7 Phishing Red Flags
Every Small Business Employee Should Know

Almost every small business security disaster we've cleaned up — the locked files, the drained account, the hijacked email — started the same way: one employee, one convincing email, one click. Not exotic hacking. An email that looked exactly like the hundred legitimate ones that arrived that day.

The fix isn't turning your staff into security experts. It's teaching them a short list of red flags and a simple habit: when an email involves money, passwords, or urgency, slow down and verify. Here are the seven flags we drill into every South Jersey business we work with.

1 The Display Name Isn't the Sender

Email lets anyone put any name they want in the "From" field. An email can say Microsoft Support or Sue (Owner) in bold — while the actual address behind it is randomstring@gmail.com. On a phone, where mail apps often show only the friendly name, this trick works constantly.

Train the habit: tap or hover on the sender's name to expose the real address before acting on any email that asks you to do something. If "your bank" is writing from a free webmail address, you're done — no further analysis needed.

2 Lookalike Domains

Smarter attackers register domains one squint away from the real thing: micros0ft-support.com, yourvendor-billing.net, company-invoices.co instead of .com. The email address looks plausible, the logo is copied perfectly, and the message reads clean because it was written (or AI-polished) to read clean.

The same trick hides in links. Hover over any link before clicking (press and hold on mobile) and read the actual destination. Attackers count on you reading the first familiar word and stopping. Read the whole domain, right up to the .com or .net — the real owner is whatever comes just before it.

3 Urgency Plus a Payment Change

Phishing runs on adrenaline. "Your account will be suspended today." "The wire must go out before 3 PM." "I'm walking into a meeting, handle this now." Urgency is designed to bypass the exact double-checking that would catch the scam.

One combination should trigger an automatic full stop: urgency plus any change to how money moves. New bank account for a vendor, updated remittance address, a rush payment to an unfamiliar payee. Legitimate businesses change banking details rarely and never demand it be handled in a panic. The defense is a two-minute phone call to the vendor at a number you already have on file — never the number in the email.

4 Attachments You Weren't Expecting

The unexpected attachment is the oldest delivery vehicle there is, and it still works: a "voicemail" HTML file, a "scanned invoice," a ZIP from a shipping company, a Word document asking you to Enable Content. That Enable Content button is not a formality — it's the moment the malware actually runs.

• If you weren't expecting a file from this sender, don't open it. Call and ask.
• Be extra suspicious of file types businesses rarely email: .html, .iso, .img, and ZIPs with passwords "for security."
• Never click Enable Content / Enable Macros on a document that arrived by email.

If a machine starts acting strange after an attachment was opened, treat it as infected until proven otherwise — our virus removal guide walks through the signs and the safe order of operations.

5 MFA Prompts You Didn't Trigger

Multi-factor authentication is essential — so attackers now attack the human holding the phone. If someone's password has been stolen, the attacker can trigger sign-in prompts over and over ("MFA fatigue"), betting the employee will eventually tap Approve just to make the buzzing stop. Some pair it with a call pretending to be IT: "I'm pushing a verification to your phone, just approve it."

6 Invoice Fraud and the Fake Boss

Business email compromise (BEC) is the grown-up version of all of the above, and it costs businesses more than ransomware. The attacker either spoofs — or has quietly broken into — a real mailbox belonging to your vendor, your bookkeeper, or your owner. Then they wait, read, and strike with perfect context: a real invoice number, a real project name, the boss's actual sign-off style.

The messages look mundane by design: "Updated ACH details for the attached invoice." "Are you at your desk? I need gift cards for a client, keep it between us." The only reliable defense is procedural, not technical: every banking change and every unusual payment request gets verified by voice, at a known number, no exceptions — even when the email came from the boss's real address. Layer that on top of hardened systems and good backups; our ransomware protection guide covers that side of the house.

7 The Flag After the Fact: Someone Clicked

It will eventually happen — good phishing beats good people. What decides whether it becomes a disaster is the next thirty minutes:

• Disconnect the machine from Wi-Fi or unplug the network cable if a file was opened or anything was installed.
• Change the exposed password from a different device — if credentials were typed into a fake login page, that account is burned. Change it anywhere else it was reused, too.
• Revoke active sessions in Microsoft 365 or Google Workspace so a logged-in attacker gets kicked out, and check for sneaky forwarding rules they may have added.
• Report it immediately. Make it culturally safe for employees to say "I clicked something." The breaches that ruin businesses are the ones hidden for a week.

Frequently Asked Questions

What is the single most reliable way to spot a phishing email?
Check the actual sending address, not the display name, and hover over any link to see where it really points before clicking. Display names and logos are trivially faked; the underlying address and URL are much harder to disguise. When an email involves money, credentials, or urgency, verify by phone using a number you already have — never one from the email itself.

An employee clicked a phishing link — what should we do first?
Disconnect that computer from the network, change the affected account's password from a different device, revoke active sign-in sessions, and alert whoever handles your IT right away. Speed matters far more than blame — the worst outcomes we see come from employees hiding a click for days while attackers quietly work inside the account.

Why do attackers send fake MFA push notifications?
It means they already have the password and are "MFA bombing" — sending prompt after prompt hoping the person eventually taps Approve out of annoyance. Any approval request you didn't trigger is proof someone has your password. Deny it, change the password immediately, and report it.

How should a small business verify a vendor's request to change payment details?
Always by voice, using a phone number from your own records or the vendor's official website — never a number or reply address contained in the request itself. Banking-change requests are the signature move of business email compromise, and a two-minute phone call is the control that defeats it.