Most serious security incidents at small businesses do not start with a genius hacker breaking through a firewall. They start with something far more ordinary: one convincing email, and one busy person who clicked before they thought. Phishing is still the number one way attackers get in, precisely because it targets people, not machines.
The good news is that almost every phishing email gives itself away if you know what to look for. Here is how to spot one in seconds.
What phishing actually is
Phishing is a fake message, usually email, designed to trick you into doing something: clicking a malicious link, entering your password on a lookalike page, opening an infected attachment, or paying a fake invoice. The message pretends to be someone you trust, your bank, Microsoft, a supplier, even your own boss.
The warning signs to check every time
Before you click anything, run through this quick mental checklist:
- A sense of urgency or fear. "Your account will be closed in 24 hours." Attackers want you to panic and act before you think.
- The real sender address does not match. The name says "Microsoft" but the actual email is something like [email protected]. Always check the address, not just the name.
- Links that do not go where they claim. Hover over a link (do not click) and look at the real destination in the corner of your screen. If it looks odd, it is.
- Generic greetings. "Dear Customer" or "Dear User" instead of your actual name.
- Unexpected attachments. Especially invoices, receipts, or files you were not expecting.
- Small spelling and grammar slips. Real companies proofread their emails; many phishing emails do not.
- A request that skips the normal process. A "supplier" suddenly changing their bank details, or the "CEO" urgently asking for gift cards.
The tricks are getting better
It is worth knowing that phishing has moved on. With AI tools, the old giveaways, broken English and clumsy design, are disappearing. Modern phishing emails can be perfectly written, look exactly like the real brand, and even reference real details about your business. That is why the habits below matter more than ever: do not rely on an email simply "looking right."
What to do when one lands in your inbox
- Do not click, do not reply, do not open attachments. If in doubt, stop.
- Verify through a separate channel. If your "bank" or a "supplier" emails, call them on a number you already trust, not one from the email.
- Report it. Forward it to whoever handles your IT, and use your email provider's "Report phishing" button so future ones get blocked.
- Delete it. Once reported, remove it so nobody else clicks by accident.
If someone already clicked
It happens, and speed matters more than blame. If a password was entered, change it immediately and change it anywhere else it was reused. Turn on multi-factor authentication if it is not already on. Then tell your IT team right away, the faster they know, the faster they can contain it before it spreads.
How to protect your whole team
One careful person is not enough, it only takes one click anywhere in the business. Real protection is a few simple layers working together:
- Multi-factor authentication (MFA) everywhere. Even if a password is stolen, MFA stops the attacker from getting in.
- Good email filtering. A properly configured system blocks most phishing before it ever reaches an inbox.
- Quick, regular team awareness. A five-minute reminder now and then keeps everyone sharp.
The bottom line
Phishing works because it targets people having a busy day, not because it is technically clever. Slow down for two seconds, check the sender and the links, and verify anything unusual before you act, and you will catch almost everything. Pair that habit with MFA and solid email security, and you close the door that most attacks try to walk through.
Need a hand with this?
iSystems360 helps businesses plan and manage their IT the right way, with clear pricing and fast, friendly support.