A message can ask you to open an attachment, enter credentials, or edit a payment with apparent urgency. The displayed name of the sender and a convincing text are not enough to prove the authenticity of the request. The verification needs to be arranged before it serves.
The NIST Phishing Guide draws attention to messages that solicit actions on data, accounts, or money. For the company, I propose to define which requests require a confirmation through a contact already known, distinct from that provided in the suspicious message.
A hypothetical example is the communication of new bank details from a supplier. Before taking action, the person in charge can use the verification path established by the organization. The procedure must also be practicable when those who habitually follow the report are absent.
It is useful to make it easy to report doubts, without waiting for the certainty of an attack. Those who receive a suspicious request should know who to turn to and what information to keep. Training can use controlled and up-to-date examples. The desired result is a verification pause proportionate to the consequences of the action, capable of reducing the pressure of urgency and involving the competent persons before the decision.