Security awareness training for French towns and hospitals

Security awareness training in local government and hospitals must target the people who pick up the phone, not just IT staff. Switchboard, reception, accounting, medical secretaries and technical services receive calls from strangers every day. Fraudsters know this: they look for the least guarded door, and it is often a reception desk.

This article presents the three most frequent call scenarios in the public sector and healthcare. It offers a method to repeat and a way to organize the training. It extends our guide to security awareness training and vishing. The public-sector examples are set in France, where the services cited are French, but the call patterns are the same in any city office or hospital.

Why local governments and hospitals are exposed by phone

These organizations have points in common. They receive many outside calls, they have dispersed departments, and their staff are there to help. An employee who refuses to be helpful quickly feels at fault, which plays into the caller's hands.

National figures show the direction. According to the 2025 activity report from Cybermalveillance.gouv.fr, the French national cybersecurity support service, published on March 26, 2026, wire transfer fraud rose by 170%. It now affects electronic invoicing and payroll management. Phone number spoofing rose by 517%.

These figures concern all audiences. Above all they are a reminder that the number displayed proves nothing. A request to change bank account details deserves verification, whatever the department.

Scenario 1: the fake supplier who changes bank account details

Imagine a call to the accounting department of a city hall. The caller says he represents the company that maintains the municipal buildings. He asks: “We have changed banks, can you update our bank account details before the next payment?” A confirmation email arrives a few minutes later, with a correct logo.

The trap relies on routine. The supplier exists, the invoice is real, and only the destination of the payment changes. The defense is a simple rule. Any change of details is confirmed by a callback on the supplier's already known number, made by someone other than the person who received the request.

This scenario resembles the one described in CEO fraud and fake supplier calls, with one particularity: in the public sector, contracts and payment deadlines add legitimate pressure.

Scenario 2: the fake technician who wants access

In a hospital, a caller introduces himself as the provider of the patient record software. He says he has detected an incident. He asks an employee to read out a code, install a remote-access tool or give a password.

The pressure comes from the stakes: “If we do not intervene now, the department loses access to the records.” The staff member wants to protect patient care, and that wish is exactly what the caller exploits.

The answer fits in one sentence: “I do not give any access by phone. I am passing your request to the information systems department, who will call you back.” The subject is close to that of password reset requests at the service desk.

Scenario 3: the call to the switchboard or reception

The switchboard is a discreet entry point. A fraudster can look there for names, organization charts, extension numbers or the date a manager is away. This information is then used to prepare a more credible call to another department.

A call that seems harmless can be a step. “Can you connect me to the finance director? She is out of the office? Until when?” Every answer is polite, and each gives the caller one more piece.

The switchboard operator does not have to suspect everyone. They need a clear rule on what they may say. They also need phrases to say it without causing offense: “I do not give out who is in the office by phone, but I can pass on a message.”

A simple method for all staff

In a hospital or a city hall, staff do not have the same job, but the same method can serve everyone. It must fit into a few memorable actions.

Listen without promising. Let the caller finish, then say: “I am noting your request.”
Spot the lever. Urgency, authority, guilt, a request presented as minor. Naming the lever helps resist it, as explained in the article on the levers of social engineering.
Call back through a known channel. See the independent callback procedure.
Report. Warn the security contact, even if the call seems to lead nowhere.

For the last point, a grid of notes to fill in during the call is offered in the article on reporting a security incident.

The phrases to keep in mind

“I understand it is urgent. I have to follow procedure, I will call you back.”
“I cannot change bank account details on a simple call.”
“I am not allowed to give that information by phone.”
“Give me your name and number, I will pass it to the right department.”
“I would rather check, and if it is genuine, it will not bother you.”

A good refusal phrase does not justify itself at length. The more the employee explains, the more hooks the caller has to negotiate. This idea is developed in the article on how to say no on the phone under pressure.

Why spoken practice matters in these jobs

Public employees and care staff already have many modules to complete. One more module, clicked between two tasks, leaves few traces. What remains is the action you have already done.

An employee who has practiced saying “I cannot, I will call you back” against an insistent voice says it more naturally on the day. They have lived the awkwardness, the silence settling in, the temptation to give way. It is not knowledge that changes, it is the ease of acting.

Role-play also has an advantage for healthcare teams: it respects everyone's time. A short session, by voice, at the workstation, is better than heavy training that is hard to schedule. More examples are in our work on difficult conversations in care settings.

Organizing the training with role-plays

Face Up lets trainers create their own role-plays from the real cases of their institution. The trainer describes the persona: a fake supplier who insists, a fake technician who loses patience. The employee answers by voice. They then receive a debrief with their strengths, their points to improve and quotes of what they said.

The content stays that of the field: bank account details to change, remote access requested, a call to the switchboard. The trainer chooses the level of pressure and the expected objective. Staff can replay as many times as needed. For the general framework, see Face Up role-plays.

Common mistakes

Training of this kind rarely fails for lack of goodwill. It fails because the rules stay abstract. Here are the mistakes most often met.

Reserving awareness training for IT staff and managers.
Forgetting reception, the switchboard and administrative assistants, who are entry points.
Giving rules without phrases to apply them.
Not saying clearly who to report to, or how.
Treating a failed call as a fault rather than as information.

Regularity matters as much as content. A short, repeated session, in small groups, is easier to organize than a long course. It also lets the security contact collect real calls and turn them into new scenarios.

This loop between the field and training is the most useful. Every reported call attempt becomes a case to replay, with the caller's exact words, and the team improves on what it really meets.

Frequently asked questions

Who should be trained first in a local government?

Staff who handle money, access or information: accounting, payroll, switchboard, reception and IT support. A single poorly prepared person is enough to open the door.

Should care staff be trained on vishing?

Yes, at least those who answer the phone and have access to systems. The training must be short and tied to their situations, not to technical vocabulary.