An email arrives just before you finish work. It says your hosting payment has failed and your website will be suspended unless you update your details.
The logo looks familiar. The message sounds urgent. Clicking the button feels like the quickest way to solve the problem.
That is exactly the moment to pause.
Phishing messages imitate familiar organisations or people to persuade you to reveal information, open something harmful or take an action you would otherwise question. The FTC identifies account warnings, unfamiliar invoices and requests for personal information as common examples.
For a small business, a clear verification process can be just as useful as knowing the warning signs.
1. Look Beyond the Sender’s Display Name
A message labelled “Accounts Team” does not tell you who actually sent it.
Inspect the full email address, but treat this as one check rather than proof. An unfamiliar domain is a warning; a familiar address is not enough to approve a sensitive request without further verification.
Consider the context:
- Were you expecting this message?
- Does the request match an ongoing conversation?
- Is the sender asking you to use a new process?
- Can you verify it through a contact method you already trust?
For example, if a supplier suddenly requests a bank account change, call your established contact using a previously saved number.
2. Notice When Urgency Replaces Explanation
A message that pressures you to act immediately deserves a closer look.
“Your account will close today” or “pay this invoice now” can make people skip their usual checks. Urgent account and payment stories are common phishing tactics.
Use a simple rule for your team: urgency does not remove the need for verification.
For a hosting warning, open your provider’s website through a saved bookmark or known address. Check the account there instead of using the email’s button.
If you still need help, contact support through the official account or an independently verified channel.
3. Do Not Judge Authenticity by Appearance Alone
An email can look polished and still deserve suspicion.
Make the action being requested the centre of your assessment. Is it asking for a password, a verification code, a payment or permission to access company information?
A neat layout does not explain why the request is necessary.
During staff training, practise with ordinary business scenarios: a document-sharing invitation, a renewal reminder or a supplier invoice. Ask employees to explain how they would verify each one before acting.
4. Treat Unexpected Attachments Carefully
An attachment may appear to be an invoice, order document or shared file. If you were not expecting it, verify it before opening.
The FTC warns that links and attachments in phishing messages can lead to harmful software. It recommends contacting the organisation through a phone number or website you already know is genuine.
Give your team permission to ask, “Did you send this?” A short check is easier to manage than uncertainty after opening a suspicious file.
5. Strengthen Your Accounts and Devices
Awareness works better alongside technical protection.
Keep browsers, operating systems and security software updated. Use unique passwords and enable multi-factor authentication where available. The FTC also identifies authenticator apps and security keys as stronger options than common text or email verification methods.
Make these protections part of onboarding. A new employee should know how to access company accounts safely and where to report an unexpected login prompt.
Never approve a sign-in request you did not initiate simply to make the notification disappear.
A Simple Verification Guide
| Message You Receive | Sensible Next Step |
|---|---|
| “Your hosting account will be suspended” | Open the hosting account independently and check its status |
| “Our payment details have changed” | Confirm through an established supplier contact |
| “A client shared a document” | Check whether the document was expected and verify with the client |
| “Your manager needs an urgent transfer” | Confirm directly through your normal approval process |
| “Send your verification code” | Do not share it; contact your account administrator if concerned |
Use these examples to create a process that matches how your business actually works.
What If You Already Clicked?
Tell your IT contact or the person responsible for company accounts promptly. Explain what happened: whether you only opened a page, entered information, approved access or downloaded a file.
The response should match the exposure.
If You Entered Your Password
Use a trusted device and the service’s official website to secure the account. Change the password, sign out other sessions and review recovery details.
For email accounts, check for unfamiliar forwarding rules and messages you did not send. These are among the recovery steps recommended by the FTC.
Change the password elsewhere if it was reused, and ask your administrator to check for any remaining unauthorised access.
If You Opened a Suspicious File
Stop interacting with it and tell your IT contact what was opened and when. Follow their containment instructions and use updated security software to investigate.
A clean-looking screen is not enough to confirm that the device is safe.
If You Sent Money or Shared Payment Details
Contact your bank or payment provider immediately through its official channels. Explain what happened and ask what protective or recovery steps are available. Acting quickly may help, although recovery is not guaranteed.
Make Reporting Easy for Your Team
Choose one clear reporting route, such as the email service’s phishing-report feature or an internal IT contact.
Encourage people to report mistakes quickly. An employee who feels embarrassed may delay sharing the details you need to respond.
During a short team review, ask:
- Do people know where to report a suspicious message?
- Can they verify urgent requests without relying on the message itself?
- Are payment changes subject to an independent check?
- Who handles an incident outside normal working hours?
Write the answers down and include them in staff onboarding.
Frequently Asked Questions
Does a familiar logo mean an email is genuine?
No. Verify the request and its context rather than relying on branding.
Should I reply to ask whether the message is real?
Use a separate, trusted contact method. Replying to the same suspicious message does not independently verify the sender.
Does clicking a link always mean my account was hacked?
No. The risk depends on what the page did and whether you entered information, approved access or downloaded anything. Report the details so the appropriate checks can be made.
Build a Habit of Checking Before Acting
Start with one practical change: agree that sensitive requests must be verified through a known channel.
Apply it consistently to payments, account access and unexpected documents. A clear process gives your team a dependable next step when a message feels urgent or unfamiliar.
Pause, Verify and Report.
