Summary (Key Takeaways)
- Someone who whizzes round phones and computers won’t necessarily notice a scam email, a copycat sign-in screen or a doctored invoice.
- Training only the people you think are “less techy” leaves gaps, because everyone has a weak spot, including the most experienced people in the business.
- Criminals only need one person to trust the wrong thing, and in a busy workshop one click can stop production, delay jobs or send a payment to the wrong account.
- Training needs to fit how your team really works: on phones, on shared workshop PCs and approving sign-ins on the go.
- Make “just checking” a normal part of the job, so people feel comfortable asking before they click, approve or pay.
“They’re Young, They’ll Be Fine With It”
Ask most business owners who in their team needs cyber security training and the answer often points one way: the people who aren’t so confident with computers. The apprentice who is never off their phone? The new starter in the office who sorted out the printer in two minutes? They’ll be fine. They’ve grown up with this stuff.
It is a natural thing to think. Younger staff have usually been online for most of their lives. They pick up new apps without reading the instructions and seem to know their way around any device you hand them.
But it is a risky assumption, and it can leave real holes in a business that otherwise looks well protected.
Knowing Your Way Round a Phone Isn’t the Same as Spotting a Scam
Using technology well and staying safe online are two different skills. One is about getting things done quickly. The other is about noticing when something ordinary-looking is really a trick.
Someone can be brilliant with a phone and still tap a link in a text that looks like it came from a parcel company. They can know the company laptop inside out and still type their password into a fake Microsoft login page. They can run their whole social life through apps and still not realise why using the same password for work and for their personal accounts puts the business at risk. If anything, being fast can work against people. The quicker someone moves, the less likely they are to pause and ask whether that email, that pop-up or that request really makes sense.
Everyone’s Got a Weak Spot
The truth is that everyone in a business has gaps in what they know about cyber security. They just sit in different places.
- The owner might spot a dodgy email a mile off but use the same password for the bank, the accounts software and their email.
- The office manager might be careful with passwords but trust an invoice that looks exactly like one from a regular supplier.
- The workshop supervisor might rarely open email but tap “approve” on a sign-in request on their phone just to make it go away.
- The apprentice might be great with technology but not yet know what a targeted scam looks like.
Passwords are a good example of a weak spot that crosses every age group. We looked at why tools and gadgets alone won’t fix it in why AI is clever but won’t keep your workshop secure.
Train only the people you think need it and you leave everyone else relying on luck.
How Criminals Pick Their Way In
Criminals aren’t fussy about who they catch. Age, job title and years of service make no difference to them. They just want the softest way in, and that is usually whoever takes a message at face value first.
Scam emails have come a long way from the badly spelled messages most people still imagine. Many now look professional, arrive at the right moment and mention real names and real jobs, which is why we wrote about how phishing is changing the rules.
Some tricks don’t even look like scams. A pop-up asking someone to “prove you’re human” feels completely routine, yet criminals use it to get people to run harmful commands on their own PC. We explained how in the fake CAPTCHA trick that can cost you time and money.
Security software catches a lot. It doesn’t catch everything. In the end, it often comes down to whoever happens to be holding the phone or sitting at the keyboard.
Phones, Shared PCs and Sign-In Requests on the Go
Work in a hands-on business rarely happens neatly at a desk. People check emails on their phones between jobs. A shared PC in the workshop is used by several people across a shift. Someone approves a sign-in request while standing at a machine or out on a customer’s site. Staff flick between work apps and personal apps all day long.
Each of those moments opens the door to a slip-up that simply wasn’t there when everyone worked at a desk. On a phone screen it is harder to see who an email is really from. When a sign-in request pops up mid-job, tapping yes is the quickest way to get rid of it. A shared PC that is never logged out means anyone can get to whatever the last person had open.
Multi-factor authentication is one of the best protections a business can have, but it only works if people understand what to do when a request they weren’t expecting appears. Our article on why MFA matters more than ever explains how it works and why that “approve” button deserves a second look.
Good training talks about these real situations, not just textbook examples, so people recognise them when they happen on a busy Tuesday afternoon.
What It Costs When Someone Gets Caught Out
For a workshop, factory or garage, the cost of one bad click is rarely just an IT headache. It can mean:
- Downtime: If systems are locked or need checking, job scheduling, ordering and invoicing can grind to a halt, and the work backs up fast.
- Payment fraud: Criminals who get into an email account can quietly change bank details on an invoice, so a customer or supplier payment goes straight to them.
- Lost or leaked information: Customer drawings, pricing and contact details are valuable to criminals and to competitors.
- Damaged relationships: Customers who receive scam emails from your account, or whose orders are delayed, may think twice about coming back.
Compared with any of those, a bit of regular training is cheap.
Make “Just Checking” Part of the Job
On the shop floor, nobody thinks twice about someone asking before they use an unfamiliar machine or checking a measurement before cutting. Cyber security should work the same way.
If someone gets an email they weren’t expecting, an invoice with new bank details or a sign-in request they didn’t trigger, they should feel completely comfortable stopping and asking. That might mean ringing the supplier on the number you already have, asking the office manager to take a look or flagging it with your IT support. It should never feel like making a fuss.
The tone comes from the top. If the owner and managers join in with training, forward on anything that looks odd and say thanks when someone double-checks, the rest of the team soon does the same. And if someone does click something they shouldn’t, the most important thing is that they say so straight away. Telling people off for owning up just teaches them to keep quiet next time.
Training That Fits a Busy Workshop
Nobody wants to take the whole team off the tools for a day of slides. Training works better when it is short, practical and regular, more like a toolbox talk than a lecture. A few things to look for:
- Everyone takes part, from the owner to the newest apprentice, including people who rarely use a computer.
- Sessions are short enough to fit around the working day.
- Examples are real ones: supplier invoices, parcel texts, Microsoft sign-ins and pop-ups on the workshop PC.
- Safe practice runs, such as test phishing emails, show people what a convincing scam really looks like.
- New starters get the basics in their first week, alongside health and safety.
A Simple Plan to Get Everyone Up to Speed
- Find out when each person last had any cyber security training, if they ever have.
- Agree one simple way for anyone to report a suspicious email, text or pop-up.
- Make it a rule that any change to bank details is confirmed by phone using a number you already hold.
- Make sure shared PCs are locked or logged out when they’re not in use.
- Check that multi-factor authentication is switched on and that people know what to do with an unexpected request.
- Book short refresher sessions through the year rather than one long course.
Keep the Whole Team Pulling the Same Way
Cyber security isn’t something you can leave to the people who seem good with computers, and it isn’t just a job for your IT support. It works when the whole team understands the risks and feels comfortable stopping to check. The most phone-savvy apprentice and the most experienced manager both have something to learn, and the business is safer when they learn it together.
If your team hasn’t had any cyber security training lately, or you’re relying on people to work it out for themselves, EC Computers can help. We’ll get everyone up to speed without bringing the workshop to a stop.