5 Printed Pieces That Stop a Phishing Email Before Anyone Pays It
A phishing email is not defeated by a filter, it is defeated by what the person on the receiving end does in the next thirty seconds. These five pieces put that answer in front of them, from $39.54 for 50 flyers.
Print cannot block a phishing email, so this kit attacks the moment after it arrives, when money either moves or does not. Five pieces cover it: standard notepads from $93.37 as the callback verification pad, standard brochures from $57.11 carrying the reporting address into the onboarding pack, standard letterheads from $99.95 so banking changes only ever travel by post, standard postcards from $16.48 telling customers that rule before somebody impersonates you, and standard flyers from $39.54 rotating one tell a month across every desk. All five start at $306.45 together, or $190.02 for the three that cover your own staff.
The picks
Five pieces, from $39.54 flyers to $120.82 carbonless forms
Buy the pad and the postcards first. Those two cover the place the money actually leaves and the people who get robbed when your name is used, and together they start at $109.85. The brochure, the letterheads and the flyers matter once you have staff who did not build the process. Prices come straight from the configurator and drop per piece as the quantity climbs.
Standard notepads from $93.37
The callback pad. Preprint the four questions and the fields for who was called, on which number, and what they confirmed. A payment change then costs somebody a written line rather than a judgement call made in eleven seconds.
Standard brochures from $57.11
The onboarding one-pager. New starters get the reporting address and the escalation path on day one, in the folder they are already holding, instead of in a training module scheduled for month four.
Standard letterheads from $99.95
The channel the attacker does not own. Bank detail changes leave your building on letterhead, by post, signed, and every customer has been told in advance that is the only way they will ever arrive.
Standard postcards from $16.48
The warning that lands before the attack does. One card to every customer and supplier carrying your real phone number and one sentence: we will never email you new payment details. Cheapest piece here at $16.48.
Standard flyers from $39.54
The rotating desk drop. One tell per month on every desk, cheap enough to reprint before people stop reading it, which is the failure mode of every awareness message that stays on the wall too long.
Where print actually helps
The filter, the person, and the payment
A phishing attempt passes through three gates before it costs anything. Print is useless at the first and decisive at the third, and knowing which is which stops you buying the wrong thing.
The first gate is the mail filter. It catches the mass campaigns, the known bad domains and the obvious spoofs, and there is nothing on paper that improves it. What gets through the filter is the message written for you specifically, using a domain registered last week, sent from a real mailbox with a clean reputation, referring to an invoice that genuinely exists. That message was built to survive a filter, so the filter is not where you spend the next hour of effort.
The second gate is the person. This is where awareness material lives, and its honest ceiling is recognition rather than prevention. A brochure in the onboarding pack and a flyer on the desk raise the odds that somebody pauses, and they dramatically raise the odds that somebody reports, which is the part that gets undervalued. A reported message that turns out to be genuine costs a minute. An unreported one that turns out to be fake costs an invoice.
The third gate is the payment, and this is where paper stops being a poster and becomes a control. A payee change that requires a written callback on a number from a contract cannot be completed by an attacker who only owns the mailbox. A banking notice that only ever arrives on posted letterhead cannot be faked by somebody who can only send email. Neither of those is awareness. They are procedures, and paper is what makes a procedure visible at the desk where it has to be followed. The reasoning behind the attack itself is in the phishing exposed guide, and the household equivalent of this layer is in protect your digital life.
What each piece does
The five pieces and the job each one holds
Each piece answers a different failure. Read the row, tap the piece to jump to its section, and start with whichever failure would cost you most this quarter.
| Piece | The job it does | When it makes sense | Starts at |
|---|---|---|---|
| Standard notepads | Turns a verification callback into a written, dated log | Anyone who can change a payee or release a payment | $93.37 |
| Standard brochures | Puts the reporting address and escalation path in the onboarding pack | Every new starter, contractor and seasonal hire | $57.11 |
| Standard letterheads | Carries banking changes on a channel email cannot imitate | You invoice customers or pay suppliers by transfer | $99.95 |
| Standard postcards | Tells customers your rule before somebody impersonates you | Before a busy season, a rebrand or a bank move | $16.48 |
| Standard flyers | Rotates one phishing tell a month across every desk | Offices where the same poster has hung for a year | $39.54 |
1. Standard notepads: the callback pad beside the phone in accounts payable
The most expensive phishing email in any business is not the one that steals a password. It is the one that changes a bank account on an invoice you were already going to pay. A preprinted pad from standard notepads at $93.37 is the cheapest way to turn that moment from a decision into a procedure, because the person holding the phone is reading fields rather than deciding whether to be rude to a supplier.
Print four questions and four boxes. Who did you call. Which number did you use, and where did that number come from. What did they confirm, in their words. Who else approved the change. Then a fifth line that does the real work: the number came from a contract, a statement or a card, and never from the message. That single constraint is what defeats a lookalike domain, because the attacker controls every contact route inside their own email and none of the ones you already had.
Format the pad to the desk it lives on. A 50 sheet glued pad on a 4.25 in by 5.5 in trim sits beside a phone without becoming paperwork, while a full letter pad tends to get filed and stop being used. Sheet counts and trims are set out in the standard notepad sizes guide, and the branding and sheet count trade-offs in custom business notepads sizes, sheet counts and branding uses.
Here is the limit nobody admits. A pad only works while the callback is genuinely made, and a pad on the desk of somebody who was told to hurry does nothing at all. So pair the paper with one rule that outranks urgency: no payee change is released the same day it is requested. If your finance process needs a duplicate that cannot be quietly edited afterwards, a two-part carbonless form keeps a copy at the desk and a copy in the file, and the mechanics of that are in NCR form security features explained.
2. Standard brochures: the escalation path a new starter gets on day one
Most people who fall for a phishing email have been employed for less than three months. They do not know which requests are normal, they have not met the finance director in person, and they have no idea who to tell. A short brochure in the onboarding pack fixes the last of those on day one. Standard brochures start at $57.11, and a trifold gives you six panels, which is more than enough and considerably better than a manual nobody opens.
Give each panel one job. What a phishing message looks like here, using your own domain as the example rather than a generic one. The four tells: manufactured urgency, a request to change bank or payroll details, a link whose text does not match its destination, and an attachment nobody asked for. The reporting address, printed large. What happens after you report, which matters more than people expect, because a new starter who fears looking foolish reports nothing. Then the sentence that gives them permission: nobody has ever been disciplined here for reporting a message that turned out to be genuine.
Fold and size are worth choosing rather than defaulting. A trifold slips into a starter folder, a half fold reads better if you want two large panels for the reporting steps, and the options are compared in common brochure sizes and fold options explained. Uncoated stock takes a pen, which is useful when the brochure carries a line for the manager name and the direct number.
Reprint it when the process changes, not annually out of habit. A brochure that names a reporting mailbox which no longer exists is worse than nothing, because the one person who did the right thing gets silence. The company-wide version of this thinking sits in online business security best practices, and the mechanics of the attack itself are in the phishing exposed guide.
3. Standard letterheads: bank changes on a channel email cannot imitate
Business email compromise works because a bank account change looks exactly like an ordinary email. The defense is not a better email. It is a rule that says a payment detail change is never announced by email at all, and then a printed channel that carries it instead. Standard letterheads from $99.95 give you that channel: a signed letter, posted, on stock a customer can feel.
Be honest about why this works, because the usual explanation is wrong. Letterhead is not hard to forge. What makes it effective is that the customer was told in advance which channel to expect, so a change arriving any other way is self-evidently false. The paper is the agreed shape of a legitimate message, and an attacker who has your mailbox still has to intercept post and match a signature to use it. Print the same rule in the footer of every letter you send, so the policy travels with the correspondence rather than living in a contract nobody rereads.
Match the letterhead to the rest of your stationery or the trick fails on arrival. A customer who has three of your letters on file will notice a fourth that uses a different logo weight or a different address block, and that is exactly the check you want them making. Stock choice, margins and the position of the letterhead block are covered in what makes an official letterhead and how to print professional letterhead, and keeping the set consistent is the subject of how to match your letterheads and business cards.
One practical note on stock. A 70 lb or 80 lb text weight sheet holds a wet signature without bleeding through and still feeds a standard office printer, while anything heavier starts to jam on the machines most offices actually own. If the letter carries anything that must resist alteration after signing, read what security printing is and how it stops document fraud before you choose the paper. Layouts you can start from are in our design templates.
4. Standard postcards: tell your customers the rule before somebody impersonates you
Your customers are the ones who get robbed when your brand is impersonated, and they will hear the rule from you or from nobody. Standard postcards start at $16.48, which makes them the cheapest piece in this kit and the only one that reaches people outside your building on a channel an attacker cannot reply to.
Keep the card to one message and one number. We will never email you new payment details. If anything about our bank account appears to change, stop and call this number, printed here. A postcard does that in a way an email announcing the same policy never can, because the email is exactly the artefact people are being warned about. It also survives on a noticeboard in an accounts office, which is where the person who actually processes your invoices sits.
Send it before you need it. The two moments worth timing it to are a bank change of your own, when a genuine notice is about to look suspicious, and the start of a busy season, when invoice volume rises and attention falls. If the list is long enough to mail properly, direct mail postcards handle addressing and postage as one job, and how postcard mailing services work explains what the service takes off your desk. For a supplier list where each card carries its own account reference, personalized postcards with variable data covers the setup.
The trade-off, stated plainly: a postcard is read by whoever picks up the post, so do not print anything on it you would not put on a noticeboard. No account numbers, no portal links, no customer references on the message side. A phone number and a rule are enough, and the format comparison against a sealed letter is in postcards versus letters.
5. Standard flyers: one tell a month, on every desk, cheap enough to replace
Awareness material fails in a predictable way. It goes up, it gets read twice, and within a month the eye treats it as part of the wall. The fix is not a better sheet. It is a cheaper one you are willing to throw away. Standard flyers from $39.54 are the cheapest way to put one message on every desk at once, and the price is low enough that replacing them monthly is a rounding error rather than a decision.
Run one tell per drop and nothing else. Month one, the lookalike domain, with a real example of your own address next to a plausible fake. Month two, the urgency script, quoting the actual phrasing from a message somebody in your building received. Month three, the payment change request. Month four, the attachment nobody asked for. A single point per sheet is remembered. A sheet listing eight is a policy document with a bright header.
Use the real examples you already have. The strongest awareness flyer any business can print is a redacted screenshot of a phishing attempt aimed at that business, with the tells circled, because it removes the belief that this happens to other people. Layout discipline for a single-message sheet is covered in how to design flyers, and gloss against uncoated matters here for a boring reason: uncoated takes a pen, so people annotate the sheet and pass it on.
Where flyers stop working is the remote team, and it is worth naming. Nobody drops a flyer on a kitchen table in another city, so a distributed company gets its coverage from the brochure in the onboarding pack and the callback rule on the pad instead. For a shared office, pair the drop with a wall piece on rotation from standard posters at $108.75, and put the reporting number on a card everybody keeps using standard business cards from $17.57. The full method behind all of it is in the phishing exposed guide.
Specs and pricing
The two pieces you will reorder, side by side
Flyers and notepads are the consumables here. Flyers get replaced monthly by design, and pads run out at whatever rate your finance desk verifies payments. Both are also where quantity moves the per-piece price most, so here are the live specs and price ladders straight from the configurator.
| Quantity | Price Per Unit | Total |
|---|---|---|
| 50 | 79.1¢ | $39.54 |
| 100 | 57.1¢ | $57.11 |
| 200 | 37.3¢ | $74.69 |
| 300 | 28.6¢ | $85.68 |
| 400 | 24.4¢ | $97.76 |
| 500 | 21.8¢ | $108.75 |
| 600 | 18.7¢ | $112.03 |
| 700 | 16.5¢ | $115.33 |
| Quantity | Price Per Unit | Total |
|---|---|---|
| 25 | $3.73 | $93.37 |
| 50 | $2.53 | $126.32 |
| 100 | $1.92 | $192.22 |
| 150 | $1.72 | $258.12 |
| 200 | $1.65 | $329.52 |
| 250 | $1.58 | $395.42 |
| 300 | $1.54 | $461.32 |
| 400 | $1.48 | $593.13 |
Wally almost paid the wrong account
The pad on the desk asked one question the email could not answer
Wally got an invoice from a supplier he pays every month, with a polite note that the bank details had changed. Everything matched: the logo, the reference, the amount, even the name of the person who usually sends it. He reached for the pad beside the phone, which asks where the number came from, and the honest answer was the email itself. So he called the number on last year's contract instead. The supplier had never sent it. The pad cost less than the invoice by several thousand percent, and it works because it asks a question nobody argues with.
Shop the business basics collection →See it in use
Flyers pinned up beside a desk
Explore more
Where to go next
By the numbers
What a payment rule can be printed on
Common Questions
Common questions about printing against phishing
Can printed material actually stop a phishing attack?
It cannot stop the message arriving, and any page that claims otherwise is selling paper rather than security. What print changes is the response. A callback pad turns a payment change from a snap judgement into four written fields. A brochure gives a new starter the reporting address before they need it. A letterhead rule means a bank change announced by email is obviously false. The email still lands. The money still stays where it was.
What should be printed on a callback verification pad?
Four fields and one constraint. Who you called, which number you used and where that number came from, what they confirmed in their own words, and who else approved the change. The constraint is the line that does the work: the number must come from a contract, a statement or a printed card, never from the message being verified. Add a date and an initial box so the pad doubles as a log if the payment is ever queried.
Why send a postcard about payment details instead of an email?
Because the email is the exact thing you are warning people about. A customer who receives an emailed notice saying we will never email you about bank details has no way to tell that message from the fake. A postcard arrives on a channel the attacker cannot reply to, carries a phone number the recipient can check against your invoices, and tends to stay pinned in the accounts office where invoices are actually processed.
Does letterhead really help when it is easy to forge?
The forgery risk is real, and the letterhead is not doing the work on its own. The rule is. Once customers know that a payment detail change only ever arrives as a signed letter in the post, anything arriving any other way fails immediately, and an attacker who has read your mailbox still has to intercept post and match a signature. Print the rule in the footer of every letter so the policy travels with your ordinary correspondence.
How often should awareness flyers be reprinted?
Monthly, with one tell per drop. An unchanged sheet stops being seen after roughly a month because the eye files it as furniture, so the value is in the rotation rather than the design. Standard flyers start at $39.54, which is low enough that replacing them is not a budget conversation. Use redacted examples of real attempts aimed at your own business, since a generic example lets people assume it happens elsewhere.
What does the five-piece kit cost to start?
The five starting prices come to $306.45 at 4OVER4.COM: standard notepads from $93.37, standard brochures from $57.11, standard letterheads from $99.95, standard postcards from $16.48 and standard flyers from $39.54. The desk trio of notepads, brochures and flyers covers your own staff for $190.02. Every price falls per piece as quantity rises, and the configurator updates live as you change size, stock and finish.
Which piece should a small business buy first?
The callback pad, if anyone in the business can change a payee or release a payment. That is where the money leaves. Second is the postcard, because it is the cheapest piece at $16.48 and it protects the people who get robbed when your name is used. The brochure, the letterhead and the flyers matter once you have staff who did not build the process and customers who have never met you.
Does any of this work for a fully remote team?
Partly, and it is worth being clear about the gap. Flyers and wall material assume a shared room, so a distributed team gets nothing from a desk drop. What still works is the brochure posted with the onboarding pack, the callback pad sent to anyone who handles payments, and the letterhead and postcard rules, which are about customers rather than offices. Print the pieces that travel and skip the ones that need a corridor.
Get Started
Print the procedure, not just the warning
Order the five-piece kit as one job at 4OVER4.COM. Set your sizes, stocks and quantities on any product and watch every price update live as you build the order.
Legal Disclaimer
Gold Standard guarantees apply to all standard orders placed through 4over4.com. Price match requires verifiable proof of a competitor's published price for an equivalent product with matching specifications and turnaround time. Satisfaction guarantee covers manufacturing defects and print quality issues. Contact support with order number and documentation. On-time delivery rate based on tracked orders 1999 to 2026. Individual results may vary based on shipping carrier performance.
