Mission 11
Safe Internet, Email and Business Communication
Everyday tools such as email, WhatsApp, browsers and cloud drives carry most of a small business’s work and most of its risk. Learn to verify unexpected requests through a known channel, share files only through approved tools, and handle links, attachments and public Wi-Fi with care.
In this mission you will
- Verify unexpected or unusual business requests using a known, independent channel.
- Explain why a familiar sender name or a padlock in the browser does not prove that a message or website is genuine.
- Share business files using approved platforms with the narrowest sensible permissions.
- Handle attachments, downloads and public Wi-Fi in ways that reduce risk to business data.
Business runs on communication
Quotes, purchase orders, invoices, payment confirmations, design files and customer lists move every day through email, WhatsApp, cloud drives and browsers. That makes these channels a favourite route for fraud and data leaks. The good news is that a few steady habits remove most of the risk. They are not about distrusting everyone. They are about checking the right things at the right moment.
What you see is not always what it is
- Sender names can be faked. 'Sharma Steels Accounts' can sit on top of an unrelated address. Look at the full address, but remember that even a correct address may belong to a compromised account.
- Links can show one text but go somewhere else. Look-alike web addresses may change or add a single character.
- A padlock or 'https' means the connection is encrypted. It does not prove the website is genuine or safe. Fake sites can have padlocks too.
- Pop-ups saying your computer is infected, or that you must call a support number, are usually scams. Close the tab and tell IT support.
- Search results and ads can point to fake copies of real services. Use saved bookmarks or official apps for banking and important portals.
Verify unexpected requests through a known channel
- 1Notice when a request is unexpected or unusual: new bank details, a changed delivery address, an urgent payment, a request for data or a login.
- 2Do not use the phone number, link or reply address in that message.
- 3Contact the person or company using details you already had: a saved number, a past purchase order, the official website you type yourself.
- 4Confirm the specific request, then follow your normal approval rules before acting.
- 5Keep a short note of who you checked with and when. Report anything that does not match.
Attachments and downloads
Attachments are a common way to deliver harmful software or to lead people to fake sign-in pages. Be careful with files you were not expecting, even from known contacts, especially compressed files, files that ask you to 'enable content' or 'enable macros', and documents that immediately ask you to sign in to view them. If in doubt, check with the sender by phone before opening. Download software only from official sources approved by your business. Keep your browser and operating system updated, because updates close security gaps attackers use.
Share files the approved way
Use the file-sharing platform your business has approved, rather than personal email, personal drives or random upload sites. Share the specific file or folder needed, not your whole drive. Give 'view' access unless editing is truly needed, share with named people rather than 'anyone with the link' for sensitive files, and set an expiry date where the tool allows it. Remove access when the work is finished. Be wary if a link asks you to grant an app permission to read all your files or mailbox. Stop and ask IT support before approving.
Practical business example
The changed delivery address at Nandini Home Textiles
Nandini Home Textiles is a fictional 22-person bedsheet manufacturer in Solapur. The sales coordinator Pooja received an email from a long-standing distributor in Hyderabad, written in the usual style and replying to a real order thread. It said their warehouse had moved and asked her to send the next consignment to a new address, and to email the full customer list for 'reconciliation'. The reply address looked right at first glance. Pooja remembered the team rule: changes are confirmed by phone. She called the distributor’s purchase manager on the number from last year’s purchase order. He knew nothing about it. Their email account had been compromised. Pooja reported it to her manager, who alerted the distributor using the same known number. No goods or data were sent. The business later moved customer files into an approved cloud folder with named-person access only.
The lesson: A real thread and a familiar style did not make the request genuine. A call to a known number stopped both a goods diversion and a data leak.
Key takeaways
- Verify unexpected requests, especially bank detail changes, through a known, independent channel before acting.
- Sender names can be faked and real accounts can be compromised. HTTPS protects the connection but does not prove a site is genuine.
- Reach important services through bookmarks or official apps, not links in messages or search ads.
- Share only the specific file needed, through approved platforms, with the narrowest access and a clear end date.
- Be careful with unexpected attachments and avoid payments or admin tasks on public Wi-Fi.
Scenario lab · +25 XP
The shared-drive link that wants everything
You handle administration at Coastal Spice Exports, a fictional 20-person spice trader in Kochi. You receive an email that appears to be from a buyer you have dealt with before: 'Please review the updated contract on our shared drive.' The link opens a sign-in page and then a screen asking you to allow an app to 'read, edit and download all files in your drive and access your mailbox'.
Fictional scenario. Never enter real passwords, OTPs or customer details anywhere in this course.
Decision 1 of 3
What do you do at the permission screen?
Knowledge check · +20 XP on mastery
Check your understanding
Practical action · +40 XP (self-reported)
Review sharing on a sample document
Practise safe sharing using a non-sensitive document, such as a blank template or a public brochure. Do not open or change sharing on files that hold customer data, financial records or passwords for this exercise.
- 1.Open your business’s approved file-sharing platform and choose one non-sensitive sample document.
- 2.Check who it is shared with, and whether the link is set to 'anyone with the link'.
- 3.Change access to named people only, with view access unless editing is needed.
- 4.If the platform allows it, set an expiry date for external sharing.
- 5.Save bookmarks for your banking, accounting and key portal sites on your work browser.
- 6.Note one thing you learnt and share it with your manager or team.
Do this in your own records. Don’t enter passwords, OTPs, customer data or incident details here.
Mission status: Not started
A mission is complete when you have read the lesson, answered the knowledge check and acknowledged the practical action. Mastery means scoring at least 3 of 4 on the knowledge check.
View my progress