The email that looks like it is from your bank (or a supplier): how to spot phishing aimed at your company
An email arrives. The logo is right, the tone is serious and the subject line hurries you: "Suspicious activity detected on your account", "Invoice pending payment", "Update your details within 24 hours". Everything seems normal… until someone on your team clicks, enters a password or pays an invoice that should never have been paid.
That is phishing, and it is not a problem of absent-minded individuals: it is one of the main ways companies lose money and data. Worse still, many of these emails are made specifically to fool businesses like yours.
Here we explain, without jargon, how to recognise it, what to do if you receive one and why the best defence combines a trained team and professional protection.
What phishing is (and why it works so well)
Phishing is a deception by email (also by SMS or messaging) in which someone pretends to be a trusted company or person —your bank, a supplier, a public body, even your boss— so that you do something harmful: reveal a password, make a payment or open a file with malware.
Its strength lies not in technology but in psychology. These emails always play on the same levers:
- Urgency: "act now or there will be consequences".
- Authority: it seems to come from someone you do not contradict.
- Routine: it imitates something you do every day, like paying an invoice.
When those three things come together, the person acts on autopilot, without stopping to check. And there lies the problem.
Why your company is a target (even if it is small)
Many owners think: "Who is going to notice my business?" The reality is the opposite. Small businesses are a preferred target because:
- They usually have fewer security barriers than a large company.
- They handle money and customer data just like any other.
- Often nobody has trained the team to recognise these deceptions.
Besides, you do not need to fool the owner. It is enough for a single employee —administration, customer service, whoever— to fall for it once. A leaked password or an overpaid invoice can cost far more than any protection measure.
How to recognise a phishing email: the key signs
The good news is that almost all fraudulent emails share clues. Teach them to your team and you will spot most of them at a glance:
- The sender's real address does not add up. The name may say "Bank X", but the real email is a strange address or from a domain that is not the official one.
- They hurry you or threaten you. "Your account will be blocked", "last chance", "reply today".
- They ask for sensitive data or actions. Passwords, bank details, an urgent payment, "confirming" your credentials.
- Links that do not go where they say. When you hover over them (without clicking), the real address does not match the one shown.
- Unexpected attachments. Invoices, quotes or "important documents" you were not expecting.
- Details that jar. Spelling mistakes, a generic greeting ("Dear customer"), a slightly different logo.
- A change to something important. "We have changed our account number, make the next payment here".
That last point deserves a special mention, because it is one of the most expensive frauds companies suffer.
Special care: the supplier that "changes account" and CEO fraud
Two variants of phishing hit small businesses' wallets directly:
- The supplier invoice with the account changed. An email that seems to come from a regular supplier announces a "new account number". If you pay there, the money goes straight to the scammer.
- CEO fraud. An email that appears to come from the company's management asks administration for an "urgent and confidential" transfer. The employee, not wanting to contradict the boss, makes it.
In both cases the defence is the same and it is simple: for any change of bank details or urgent payment, verify through another channel (a phone call to the usual number) before moving a single euro.
The rule that never fails
As with other scams aimed at people, there is one habit that cuts off most of these attacks at the root:
When an email asks for data, money or urgency, do not act from the email itself. Verify through an independent channel.
That is: do not click the link in the email or reply to it. Go to the bank's website yourself by typing the address, or call the supplier on the number you already had. If the email was real, you lose nothing. If it was fake, you have just avoided the problem.
What to do if you receive (or have already fallen for) phishing
If you suspect an email:
- Do not click links or open attachments.
- Do not reply or forward the email to colleagues "just in case".
- Verify through a separate channel if necessary.
- Notify the person in charge of IT and delete it.
If someone has already clicked or entered data:
- Change the affected password immediately and any that were the same elsewhere.
- If bank details were entered, notify the bank as soon as possible.
- If a payment was made, contact the bank straight away: sometimes it can be stopped.
- Disconnect the device from the network if a suspicious file was opened and contact a professional.
The key is speed and the absence of shame. Hiding the mistake for fear of a telling-off is what turns a scare into a disaster.
Why training and protection go together
Here is the underlying point. No program, however good, filters 100% of fraudulent emails, because these attacks are designed to fool the person, not the machine. And no training prevents that, one day, an especially well-made email reaches the inbox.
That is why real defence has two halves:
- Practical training so that your whole team recognises these deceptions at a glance and knows exactly what to do.
- Professional protection of email and devices, which filters most attacks before they reach a person.
Just one of the two leaves the door ajar. Both together close the way to the vast majority of attempts.
Protect your team before an email costs you dearly
Phishing works because it counts on nobody having taught your team to recognise it and on your systems not being prepared to filter it. Both have a solution.
At Bytechip we help freelancers, small businesses and companies shield their email and prepare their teams against these deceptions, with professional protection and training adapted to non-technical people. That way, when the trap email arrives —because it will— your business will be ready.
If you want a slip to stop being a risk for your company, let's talk.