attachments. Do not scan strange quick response codes. Do not call phone numbers inside the message. Do not negotiate. Do not explain yourself. Do not threaten the scammer. Do not send any personal information. Mark the message as spam or junk. Then delete it. If you feel unsure, ask a trusted technical person. A second set of eyes helps.

What To Tell Employees?

Employees need simple rules. Do not panic. Do not reply. Do not pay. Do not click. Report the message. Save it for review if needed. Then let the right person inspect it. That process protects the business. It also protects the employee from embarrassment. Make sure staff know these scams exist. People handle threats better when they expect them. Surprise helps scammers. Training removes surprise.

What To Tell Family Members?

Family members need reassurance first. These messages can feel deeply upsetting. Start by saying, “This is a common scam.” Then explain the basic trick. Tell them the scammer likely has no video. Tell them not to answer. Tell them not to send money. Tell them you can help check the account. That calm response matters. Fear shrinks when people feel supported. Nobody should face these emails alone.

How To Respond As A Business?

A business should have a simple reporting process. Staff should know where to send suspicious emails. They should know not to click. They should know not to reply. They should know not to forward dangerous attachments casually. They should know to ask for help. The process should feel safe. If employees fear blame, they may hide mistakes. That helps scammers. A good business culture rewards quick reporting.

What Is SPF (Sender Policy Framework)?

SPF acts like a bouncer at an exclusive club. It tells the world exactly which mail servers are allowed to send emails on behalf of your domain. When you set up SPF, you’re essentially creating a list that says “These servers, and only these servers, can send emails from mydomain.com.” Any email claiming to be from your domain but sent from an unauthorized server gets flagged as suspicious.