The phishing emails that cost businesses money today don’t look like phishing. They come from a vendor you actually use, reference a job you’re actually running, and ask for something that sounds routine.
The old warning signs were bad grammar, a strange sender, and an obvious request for your password. Attackers now use AI to fix all three. They can copy a vendor’s writing style, pull your project names off your website and LinkedIn, and write a message that reads exactly like the real thing. Some can clone a voice from a few seconds of audio pulled off a voicemail greeting or a social media video.
Careful, experienced people get caught by these. Being smart doesn’t protect you. Having a process does.
What it looks like now
Phishing doesn’t only arrive by email anymore. These are the versions we see most around Deer Park, La Porte and Pasadena.
The changed bank account. A supplier you’ve paid for years emails to say they’ve switched banks, with new remit-to details attached. The email may come from the supplier’s real address, because their mailbox was the one that got broken into. This is the most expensive scam on this list, and it usually isn’t caught until the real supplier calls asking why you haven’t paid.
The urgent request from the boss. A message that appears to come from the owner asks the office manager to push a payment through today, buy gift cards for a customer, or send over the W-2s. It’s always urgent and the boss is always unreachable.
The fake sign-in page. A shared document, a DocuSign envelope, or a voicemail notification links to a page that looks exactly like the Microsoft 365 login. Type your password there and the attacker has your mailbox, which is how the changed-bank-account scam gets started at the next company.
Text messages. A text claiming to be from your bank, a delivery company, or a coworker’s new number. Phones show less of the sender’s details than a computer does, and people act on texts faster than they act on email.
Phone calls and cloned voices. A caller claiming to be your bank’s fraud department, your IT provider, or a familiar voice asking for something unusual. If the request involves money or a password, the voice being familiar doesn’t settle anything.
QR codes. A code on an invoice, a PDF, or a flyer that leads to a fake login page. Email filters have a hard time reading a code inside an image, which is why attackers like them.
What actually protects you
Each of these steps is aimed at a specific scam above.
Verify money and banking changes by phone, using a number you already had. Never use the phone number in the email, the signature block, or the attachment. Call the number already on file from before the request arrived. If the vendor’s mailbox has been taken over, every detail in that email belongs to the attacker, including the phone number. This one rule stops most of the money loss.
Make “I’m checking this” the safe answer. If the owner’s rule is that payment requests get verified even when they come from the owner, the office manager never has to choose between being careful and being fired. Say it out loud to your staff.
Turn on MFA everywhere, and use stronger options where you can. A stolen password is far less useful when the attacker also needs your phone. Passkeys and security keys go further, because they won’t work on a fake login page at all.
Filter email before it reaches anyone. Good email security catches impersonation attempts, malicious links and bad attachments that the built-in filter lets through. It won’t catch everything, which is why the rest of this list exists.
Train with realistic examples, not a once-a-year video. Short simulated phishing emails sent to your own staff show who clicks, and that’s information you want before an attacker finds out first.
Make reporting easy and never punish it. An employee who says “I think I just clicked something” in the first five minutes gives you a chance to lock the account down. One who’s afraid to say anything gives the attacker the rest of the week.
Trim what’s public. Your website doesn’t need a full staff directory with direct emails and job titles. Every detail an attacker can find makes the message more believable.
Keep everything updated. Some phishing attachments only work on software that hasn’t been patched.
Where to start
If you only do one thing this week, set the rule that every change to a vendor’s bank account or payment instructions gets confirmed by a phone call to a number you already had. Write it down and tell your staff who handles payments today.
If you’d like help with the rest, book 30 minutes. We’ll look at how email reaches your inbox, who has MFA and who doesn’t, and how a payment change gets approved in your office today.
Found This Article Helpful?
Stay updated with our latest IT insights and solutions.