Phishing and AI at work: verify requests before you act

The new risk is a request that seems normal

The most dangerous reflex is: “The message looks real, so I’ll take care of it quickly.” Fraudsters deliberately try to reduce thinking time. They may invoke payroll that must go out before noon, an executive’s emergency, a file update, a security problem or a new employee’s imminent arrival.

Treat any unusual request involving payment, access or personal information as something to confirm. Use known contact details, a verified internal portal or an in-person conversation. An email account can be compromised and a voice can be imitated; do not rely solely on the message’s appearance. In its October 8, 2026 update - French resource, the Commission d’accès à l’information (CAI) notes that emails, voices, videos and QR codes can appear legitimate without being so.

Four simple rules to make visible

1. Pause before you act

Urgency is a reason to verify, not a reason to bypass controls. A short pause can prevent an exceptional request from becoming a costly mistake.

2. Verify through another channel

Replying within the same email thread is not independent verification. For a sensitive transaction, use known contact details and apply the established controls. Never share a password or authentication code in response to an unexpected request.

3. Limit what you share

Personnel files, banking details, medical information, insurance documents, applications and performance management records must be handled carefully. Before sending a document, ask whether all the information is necessary and whether the recipient is authorized to receive it.

4. Report it even when no harm is apparent

An attempt should be reported to the designated people. It is not automatically a confidentiality incident. If there are grounds to believe that a confidentiality incident involving personal information has occurred, have the facts assessed, preserve relevant evidence and apply the established process.

Do your procedures clearly identify who verifies requests and receives reports

Who confirms a banking change? Which channel should people use if the usual email seems suspicious? Who receives reports of unusual requests? Exact HR can help clarify roles, procedures and personal information protection tools, in coordination with the people responsible for your operations and IT, within the agreed engagement.

Useful training includes practice with realistic situations

Awareness activities should reflect the risks and people’s roles. Short scenarios can complement training: a payment request by text, a banking change, a suspicious link or a QR code. This frequency and format are operational recommendations, not a universal annual requirement imposed by Law 25.

Does your team need Law 25 training

Do your HR staff, administrative team and managers handle the same information? Do they know what to do when a request appears credible but unusual? We can train your team in personal information protection practices and tailor examples to their roles. Objectives, content and format are clarified with you. Technical controls are addressed in coordination with your IT or cybersecurity resource.

For broader support, explore our Law 25 and personal information protection services.

The manager’s role is to make caution acceptable

A team will not follow a verification procedure if people fear being seen as slow, rigid or distrustful. Managers should repeat a clear message: it is always acceptable to take time to verify a request involving money, access or personal information.

Avoid discouraging reports through an automatic blame response. Examine the procedure, access permissions, imposed deadline and training. Under Quebec’s private-sector framework, a confidentiality incident requires reasonable measures and an entry in the incident register. Where there is a risk of serious injury, the required notices must be given promptly, subject to applicable exceptions. An attempt or a click, considered alone, does not establish the conclusion. Private-sector privacy legislation, sections 3.5 to 3.8 - linked French text.

A related video from Exact HR

To explore access permissions and digital tools further. This French-language video covers AI agents; it does not replace a phishing response procedure.