How to Spot Phishing Emails: A Guide for Your Staff

Updated October 22, 2026

Phishing is still how most attacks on small businesses begin. Filters catch a lot, but some messages always get through, and AI tools have made fake emails more polished than ever. Bad spelling isn’t a reliable warning sign anymore. These are.

The warning signs

Urgency or pressure

“Your account will be closed today.” “I need this wire sent before 3 p.m.” “Final notice.” Pressure is designed to make you act before you think.

A request to change how money moves

New bank details, a different payment method, gift cards, an urgent wire. Treat any of these as suspicious until verified by phone using a number you already have.

A login page you got to from a link

A link in an email that leads to a Microsoft, Google, DocuSign, or bank login page is the most common way passwords are stolen. Go to the site directly instead of clicking.

A sender that’s almost right

Look at the actual email address, not just the display name. Watch for:

• Lookalike domains: rnicrosoft.com, yourcompany-billing.com, yourcompany.co
• Free email accounts claiming to be a business or executive
• A “Reply-To” address that differs from the sender

Something unexpected

An invoice you weren’t expecting, a shared document from someone you don’t usually work with, a voicemail notification for a system you don’t use, or a “delivery problem” for a package you didn’t order.

Requests to keep it quiet

“I’m in a meeting, don’t call, just handle this.” Executives rarely ask for secrecy and speed together. Criminals do.

Common scams aimed at small businesses

The fake invoice. An invoice from a real vendor’s email account (which has been hacked) or a lookalike, with new payment details.

The CEO gift card request. “Are you at your desk? I need you to pick up some gift cards for a client.” It appears to come from the owner.

The shared document. “Sarah shared a file with you” leads to a fake Microsoft login page.

The payroll change. An email that appears to come from an employee asks HR to change their direct deposit account.

The MFA prompt you didn’t start. Your phone asks you to approve a login. If you didn’t just try to sign in, someone else did, using your password.

Texts and calls. The same scams arrive by text message and phone, sometimes impersonating your IT provider asking for a code or remote access.

What to do with a suspicious email

1. Don’t click links, open attachments, or reply.
2. Verify through another channel. Call the person at a number you already have.
3. Report it the way your company has set up, such as a “Report phishing” button or forwarding to IT.
4. Delete it after reporting.

What to do if someone clicked

Fast reporting turns a potential disaster into a minor event. Make it safe for people to admit a mistake.

1. Report immediately to your IT contact. Don’t wait to see if anything happens.
2. If a password was entered, change it right away from a different device, and have IT sign that account out of all sessions and check for new email forwarding rules.
3. If an attachment was opened, disconnect the computer from the network (unplug it or turn off Wi-Fi) and let IT check it.
4. If money was sent, call your bank immediately. Speed matters for any chance of recovery. Also file a report with the FBI at ic3.gov.

For owners and managers

• Run short, regular training and simulated phishing tests, not one long annual session.
• Put “verify by phone” rules for payments, payroll changes, and gift cards in writing.
• Turn on MFA everywhere. It stops most stolen passwords from being useful. See how to set up MFA.
• Protect your own domain from being spoofed with SPF, DKIM, and DMARC. See email authentication.