Phishing is a common way attackers try to steal business passwords, gain access to accounts, or trick employees into sending money. It does not take a sophisticated hacker. Sometimes it takes just one convincing message and one busy employee. Here is how to recognize suspicious messages and what to do if something goes wrong.
What is phishing?
Phishing is a type of social engineering in which an attacker uses a deceptive message to trick someone into clicking a link, opening a file, sharing sensitive information, or sending money. Phishing commonly arrives by email. Similar scams can arrive by text message or phone call. Common disguises include Microsoft 365, banks, shipping companies, vendors you actually pay, and even your own boss.
How to spot a phishing email
Look for these warning signs:
- Urgency or fear. “Your account will be closed today.” “Payment overdue.” Pressure is the point.
- A sender address that doesn’t match. The display name may look familiar, but the actual email address or domain may be different. Check the full address and be cautious of lookalike domains. A familiar-looking address alone does not prove a message is legitimate.
- Links that go somewhere unexpected. On a computer, hover over a link to inspect its destination. On a phone, you may be able to press and hold to preview it. If you are unsure, do not use the link. Open the company’s official website or app yourself instead.
- Requests to log in from an email. If you’re asked to “verify” your password, go to the site directly instead of using the link.
- Unexpected attachments. Especially invoices, shipping notices, or “scanned documents” you weren’t expecting.
- Changes to payment details. A vendor suddenly has a “new bank account.” This may be business email compromise. Before changing a vendor’s bank details or sending an unusual payment, verify the request with a known contact using a phone number you already have, not one supplied in the message.
- Odd tone or grammar. Unusual wording can be a warning sign, but polished writing is not proof that a message is legitimate. Attackers can use AI tools to write convincing messages, so don’t rely on spelling mistakes alone.
What to do if you clicked a phishing link
Act promptly, but don’t panic. The right response depends on what happened. Simply opening a link does not necessarily mean your device or account has been compromised.
- Stop interacting with the message. Do not enter information, approve unexpected sign-in requests, or download anything else from the link.
- If a file ran or something installed, contact your IT provider immediately. Follow their instructions for disconnecting the affected device from the network. Avoid using it for sensitive work until it has been checked.
- If you entered a password, act from a trusted device. Change the affected password promptly. Change it anywhere else it was reused, and notify your IT provider. If you entered work-account credentials, check with your IT provider about revoking active sessions and reviewing account activity.
- Check multi-factor authentication (MFA). If you approved an unexpected sign-in request or suspect someone accessed your account, tell your IT provider immediately. They can help secure the account and review authentication settings.
- Tell the right people. Notify your IT provider or whoever manages your systems. Warn coworkers if the message may affect them.
- Contact your bank immediately if money or banking information was involved. If a payment was sent, ask the bank whether it can stop or recall the transfer.
- Check for signs of account misuse. Look for unfamiliar sign-ins, new email forwarding rules, unexpected inbox rules, and messages you did not send.
How to report phishing
- Outlook or Microsoft 365: If available, select Report and then Report phishing. The exact location varies by version and configuration.
- Gmail: Open the message, select the three-dot More menu, and choose Report phishing. The steps may differ on mobile.
- APWG: You can forward suspected phishing emails to reportphishing@apwg.org to help with phishing analysis and tracking.
- FBI IC3: Report suspected online fraud, including business email compromise, at ic3.gov. If money was transferred, contact your bank immediately as well.
- Nebraska Attorney General: The Consumer Protection Division accepts complaints about potentially unfair or deceptive business practices. It is not a general-purpose phishing incident response service.
How to protect your small business from phishing
You don’t need a big budget. These steps cover much of the risk:
- Turn on MFA wherever it is available, starting with email, administrator accounts, and banking. MFA adds a layer of protection if a password is stolen, although it does not stop every attack. Prefer phishing-resistant options, such as security keys or passkeys, when supported.
- Train your team regularly. Short, practical exercises and examples can help employees recognize suspicious messages and practice reporting them.
- Verify payment changes by phone, using a number you already have, not one from the email.
- Use your email provider’s built-in security features. Microsoft 365 and Google Workspace offer email security protections, but the features available and their effectiveness depend on the service, licensing, and configuration.
- Keep devices and software updated. Security updates fix known vulnerabilities that attackers may exploit. Updates cannot prevent every infection, but they reduce avoidable exposure.
- Make reporting easy and blame-free. People who feel safe reporting a mistake report it sooner.
- Back up important data regularly. Protect backups from unauthorized changes and test that you can restore your files when needed.
Questions to ask your IT provider
- Is MFA turned on for every account, including admin accounts?
- How is our email filtered, and who reviews what gets caught?
- What happens if someone here clicks a bad link? Who do we call?
- Do we have phishing awareness training, and how often?
Need help?
If you’d like help reviewing your email security or setting up MFA and training, you can request a quote. Requests go to Cambium Data. Learn more about how quote requests work.
Sources and further reading
- Verizon, 2025 Data Breach Investigations Report
- FBI, Business Email Compromise
- FBI, Spoofing and Phishing
- FBI Internet Crime Complaint Center, ic3.gov
- Federal Trade Commission, How To Recognize and Avoid Phishing Scams
- Federal Trade Commission, Scams and Your Small Business
- Microsoft, Phishing and suspicious behavior in Outlook
- Microsoft Learn, Report phishing and suspicious emails in Outlook
- Google, Report phishing in Gmail
- Anti-Phishing Working Group, Report Phishing
- Nebraska Attorney General, Consumer Protection
Written by Tony Underwood. Nebraska Business Tech is owned by Tony Underwood, founder and owner of Cambium Data.
Leave a Reply