Our staff have all had phishing training and one of them still nearly fell for a fake quote request. What went wrong?

Think about what the training actually taught. Watch for the urgent invoice. Watch for the password reset nobody asked for. Watch for the angry notice about an account being suspended. Every example is a threat, and the lesson underneath all of them is the same: be suspicious when a message tries to alarm you.

A fake quote request does not alarm anyone. It offers you work. It lands in the one inbox nobody wants to filter aggressively, and it gets a fast, friendly reply, often from the owner, because responding quickly to a potential customer is not carelessness. It is good business.

So the person who nearly fell for it was not being sloppy. They were doing their job, and the attacker was counting on exactly that. It also lands hardest on small businesses for a structural reason. In a large company an inbound request goes into a purchasing process or a portal. In a ten person business it goes straight to the owner's phone while they are standing in a parking lot between jobs.

The fix is not more suspicion, which mostly produces slower replies and warnings people learn to tune out. It is one extra step in a place the training probably never mentioned: verify who you are dealing with before you produce anything of value for them, applied to inbound business and not just to suspicious invoices.

It is also worth looking at the examples your program uses. If every practice message is a threat, your team is being drilled on half the problem. Add one that flatters, and the next real one is much easier to spot.