How to Spot a Phishing Email: A Field Guide for Small Business Staff

Most cyberattacks on small businesses do not start with sophisticated hacking. They start with an email that looks ordinary: an unpaid invoice, a shared document, a message from the boss asking for a quick favor. Phishing works because it borrows the shape of everyday business. The defense is a team that knows what to look for and feels comfortable slowing down.

The classic warning signs

• Urgency or pressure. Your account will be closed, the payment is overdue, the request is needed in the next hour.
• A mismatched sender. The display name looks right, but the actual address is from an unfamiliar or slightly misspelled domain.
• Unexpected attachments or links. Especially files you were not expecting or links to login pages.
• Requests to bypass normal process. Pay a new account, buy gift cards, keep this confidential.
• Links that do not match. Hovering over a link on a computer shows a destination different from the text.

Modern phishing is often polished, with correct logos and good grammar. The absence of typos is not a sign of safety.

Tactics aimed at small businesses

Some schemes target the way small teams operate. Business email compromise involves an attacker impersonating an executive, vendor or client to redirect a payment. A common version is a vendor email announcing new bank details. Another is a message that appears to come from the owner, asking an employee to buy gift cards for a client. Fake invoices, fake shipping notices and fake shared-document alerts are also widespread.

Phishing also arrives by text message and phone call, so the same caution applies beyond email.

A simple verification routine

Give everyone permission to pause and a clear process to follow:

• Do not use contact information in the suspicious message. Look up the person or company separately.
• Verify any change to payment instructions by calling a known number before sending money.
• Open shared documents by logging into the service directly, not through the email link.
• When in doubt, ask a colleague. A second opinion takes seconds.

What to do after a click

Mistakes happen, and fast reporting matters more than blame. If someone clicks a link or enters a password on a suspicious page, they should report it immediately, change the affected password from a trusted device and make sure multi-factor authentication is on. If money was sent, contact your bank right away. A culture where people report quickly limits the damage.

Keep the training short and regular

A long annual training session fades quickly. Short, regular reminders work better: share a real example the team received, review the warning signs at a staff meeting, and celebrate the person who caught a suspicious message. The Federal Trade Commission and the Cybersecurity and Infrastructure Security Agency publish free small business guidance at ftc.gov and cisa.gov.