How to Spot a Phishing Email: A Field Guide for Small Business Staff
Phishing messages are designed to look routine. Learn the common warning signs, the tactics aimed at small businesses and a simple process for checking before you click.
Most cyberattacks on small businesses do not start with sophisticated hacking. They start with an email that looks ordinary: an unpaid invoice, a shared document, a message from the boss asking for a quick favor. Phishing works because it borrows the shape of everyday business. The defense is a team that knows what to look for and feels comfortable slowing down.
The classic warning signs
- Urgency or pressure. Your account will be closed, the payment is overdue, the request is needed in the next hour.
- A mismatched sender. The display name looks right, but the actual address is from an unfamiliar or slightly misspelled domain.
- Unexpected attachments or links. Especially files you were not expecting or links to login pages.
- Requests to bypass normal process. Pay a new account, buy gift cards, keep this confidential.
- Links that do not match. Hovering over a link on a computer shows a destination different from the text.
Modern phishing is often polished, with correct logos and good grammar. The absence of typos is not a sign of safety.
Tactics aimed at small businesses
Some schemes target the way small teams operate. Business email compromise involves an attacker impersonating an executive, vendor or client to redirect a payment. A common version is a vendor email announcing new bank details. Another is a message that appears to come from the owner, asking an employee to buy gift cards for a client. Fake invoices, fake shipping notices and fake shared-document alerts are also widespread.
Phishing also arrives by text message and phone call, so the same caution applies beyond email.
A simple verification routine
Give everyone permission to pause and a clear process to follow:
- Do not use contact information in the suspicious message. Look up the person or company separately.
- Verify any change to payment instructions by calling a known number before sending money.
- Open shared documents by logging into the service directly, not through the email link.
- When in doubt, ask a colleague. A second opinion takes seconds.
What to do after a click
Mistakes happen, and fast reporting matters more than blame. If someone clicks a link or enters a password on a suspicious page, they should report it immediately, change the affected password from a trusted device and make sure multi-factor authentication is on. If money was sent, contact your bank right away. A culture where people report quickly limits the damage.
Keep the training short and regular
A long annual training session fades quickly. Short, regular reminders work better: share a real example the team received, review the warning signs at a staff meeting, and celebrate the person who caught a suspicious message. The Federal Trade Commission and the Cybersecurity and Infrastructure Security Agency publish free small business guidance at ftc.gov and cisa.gov.
