Most attacks on small businesses start with an email. Not a dramatic one. An ordinary-looking one. Here are the four small tells, and what to do when you are not sure.
In short
The display name is decoration. The address is the identity.
Never sign in through a link in an email. Go to the service directly.
Clicking is recoverable. Staying quiet about it is what causes the damage.
1. The sender is not who it says
An email arrives from a colleague you work with every day. The display name is exactly right. The address behind it is their.name@yourc0mpany.com.
Tap or hover the sender name to reveal the actual address.
Read the domain slowly, right to left. Look for one character off, or a free address where a company one should be.
Be wary of "Re:" on a conversation you were never part of.
2. The link ends at a login page
"Your password expires today. Verify now to keep your current password." The link opens a sign-in page identical to the one you use every day. Same logo, same layout, same colours.
Never log in through an email link. Type the address or use your bookmark. If the alert was real, it will be waiting for you when you sign in normally. QR codes in emails are links you cannot preview, so treat them the same way.
3. The attachment you were not expecting
"Please see the attached remittance advice." You were not expecting one. It is a .zip, or a document that asks you to "enable content" before you can read it.
That prompt is the attack, not the document. Do not open it "just to check". Confirm with the sender another way: a call, a message, or a fresh email you start yourself.
4. The deadline
"Within 24 hours." "Or your account will be closed." Pressure is the oldest trick there is. A real supplier, bank or colleague can wait five minutes while you check.
If you clicked
Fake sign-in pages are pixel-perfect copies. Noticing one after the fact means it did its job well. Speed matters far more than embarrassment.
Tell your IT contact straight away. Reported in minutes, this is usually a non-event.
Change that password from a device you trust.
Do not delete the email. It is evidence that helps protect everyone else.
Want fewer of these reaching your team?
We filter the bad mail before it lands, train the team on what gets through, and pick up the phone when someone clicks. Talk to us, or read about managed IT services.