Recognise the NCSC's five tell-tale signs of a scam, and spot spear phishing, QR code phishing and well-written messages that prove nothing
For anyone who uses email, a computer or a phone for work. Most attacks on businesses start with a message that gets someone to click, type a password or approve a request. The course covers phishing and impersonation, passwords, passkeys and two-step verification, keeping devices and papers safe at home, on the move and at client sites, and using AI tools without leaking confidential information. It ends with how to report an incident quickly and without blame, inside the business and to the NCSC, Report Fraud or Police Scotland. Advice and figures checked October 2026.
Content last reviewed 8 October 2026
What you will be able to do
- Recognise the NCSC's five tell-tale signs of a scam, and spot spear phishing, QR code phishing and well-written messages that prove nothing
- Check a suspicious request through a second channel, using contact details you already hold
- Refuse any request for your password or a one-time code, whoever appears to be asking
- Protect your accounts with unique passwords, a password manager, two-step verification and passkeys
- Recognise a prompt bombing attack on two-step verification and know what to do about it
- Keep work devices updated, locked and backed up, and install apps only from official or approved sources
- Work safely in public places, on public Wi-Fi and at client sites
- Stop tailgaters, keep client papers secure, and hand back old work devices and USB sticks rather than binning them
- Decide what you can and cannot put into an AI tool at work
- Report a cyber incident to your employer at once, and know the public reporting routes in each part of the UK
What is inside
5 modules, built to be applied at work.
Introduction
- Introduction2 min
Spotting phishing and impersonation
- How phishing works2 min
- Impersonation4 min
- Check your understanding2 min
Passwords, passkeys and two-step verification
- Quick recall1 min
- How passwords get stolen2 min
- Two-step verification3 min
- Check your understanding2 min
Devices, updates and working on the move
- Quick recall1 min
- Four habits that protect your devices1 min
- Working away from the office3 min
- Doors, desks and old devices2 min
- Check your understanding1 min
Using AI tools without leaking information
- Quick recall1 min
- Using AI tools without leaking information2 min
- Check your understanding1 min
Reporting quickly, without blame
- Quick recall1 min
- Anyone can be caught out5 min
- Reporting outside the business2 min
- Check your understanding1 min
- Course test5 min
A credential you can prove
Finish the course and earn a certificate with its own public verification page. Share it on LinkedIn or attach it to an application; anyone can check it.
Who wrote it and who checked it
- Next review due
- 8 October 2028
Courses that pair with this one
Chosen by the people who wrote the course, so the next step follows on from this one.
Fraud Prevention at Work
For anyone who reads email, approves an invoice or pays a supplier, which in most firms is everyone. Staff learn to spot fake invoices, changed bank details, CEO fraud and deepfake calls, and to check them with a call to a number already on file. It covers the Fraud Act, bribery and gifts, and the failure to prevent fraud offence. It also covers the rule, in force since June 2026, that makes any company or partnership guilty of a senior manager's fraud committed within their authority. It ends with a 15-question test; finish every lesson and pass it to get a certificate. Law and figures checked September 2026. General awareness, not legal advice.
Data Protection at Work
For anyone who handles names, emails, CVs or client records at work. Staff learn what counts as personal and special category data, the seven principles, the rules on marketing emails, and how to spot a subject access request or a data protection complaint and pass it on the same day. They learn to recognise a personal data breach and report it at once, to handle data safely at home, at client sites and in public, and to keep personal data out of unapproved AI tools. Includes the Data (Use and Access) Act 2025 changes. General awareness, not legal advice.
Equality, Diversity and Inclusion at Work
Equality law for everyone who works for a business in Great Britain. The course covers the nine protected characteristics in the Equality Act 2010, direct and indirect discrimination, discrimination arising from disability, reasonable adjustments, harassment and victimisation. It explains positive action, equal pay, bullying, the duty to prevent sexual harassment and the stronger rules from 30 October 2026 covering clients and other third parties, how to work fairly with colleagues whose views differ, and what to do if you see or experience something wrong.