Phishing

Phishing is a scam where a message pretends to come from someone you trust. That might be Microsoft, your bank, a supplier or a coworker. The goal is to get you to do something harmful. You might sign in on a fake page, pay a fake invoice, change bank details or open an infected file.

There are a few kinds. Spear phishing targets one specific person. Smishing comes by text message. In business email compromise, criminals pose as or take over a business email account. Then they use it to redirect payments.

Why it matters to a small business

Small businesses are common targets. One person often handles email, payments and the website. A single phishing email that works can lead to a stolen mailbox, a hacked website or a payment sent to a criminal.

Common warning signs, also listed in CISA’s phishing guidance:

• Urgency or threats.
• Requests to sign in, pay or change bank details.
• Sender addresses that are slightly off.
• Unexpected attachments or shared documents.

The best habit: don’t use links or phone numbers in a suspicious message. Go to the site yourself, or call a number you already have. Two-factor authentication limits the damage if a password is stolen. DMARC makes it harder for criminals to send email from your exact domain.

Example

A bookkeeper receives an email from the “owner” asking her to pay a new supplier urgently. The address is one letter off. She calls the owner, who knows nothing about it. No money is lost.

Learn more

• How do I spot a phishing email?
• Someone is sending emails that look like they’re from me
• Is that domain renewal notice a scam?
• Check your domain’s email protection with the free email deliverability checker.