Recognizing phishing: a practical guide for your team
The warning signs that matter most, why invoice and payment fraud is so common, and what to do after a suspicious click.
By JN CORE TECHNOLOGIES 5 min read
Phishing remains one of the most common ways attackers get into small businesses. The good news: a team that knows what to look for — and feels comfortable reporting mistakes — is a strong defense.
The warning signs that matter most
Spelling mistakes used to be the giveaway. Today, many phishing messages are well written, so focus on what the message asks you to do:
- Urgency or pressure. "Your account will be closed today." "I need this before my meeting."
- A request involving money or credentials. Changing bank details, buying gift cards, approving a payment, or "verifying" a password.
- A mismatch. The display name says your CEO, but the address is unfamiliar. The link text says one site, but hovering shows another.
- An unexpected attachment or sign-in page, especially a file-sharing notice you weren't expecting.
- Unusual MFA prompts you didn't trigger. Never approve a sign-in request you didn't start.
Invoice and payment fraud
Some of the most costly scams involve no malware at all. A criminal impersonates a vendor — or compromises a real vendor's mailbox — and asks you to send payment to a "new" bank account.
A simple rule prevents most of these losses: verify any change to payment details by calling a known phone number, not one included in the email.
What to do if you clicked
Clicking a link happens to careful people. What matters is acting quickly:
- Tell someone right away — your manager or IT contact. Speed matters more than embarrassment.
- If you entered a password, change it immediately from a trusted device and tell IT so they can revoke active sessions.
- If you opened an attachment, disconnect the device from the network and contact IT. Don't wipe or reset it yourself — that can destroy evidence of what happened.
- If money was sent, contact your bank immediately. Time is critical.
Building a reporting culture
The goal isn't zero clicks — it's fast reporting. Thank people who report suspicious messages, even false alarms. Make reporting easy, such as a dedicated email address or the "Report" button in Outlook.
Want help training your team or setting up phishing protections? See our cybersecurity services.
This article provides general information, not professional advice for your specific situation. Product names and features change over time; verify current details with the vendor's documentation.
All resources