5 Phishing Email Red Flags Every Small Business Should Know

Phishing emails used to be easy to spot: bad grammar, obvious fake logos, a prince who needed your bank details. Today's versions are far more convincing, often copying real company branding, employee names, and even ongoing conversations. Small businesses are a favorite target because there's usually less security training and faster trust between coworkers. Here are five red flags worth teaching your whole team.

Red flag one: sender address mismatch. The display name might say "Microsoft Support" or your CEO's name, but the actual email address is a long, unfamiliar string or a slightly misspelled domain. Always check the full address, not just the name shown.

Red flag two: urgency and suspended-account language. "Your account will be suspended in 24 hours" or "Immediate action required" is designed to make you click before you think. Legitimate companies rarely demand instant action over email.

Red flag three: login-via-link instead of a direct site visit. Phishing emails want you to click their link and log in there, rather than opening the app or typing the website yourself. If anything feels off, navigate to the site directly instead of clicking through.

Red flag four: wire, gift-card, or payment-detail requests, especially from "executives." A message claiming to be from your owner or CEO asking for an urgent wire transfer or gift cards is one of the most common small-business scams. These often arrive when the real executive is known to be traveling or unreachable.

Red flag five: unexpected attachments, especially .zip, .exe, or password-protected files. Legitimate invoices and documents rarely arrive as a surprise compressed file you need a password to open. When in doubt, don't open it.

If any of these show up, verify out-of-band: call the person or company using a known phone number, not one provided in the email itself. A 30-second phone call has stopped more wire fraud than any spam filter.

The fix that protects most small businesses isn't expensive software, it's a habit: every unexpected request for money, login credentials, or sensitive data gets verified out-of-band before anyone acts on it.