Front Desk Staff and the Email That Looks Right

The inbox at the front desk

The address on the contact page, info or office or hello, is usually read by whoever sits at the front desk: a receptionist, an office manager, somebody covering the phones.

It receives everything. Customer questions, supplier invoices, delivery notices, and a steady stream of email built to look exactly like them.

October is Cyber Security Awareness Month. Much of the advice it prompts is aimed at owners and IT people, yet the person most likely to open the dangerous email sits at the front desk.

That person needs a short, specific briefing, not a lecture.

What arrives looking right

• The invoice from a supplier you use, with a document to open.
• The delivery notice for a parcel that could not be left.
• The shared document that needs a sign-in to view.
• The mailbox warning saying storage is full or a password expires today.
• The owner's request for gift cards or an urgent payment.
• The supplier's new bank details for the next payment.

The fifth is aimed squarely at the front desk. It uses the owner's real name, often copied from the website, and asks for something small and urgent while the owner is supposedly in a meeting.

Why they look right

Logos and layouts are copied from genuine emails, so the design proves nothing.

The sender's name shows a real supplier or a real colleague. The address behind the name is somebody else's, and on a phone it stays hidden unless you tap.

The timing is plausible, because the business really does receive invoices at month end and parcels most weeks. A fake arriving on the day a real one is due gets opened.

And each one asks for a single small action: open this, sign in here, pay that. The small action is the whole attack.

Three questions before clicking

Who really sent it? Look past the display name to the address. A colleague writing from a personal account, or a supplier from a free webmail address, is a reason to stop.

Were we expecting it? An invoice from a supplier you do not use, a parcel nobody ordered, a document from somebody you have never worked with.

What does it want me to do? Open an attachment, sign in, enable something, pay, keep it quiet or hurry. Any of those means checking another way first.

Three questions fit on a card beside the screen. A longer list would not get read.

Documents that ask for permission

Fake invoices often arrive as an office document that shows nothing useful when opened, just a short message and a yellow bar asking you to enable editing or enable content.

Enabling content lets code inside the document run, and that code can install harmful software on the computer. Genuine invoices almost never need it.

The front desk rule is simple: never press enable on a document that arrived by email. Forward it unopened to whoever handles invoices, and let them check with the supplier.

Links that lead to a sign-in page

Delivery notices and shared documents usually lead to a page asking for an email password, dressed up to look like your email provider's own.

The rule here is just as short: never sign in from a link in an email. Open the service from a bookmark, and anything genuine will be waiting there.

For a parcel, go to the courier's site directly and enter the tracking number from your own order, not the one in the message.

A worked example

A foot clinic with three practitioners and one receptionist ran its front desk from a shared inbox: appointment requests, insurance paperwork, and orders from the lab that makes its custom orthotics.

One morning an invoice arrived that seemed to come from the orthotics lab, on the day its monthly statement usually came. The attachment opened blank and asked her to enable content.

She clicked it, saw nothing, and forwarded the email to the owner to ask whether it looked right.

The owner knew the lab's statements came through its ordering portal, never as attachments, and phoned the lab, which had sent nothing.

The clinic's computer contractor took the machine off the network that morning, removed what the document had installed, and changed the passwords used on it from another device.

The receptionist had done one thing exactly right: she told somebody within the hour.

Requests for money

Any change to a supplier's bank details, any request to buy gift cards, any urgent transfer gets checked by calling a number already in your records.

Never use the number in the email itself. Whoever wrote the message also chose the number.

No genuine owner or supplier asks staff to buy gift cards and email back the codes. The request alone is enough to treat the message as fake.

Give the front desk explicit permission to delay. A payment held for an hour while somebody checks costs nothing; one sent to a stranger is usually gone.

Make telling someone easy

The worst outcome is not a click. It is a click nobody mentions, because the person who made it is embarrassed.

Name one person to tell, and say plainly that reporting a mistake straight away is right and that nobody will be in trouble for it.

Then know the next steps. A password typed into a fake page gets changed from another device, and the mailbox is checked for forwarding rules somebody else added.

A computer that opened a suspicious document is disconnected from the network until whoever looks after your computers has checked it.

The counter-case

A briefing does not replace the technical defences. Good spam filtering catches most of this before anyone sees it, and two-step verification on email limits what a stolen password can do.

In a two-person office where the owner reads every email, the briefing is a note to yourself, and five minutes covers it.

Nor does a briefing make anybody infallible. Busy people still click; the aim is fewer clicks and a quick report when one happens.

Brief whoever opens the shared inbox, this month, in words they will remember.

This month

1. Find out who reads the shared inbox.
2. Write the three questions on one card.
3. Never enable content on emailed documents.
4. Never sign in from a link in an email.
5. Confirm money requests on a known number.
6. Name one person to tell straight away.
7. Repeat the briefing for every new hire.

Step six is the one that decides how much a mistake costs. Most of the harm from a stolen password or an infected computer happens while nobody knows about it.

Unique passwords, which limit the harm when one is caught, are covered in strong passwords suggested by the iPhone.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.