The phishing scams aimed at small businesses, and how to stop them
An email lands from your supplier. Their bank details have changed, and could you send this month’s payment to the new account? It looks right. It is from the right name. It might even reply to a real thread you had with them last week.
That is phishing: someone pretending to be a person or company you trust, so you hand over a password, open a bad file, or send money. It gets past the firewall and the spam filter because it does not attack your computer. It attacks you, on a busy afternoon.
Here are the kinds you are most likely to meet, and what actually stops them.
How a phishing attack works
Almost every one follows the same path. The attacker learns something about you, often from your own website, LinkedIn or social media. They write a message that looks like it comes from someone you know. It contains a link, an attachment, or a request. If you bite, they collect your password, put malware on your machine, or get you to pay them. Then they use that first win to go further, such as sending more scams from your real email account.
The tricks they use are simple:
- Look-alike addresses. A web address one letter off from the real one, or an email that shows a trusted name but comes from somewhere else.
- Hidden links. Text that says one thing while the link goes somewhere else, or a shortened link that hides where it leads.
- Copied login pages. A page that looks exactly like your bank, Google or Microsoft sign-in, built to catch whatever you type.
The old tell-tale signs, bad spelling and odd greetings, are fading. Attackers now use public information and AI writing tools to make messages that read like the real thing.
The mass email scam
This is the most common kind. The same message goes to thousands of people, hoping a few click. It usually borrows a well-known name, a bank, a shipping company, a government agency, and pushes urgency: your account is locked, your parcel is held, you owe a fee. It opens with “Dear Customer” and carries a link to a fake login page or an attachment you should not open.
The scam written just for you
Spear phishing is the same idea aimed at one person. The attacker does their homework: your role, your suppliers, the project you are working on. The message mentions real names and real details. A bookkeeper gets an “urgent payment approval”; the person who runs the website gets a “critical security update”.
When the target is the owner or a senior manager, it is sometimes called whaling. These messages often claim to come from a lawyer, an accountant or an official body, cite confidentiality, and ask you to skip the usual steps just this once.
Fake invoices and changed bank details
This one costs businesses the most money. It is called business email compromise, and the FBI counts the losses in billions of dollars. The attacker either takes over a real email account or imitates one, then asks for money. The common versions:
- The boss in a hurry. A message “from the owner” asking staff to wire money right away.
- The hijacked account. A real employee’s mailbox, taken over, sending fake invoices to customers.
- The fake lawyer. Someone posing as legal counsel on a confidential deal.
- The supplier takeover. A supplier’s real account, taken over, asking you to pay a new bank account.
Once inside a mailbox, attackers often set up hidden rules that forward or delete messages, so the real owner never sees the replies. They watch how your business pays bills before they strike.
It works on large companies too. Between 2013 and 2015, a fraudster posing as Quanta Computer, a real supplier, sent fake invoices to Google and Facebook and was paid more than $100 million before anyone caught on. Mattel nearly lost $3 million when finance staff wired money on the say-so of a fake message from a new CEO; the receiving bank stopped it.
Text messages and phone calls
Scams also arrive by text (sometimes called smishing) and by phone (vishing). A text says a delivery failed or your account needs attention, with a link. A caller says they are from your bank, the IRS or tech support, and the caller ID may even show the real number, because caller ID can be faked.
These skip your email filters entirely, and people tend to check less carefully on a phone. In 2020, attackers took over the Twitter accounts of Barack Obama, Bill Gates and Elon Musk by phoning Twitter staff and talking their way into internal tools. No clever code, just convincing calls.
The copy of a real email
Clone phishing takes a real email you received, makes a near-perfect copy, swaps the link or attachment for a bad one, and sends it again as a “correction” or “resent”. Because you recognize the original, you are less suspicious.
The fake support account
Post a complaint about a company on social media and you might get a quick reply from a “support” account offering to help. Some of those accounts are fake, set up to watch for complaints and steer people to a login page or a download. Only use the support channels listed on the company’s own website.
What actually stops phishing
You do not need an enterprise security department. A few habits and settings do most of the work.
Turn on two-step login everywhere. Also called multi-factor authentication, it asks for a code from your phone as well as your password. Even if someone steals the password, they still cannot get in. If you do one thing from this article, do this, starting with email, banking and your website.
Check payment changes by phone, on a number you already have. Never use a phone number from the email asking for the change. A real supplier will not mind the call. Treat any request to pay a new account, or to rush a payment, as suspect until you have spoken to someone you know.
Have two people sign off on large payments. Agree a threshold. Above it, a second person approves. Unusual or urgent requests wait a day.
Set up your domain’s email authentication. Three settings in your domain’s DNS, called SPF, DKIM and DMARC, tell other mail servers which senders are allowed to use your domain. Set correctly, they make it much harder for someone to send email that pretends to be from you, and they help your own mail stay out of spam. Your email provider or web person can set these up; it is a one-time job.
Check your mailbox rules now and then. Look for forwarding or auto-delete rules you did not create. They are a common sign that someone else is in your account.
Make it easy to report, and never punish a click. If staff fear getting in trouble, they hide mistakes, and a stolen password stays in use for weeks. Thank people who report a suspicious message, even when it turns out to be nothing.
Talk about it with real examples. A short chat about the scams above, especially the invoice and phone versions, does more than a yearly slideshow about “don’t click links”. Remind people that scams come by text, phone and social media, not only email.
Find out if your passwords have leaked. Have I Been Pwned tells you whether an email address has shown up in a known data breach. If it has, change that password and anywhere you reused it.
If you think you clicked
Change the password straight away, from a device you trust, by typing the site’s address yourself rather than following any link. Turn on two-step login if it was off. Check your mailbox for new forwarding rules. If money was sent, call your bank immediately; the sooner they hear, the better the chance of stopping the transfer. Then tell your team, so the same message does not catch someone else.
Phishing works on busy people, not careless ones. A phone call before you pay and a code on your phone when you log in will stop most of it.