Article Read Time
When an Employee Clicks a Phishing Link, the Failure Started Higher Up
In August 2022, the City of Lexington discovered that criminals had intercepted its email with the Community Action Council. They used that access to steer about $4 million in federal rent assistance and housing funds into their own bank accounts through three wire transfers. Mayor Linda Gorton called the city the victim of a crime and told reporters, “We must be sure government employees are well trained to detect it.” Commonwealth Sentinel believes that sentence puts the responsibility exactly where it belongs.
The usual story after a phishing loss runs the other way. Someone in accounting opened a message, followed a link, or approved a payment, and the conversation centers on that one person and what they missed. That framing is comfortable for everyone above the clerk’s desk, and it helps the same loss happen again.
Commonwealth Sentinel has long argued that a clicked phishing link is a symptom of decisions made by owners, managers, department heads, and elected officials. Those leaders decide whether training happens and whether it counts as paid time. They also decide whether payment changes require a phone call, and whether an employee who makes a mistake feels safe saying so within 10 minutes.
The numbers describe busy people, and busy people need phishing safeguards
The FBI’s Internet Crime Complaint Center, the federal office that collects reports of online fraud, logged 24,768 business email compromise complaints in 2025. Reported losses came to $3.046 billion. Business email compromise means a criminal uses a hijacked or faked email account to talk an organization into sending money or data to the wrong place.
Verizon’s 2026 Data Breach Investigations Report found that 62 percent of confirmed breaches involved a person, through a clicked link, a reused password, or a convincing call. That share has stayed about the same for several years, reflecting the normal limits of busy people working at speed. Ordinary limits call for ordinary safeguards, and leaders build them.
Even the people who run technology for a living make the same mistake. In a 2025 survey of 1,700 workers by the security firm Arctic Wolf, nearly two-thirds of senior IT executives admitted to clicking a phishing link. Of those who clicked, 17 percent said they never reported it. When network managers click and stay quiet, a clerk who does the same follows a pattern the organization has taught.
Phishing training is a line item someone has to approve
Most phishing training falls short for reasons that have little to do with the people sitting through it. It is held once a year, squeezed into a lunch hour, skipped by part-time staff, and forgotten until the insurance policy comes up for renewal. Someone with the authority to set a budget and a calendar makes each of those choices, and that same person can reverse them.
A leader who wants staff to recognize a fake invoice has to give them paid time to learn what one looks like, using real scams reaching Kentucky inboxes. That leader also has to sit in the same session. Employees quickly notice when the owner or the county judge-executive is excused from a requirement, and they conclude the requirement doesn’t matter much.
Written rules protect people who are moving fast
Training sharpens judgment, but it fails when someone is tired, rushed, or trying to help a caller who sounds upset. The strongest protection against phishing is a written rule that removes the decision from the moment. The most useful one is simple: any request to change where money goes is confirmed by calling a number already on file, never one from the message.
Only leadership can make that rule stick. A bookkeeper who stops to verify a vendor’s new bank account is protected only if the owner backs the delay, even when the payment is due that afternoon. Lexington’s review after the theft focused on how criminals bypassed the city’s wire transfer controls, a question of process and authority.
Reporting a phishing mistake has to be safe
The most expensive phishing click is the one nobody mentions. An office that hears about a bad link within minutes can reset a password, call the bank, and sometimes stop a transfer. An office that learns about it weeks later is usually calling its insurance carrier instead. Whether employees speak up quickly depends almost entirely on how the last person who spoke up was treated.
Leaders set that tone in plain ways. They name one person and one phone number for reporting, and they thank everyone who reports, including the people who raise false alarms. They share results from practice phishing emails as an office-wide number rather than a list of names. When a leader clicks something they shouldn’t have, the most useful thing they can do is say so at the next staff meeting.
How Commonwealth Sentinel helps leaders carry the load
Commonwealth Sentinel builds and runs phishing training for local governments, small businesses, and non-profits across the Commonwealth. Our programs include a kickoff session for every employee, short monthly refreshers, and practice phishing emails, with results shared as an office-wide number. We also help leaders write the payment-verification rule and reporting process described above, so those protections are in place before the next fake invoice arrives.
Our team brings more than 30 years of cyber security and critical infrastructure protection experience from the U.S. Navy, the FBI, and InfraGard to every session. We track the scams reaching Kentucky offices each week, so the examples staff sees in training match the messages landing in their own inboxes. We also ask leaders to attend alongside their staff, because employees take their cue from the person at the top.
Owners, managers, and elected officials who want to talk through a program for their own office can reach us at 502-234-5554, and we are glad to start with a conversation about where the office stands today.
An employee who clicks a phishing link has made one mistake, but an office that never trained, never set a rule, and never made reporting safe has made several. They all happened upstairs.