Most successful attacks on small businesses don't start with a hacker in front of a black screen – they start with a harmless-looking message in the inbox. Having handled the aftermath of a successful attack, I've seen what a single click can cost. This guide covers the scams that hit small offices most often and turns your team into the first line of defense.
The typical warning signs
- Time pressure and threats: 'Your account will be locked in 24 hours' or 'Final notice before collection'.
- Sender addresses that are only almost right: billing@paypa1.com instead of paypal.com, or a foreign address hiding behind a familiar display name.
- Unexpected attachments – especially ZIP, ISO, HTML or Office files asking you to 'enable content'.
- Links whose actual destination doesn't match the displayed text (hover before you click).
- Unusual requests asking for secrecy or bypassing normal approval rules: urgent wire transfers, changed bank details or sensitive file exports.
Want to tackle this in your company?
Send me a short message or give me a call. I'll get back to you within 24 hours on weekdays.
Why modern phishing emails are so convincing
Poor grammar and obvious typos as a tell are history. With language models, attackers write flawlessly, copy real email signatures and pull context from your website imprint, social networks or past data leaks at suppliers.
On top of that comes 'quishing' (QR code phishing): instead of a clickable link that your desktop security filter might block, the email contains a QR code – for instance for a supposed Microsoft 365 security check or a parcel notification. Scanning it with a phone moves the attack off the protected office PC and straight onto a fake sign-in page.
Three scams that hit small businesses most often
- Fake invoices and changed IBANs: a real supplier's mailbox is compromised or spoofed with a lookalike domain, and a familiar invoice arrives with a note that the company's bank account has changed.
- Fake Microsoft 365 and OneDrive shares: an email claims 'Someone shared a document with you' or 'Your password expires today'. The sign-in page looks identical to Microsoft's and often acts as a live proxy (adversary-in-the-middle) to capture both the password and the second-factor code.
- CEO fraud: a short message apparently from the managing director – often styled as if sent from a phone ('In a meeting, please handle this urgently') – asks accounting for an immediate payment or confidential staff and client data.
Checklist for a suspicious message
- Don't click, don't scan QR codes, don't download, don't reply to the email.
- Verify the sender through a second channel – always call a number from your own address book, never the number printed in the suspicious email.
- For changed bank details or unusual payment requests, require two-person sign-off and a phone callback without exception.
- Report the message internally right away so colleagues are warned.
- If someone did click or enter credentials: inform IT immediately, change the password, revoke active sessions and disconnect the device from the network if in doubt. Fast reporting limits the damage – blame only ensures the next incident stays hidden.
The technical safety net behind it
An alert team is the first line, clean technical configuration the second: two-factor authentication and phishing-resistant sign-in methods protect accounts, SPF, DKIM and DMARC in your DNS stop outsiders spoofing your domain, and clean permissions without local admin rights keep an opened attachment from compromising the whole network.
To see where your company stands on email protection, access control and incident routines in about two minutes, take the free IT security check.
Phishing resistance comes from routine: short trainings with real examples, clear payment verification rules in accounting and a properly hardened email setup. I help with both – IT security and team awareness without scare tactics and with clear rules for everyday office work.