There was a time when many phishing emails were almost comically easy to recognize. The logo looked wrong. The message was filled with spelling mistakes. The sender claimed to represent a company you had never done business with, and the request itself made little sense.
Those emails still exist. Unfortunately, they are no longer a good picture of the entire phishing problem.
A modern phishing email can look remarkably ordinary. It may reference a domain your company actually owns, appear to come from a service provider you really use, imitate a coworker or executive, or arrive in the middle of what looks like a legitimate business conversation. The amount requested may even be so small that paying it seems easier than investigating it.
That is why phishing should not be treated exclusively as an IT problem.
It is also an accounting problem, a payroll problem, a management problem, an employee-training problem, and ultimately a business-process problem.
Technical protections are important. Properly managed business email, multi-factor authentication, passkeys, spam filtering, and email authentication standards such as SPF, DKIM, and DMARC can all make attacks more difficult.
But technology cannot eliminate the fundamental vulnerability phishing exploits: people routinely receive emails asking them to do things.
Pay this invoice. Renew this service. Sign into this account. Review this document. Change this employee's direct deposit. Update this vendor's banking information.
Small businesses need security systems that recognize a simple reality: eventually, someone may receive a fraudulent message convincing enough to look legitimate.
The objective should not be to assume every employee will identify every fake. It should be to make sure one convincing email is not enough to cause serious damage.
Phishing Has Become Much Harder to Recognize
The old advice to look for misspellings and bad grammar has not become useless, but it is nowhere near sufficient.
Attackers have access to enormous amounts of public information about businesses. Company websites identify employees and executives. LinkedIn reveals job titles and relationships. Websites identify vendors and technology platforms. Public records, social media, press releases, job postings, and other sources can provide additional context.
Generative AI has also lowered the barrier to producing polished, convincing written communication.
The FBI has warned that criminals are using generative AI to facilitate financial fraud and make fraudulent communications more believable. The FBI's Internet Crime Complaint Center has also documented the enormous financial impact of Business Email Compromise, or BEC, in which criminals use compromised or impersonated business communications to facilitate fraudulent transfers and other schemes.
This changes the way businesses should think about suspicious email.
An inaccurate detail can be a warning sign. An accurate detail is not proof of legitimacy.
An email may contain your actual domain name. It may use the name and branding of your real hosting company or domain registrar. It may identify your actual CEO. It may mention a vendor your business really uses.
That information can make a message more believable, but it does not prove the sender is legitimate.
In some attacks, the situation is even more difficult because the criminal has compromised a real email account. The message may actually come from a vendor, employee, or business associate's legitimate account.
That is why businesses need to look beyond the appearance of the email and evaluate what the sender is asking them to do.
Sometimes a Small Request Is More Convincing Than a Big One
People naturally become suspicious when an unexpected email asks them to wire $50,000.
They may be far less suspicious when it asks for $12.
Consider a fake domain renewal notice. The message references a domain the company really owns and suggests a small payment is required to keep some domain-related service active.
The employee recognizes the domain. The amount is trivial. The request sounds routine.
Paying it may seem easier than figuring out whether it is legitimate.
That is precisely why a small request can work.
The attacker does not necessarily need the stated payment to make the attack worthwhile, either. The destination could be designed to collect a credit card number, capture login credentials, gather additional information, or begin another stage of the attack.
This is an important mindset change for small businesses.
The size of the requested payment is not a reliable measure of the risk.
A $12 request deserves verification for the same reason a $12,000 request does if it involves an unfamiliar payment process, login page, account change, or unusual communication.
What Does the Attacker Actually Want?
“Phishing” describes a broad category of deceptive activity rather than one single scam.
Sometimes the objective is straightforward credential theft. An employee receives what appears to be a Microsoft 365 or Google Workspace notification and is directed to a fake login page. The employee enters a real username and password, which are then captured by the attacker.
Other attacks are financially motivated. A criminal impersonates a vendor and provides new banking information for the next invoice. Someone pretending to be the owner asks accounting to make an urgent transfer. A fraudulent payroll request asks HR to change an employee's direct-deposit information.
Business Email Compromise can be particularly dangerous because it exploits existing relationships and normal business procedures rather than relying solely on malicious attachments or obviously suspicious messages.
The first compromised account can also become a platform for additional attacks.
If a criminal gains control of an employee's mailbox, that account can contain invoices, customer information, vendor relationships, employee names, internal conversations, calendars, and years of business context. The attacker may be able to observe how the organization communicates before deciding how to exploit that access.
They may then send messages from an account coworkers already trust.
The phishing email is therefore not always the attack itself.
Sometimes it is simply the door.
Business Email Is Part of Your Security Infrastructure
A small business's email system deserves to be treated as business infrastructure.
Using a custom company domain through a properly administered business email platform such as Google Workspace or Microsoft 365 offers more than a professional-looking email address. It also gives the business centralized control over accounts, authentication, access, security settings, and employee offboarding.
That centralized control matters.
When an employee leaves, someone needs to know which accounts should be disabled and how company information will be retained or transferred. When suspicious activity occurs, administrators need the ability to respond. When security policies change, they should not depend on every employee independently configuring a personal account correctly.
Businesses should also pay attention to old and forgotten accounts. An email address belonging to someone who left the company years ago should not quietly remain an accessible doorway into company systems.
The principle is simple: if email is how your business communicates with employees, customers, vendors, banks, and service providers, it is not merely a communications tool.
It is part of the security perimeter.
Passwords Alone Are Not Enough
A strong password remains useful, but a password should not be the only thing standing between an attacker and an important business account.
Multi-factor authentication adds another requirement when someone attempts to sign in. That can significantly reduce the danger of a stolen password.
However, businesses should also understand that not every form of MFA provides the same protection.
CISA recommends phishing-resistant MFA and has specifically encouraged organizations to move toward FIDO/WebAuthn-based authentication where possible. Passkeys are built around this type of modern authentication and are increasingly supported by major technology platforms.
The advantage is important: rather than simply asking the user to type another code that might also be captured or socially engineered, phishing-resistant authentication is designed to make it much harder for credentials to be used on an impostor site.
That does not mean every small business needs to become an authentication expert.
It means businesses should stop thinking of “we have passwords” as a complete security strategy and should take advantage of stronger authentication offered by the systems they already use.
Account recovery deserves attention as well. Strong authentication on the front door provides much less protection if an attacker can easily manipulate the process used to recover the account.
SPF, DKIM, and DMARC Help Protect Your Domain
Business owners who manage custom-domain email may encounter three acronyms: SPF, DKIM, and DMARC.
The technical implementation belongs with whoever properly manages the organization's email and DNS, but business owners should understand what these technologies are trying to accomplish.
SPF helps receiving mail systems determine which servers are authorized to send email for a domain.
DKIM uses cryptographic authentication to help a receiving system verify that a message was authorized by the domain and that relevant message content has not been altered after it was signed.
DMARC builds on SPF and DKIM. It establishes policies for how participating receiving systems should handle messages that fail authentication and provides reporting that can help domain owners understand how their domains are being used.
Together, these technologies can make certain forms of domain spoofing more difficult and also contribute to legitimate email deliverability.
But they are not magic shields against phishing.
A criminal can register a lookalike domain. They can use a misleading display name. They can impersonate a person using another domain. They can compromise a legitimate account. They can send a message that does not technically spoof your domain at all but is still convincing enough to deceive someone.
SPF, DKIM, and DMARC should therefore be viewed as important layers of protection rather than proof that phishing has been “solved.”
Employee Training Has to Go Beyond “Don't Click Suspicious Links”
Telling employees not to click suspicious links creates an obvious problem.
What does suspicious look like?
The entire purpose of a successful phishing attack is to make the request appear reasonable enough that the employee does not perceive it as suspicious.
Better training teaches people to recognize high-risk actions, not just ugly emails.
An employee should become more cautious whenever an email asks for credentials, financial information, sensitive records, an unusual payment, a change in payment destination, a payroll update, or an exception to the company's normal procedure.
Urgency deserves particular attention.
“Please handle this before the meeting.”
“This account will be suspended today.”
“I'm unavailable by phone, so just take care of this.”
“Payment must be made immediately to avoid interruption.”
Urgency is powerful because it changes the employee's objective. Instead of asking, “Is this legitimate?” the employee starts thinking, “How quickly can I get this done?”
Training should help restore that moment of scrutiny.
Just as importantly, company culture should give employees permission to question requests—even when the message appears to come from the owner.
An employee should never be afraid that verifying an unusual request will be viewed as incompetence or insubordination.
In a security-conscious organization, verification is part of doing the job correctly.
Verify the Transaction, Not Just the Message
This may be the most important procedure a small business can establish.
When an email requests a sensitive financial or account change, do not rely solely on deciding whether the email “looks real.”
Verify the transaction independently.
Suppose a regular vendor emails the accounting department and says it has changed banks. All future payments should be sent to a new account.
The vendor name is correct. The invoice looks normal. The email address appears familiar. The message contains accurate information about the relationship.
That still should not be enough to change where the company's money goes.
Someone should independently verify the new instructions using contact information the business already trusts—not a phone number conveniently provided in the message requesting the change.
The same principle applies to payroll.
If an employee supposedly emails HR asking to change direct-deposit information, the business should have a procedure for independently confirming the request.
The goal is to create a second barrier.
The criminal may successfully deceive the email recipient. But deceiving the recipient should not automatically be enough to move the money.
A Familiar Vendor Name Does Not Make an Email Safe
Vendor impersonation is particularly effective because trust already exists.
Employees expect invoices from vendors. They expect occasional account questions. Banking information really does change sometimes. Vendors really do send documents and links.
Attackers exploit that normality.
A criminal may create an address that closely resembles the vendor's. More sophisticated attackers may gain access to a legitimate mailbox and observe an existing conversation before inserting themselves into it.
That latter situation defeats much of the simple phishing advice businesses commonly hear.
The sender's name looks right because it is right.
The conversation history looks legitimate because much of it is legitimate.
The vendor relationship is real.
The fraudulent element may be only one instruction: send the next payment somewhere else.
That is why replying to the same email and asking, “Is this correct?” may not be independent verification. If an attacker controls the account, the attacker can simply reply yes.
Use a known telephone number, established vendor portal, or another previously trusted communication method.
Again, verify the transaction rather than relying exclusively on the message.
Owners and Executives Can Be Impersonated Too
Small businesses often have informal communication cultures. That can be an advantage operationally, but it can also create opportunities for impersonation.
An employee receives a message that appears to come from the owner:
I'm tied up. Can you take care of something for me?
The initial request may seem harmless. After the employee responds, the supposed owner asks for gift cards, a transfer, sensitive employee information, or some other action.
Authority is part of the attack.
People are conditioned to respond quickly to requests from their bosses, particularly when the request sounds urgent.
Businesses can reduce that vulnerability by establishing procedures that apply regardless of who appears to be asking.
If company policy requires independent verification for a bank-account change, the CEO does not get to bypass that protection simply by sending an email marked urgent.
That same principle is important for payroll scams involving direct-deposit changes and requests for sensitive employee information.
Security procedures work best when everyone is subject to them.
What Should an Employee Do When Something Looks Wrong?
Employees need a simple answer to this question before the suspicious message arrives.
If an email requests a sensitive action and something feels unusual, the employee should avoid interacting further with the message until it has been evaluated. They should not use a link in the email to log into an account, and they should not rely on phone numbers or other contact information supplied by the questionable message to verify the request.
Instead, the employee should use the company's established reporting process or contact the person responsible for IT or security. For a financial request, they may also need to verify it through a known communication channel.
Small businesses sometimes fail here because there is no obvious person to tell.
An employee sees something strange but does not know whether to forward it to the owner, call the IT provider, ask a manager, or simply delete it.
That uncertainty should be solved before an incident occurs.
Employees should know exactly where suspicious messages go and what types of requests require additional verification.
What If Someone Already Clicked?
People make mistakes.
A strong security culture should encourage employees to report those mistakes quickly rather than hide them.
An employee who realizes they entered a password into a suspicious website may be embarrassed. If they are afraid of punishment, they may wait to say something.
That delay can give an attacker more time.
The correct response depends on what happened and which systems are involved. It may require securing an account, changing credentials, revoking active sessions, contacting a financial institution, investigating mailbox activity, notifying an IT or cybersecurity provider, or taking additional legal, regulatory, insurance, or notification steps.
The important organizational lesson is that the business should know who takes over from there.
A 12-person company may not need a corporate incident-response department. It still needs a basic plan .
Who calls the IT provider?
Who contacts the bank if a fraudulent payment was made?
Who has administrative access to the email system?
Who contacts the company's cyber insurer, attorney, or other professionals when appropriate?
Those are bad questions to answer for the first time while money is disappearing.
Phishing Protection Is a Layered Business System
No single security control will eliminate phishing.
Spam filters will miss messages.
An employee may click something.
A password may be compromised.
A vendor account may be breached.
A convincing impersonation may get through.
The objective is to prevent one failure from automatically becoming a catastrophe.
A useful way for a small business to think about phishing protection is:
Identity → Technology → Process → People → Response
Identity means controlling who has access to business systems and what authority those people have.
Technology includes properly managed email, authentication, security filtering, SPF, DKIM, DMARC, and other technical protections appropriate to the organization.
Process means creating verification and approval procedures around high-risk actions such as payments, banking changes, payroll changes, and access to sensitive information.
People means training employees to recognize unusual requests and creating a culture where verification is encouraged.
Response means knowing what to do and whom to contact when something gets through anyway.
The strength comes from the layers.
If an attacker gets past the email filter, the employee may recognize the unusual request. If the employee does not, a payment-verification procedure may stop the transaction. If that fails, rapid reporting and response may still reduce the damage.
That is a far stronger strategy than hoping nobody ever clicks the wrong thing.
Make Your Business Harder to Trick
Small businesses do not need to become cybersecurity companies.
They do need to recognize how deeply email is connected to everyday business operations.
Email can authorize payments, reset passwords, deliver invoices, communicate with employees, manage customer relationships, change payroll information, administer software accounts, and connect a business to many of the vendors it relies on.
That makes phishing much bigger than an IT issue.
Technical safeguards such as properly managed business email, multi-factor authentication, passkeys, SPF, DKIM, and DMARC are important. So are employee awareness and modern email filtering.
But some of the most effective protections are business procedures.
Require independent verification when payment information changes. Establish clear rules for direct-deposit changes. Give employees permission to question unusual requests from executives. Make sure everyone knows where to report a suspicious message. Have a plan for what happens when someone makes a mistake.
And remember that an email containing accurate information is not necessarily an authentic email.
The domain may really be yours. The vendor may really be your vendor. The employee may really work for you. The invoice may look exactly like previous invoices.
The question is whether the request is legitimate.
The goal is not to create a workforce capable of identifying every phishing email with perfect accuracy.
It is to create a business where one convincing fake email is not enough to cause serious damage.
Sources and Further Reading
Cybersecurity and Infrastructure Security Agency (CISA) — Recognize and Report Phishing
https://www.cisa.gov/secure-our-world/recognize-and-report-phishing
CISA — More Than a Password / Multi-Factor Authentication
https://www.cisa.gov/secure-our-world/use-strong-passwords
Federal Trade Commission — How to Recognize and Avoid Phishing Scams
https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams
FBI Internet Crime Complaint Center — Business Email Compromise
https://www.ic3.gov/CrimeInfo/BusinessEmailCompromise
FBI — Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud
https://www.ic3.gov/PSA/2024/PSA241203
NIST — Phishing
https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/phishing
Google Workspace Admin Help — Set Up SPF
https://support.google.com/a/answer/33786
Google Workspace Admin Help — Set Up DKIM
https://support.google.com/a/answer/174124
Google Workspace Admin Help — Set Up DMARC
https://support.google.com/a/answer/2466580
Microsoft — Email Authentication About SPF, DKIM, and DMARC
https://learn.microsoft.com/en-us/defender-office-365/email-authentication-about
FIDO Alliance — Passkeys
https://fidoalliance.org/passkeys/
