The invoice looks right. The sender’s name matches the vendor you’ve worked with for years. The message even continues a real email thread from last week. That is exactly why modern phishing works so well, and why small businesses have become such frequent targets. The fix is less about fancy technology and more about building a few habits that make a scammer’s job much harder.
The Short Version
- Phishing now arrives by email, text, social media messages and phone calls, and it often looks like routine business.
- The strongest single habit is verifying unexpected requests through a contact method you already trust.
- Multi-factor authentication, prompt updates, security software and tested backups limit the damage if someone does slip up.
- Cyber coverage can help with the costs of a breach, but what it pays for varies widely by policy.
Why Small Businesses Get Targeted
Criminals tend to go where the effort is low and the payoff is decent. A small company may not have a dedicated IT person, a written security policy or regular staff training. Contact details for owners and employees are often easy to find on a website or social profile, and small teams pride themselves on responding quickly to customers and suppliers.
That responsiveness is a strength in business and a weakness in security. A phishing message is built to make someone act before they think: pay this bill, reset this password, open this contract, call this number. Every one of those requests sounds normal on a busy Tuesday.
What Phishing Looks Like Now
The clumsy “you’ve won a fortune” email still exists, but it’s not the main threat. Today’s attempts are more polished and spread across channels.
The hijacked conversation
One of the most convincing tactics starts when an attacker gets into a real person’s mailbox, perhaps a supplier or a client. Instead of sending a brand-new message, they reply inside an existing thread. You see a familiar name and a familiar subject line, and the only change is a request to download a file, sign in to view a document or update payment details.
The helpful phone call
Voice phishing can be surprisingly persuasive. A caller may claim to be from your software provider, your bank or tech support and walk an employee step by step through “fixing” a problem, which actually means sharing a login, approving an access request or installing remote-control software.
Texts and direct messages
Short messages about a missed delivery, a locked account or a suspicious charge push people to tap a link on a phone, where it’s harder to inspect where that link really goes.
Red Flag
The biggest warning sign is not bad grammar. It’s a request you weren’t expecting, especially one involving money, credentials or a file, combined with pressure to act right away.
What Attackers Are After
Once someone takes the bait, the consequences can spread quickly across devices and accounts. Depending on the scheme, a criminal may be able to:
- Steal customer, employee or financial data
- Install malware or ransomware on your systems
- Redirect payments to their own accounts
- Take over an email account and use it to phish your customers and vendors
That last point matters. A compromised business mailbox can damage relationships you’ve spent years building, because the scam now carries your name.
A Practical Defense Plan
- Make “verify first” a company rule. If a message or call asks for something unusual, confirm it using a phone number or contact you already have on file, never the one provided in the message. A two-minute call can prevent a five-figure loss.
- Turn on multi-factor authentication. Start with email, banking and any cloud software that holds customer data. Even if a password gets stolen, a second verification step makes account takeover much harder.
- Keep everything updated. Operating systems, office software, browsers, phones and third-party apps regularly receive security patches. Set updates to install automatically where you can.
- Use endpoint security software. Reputable security tools, including those built into modern operating systems, help detect malware before it does damage.
- Inspect before you click. On a computer, hover over a link to preview the real address. If it doesn’t match where you expect to go, don’t click. Treat surprise attachments with the same suspicion, particularly odd file types.
- Back up and test your backups. Reliable, separate backups can turn a ransomware event from a disaster into an inconvenience. Run a test restore now and then so you know the process actually works.
- Train your people regularly. Short, frequent refreshers work better than a once-a-year lecture. Share real examples of messages your team has received.
Pro Tip
Set a simple rule for payment changes: no vendor bank details get updated without a phone confirmation to a known contact. Payment redirection scams depend on skipping that step.
When a Customer Asks, “Did You Send This?”
Sometimes the first sign of trouble comes from outside. A customer calls about an odd email that appears to come from you. First, check whether anyone at your business actually sent it. Then help the customer work through a few questions:
- Were they expecting this message at all?
- Does the link point to a real, familiar website?
- Is it asking them to open a document they didn’t request?
- Does it ask for a username, password or payment information?
- Does it threaten to cut off access or service unless they act immediately?
If the message did come from your account without your knowledge, change passwords, review account settings for forwarding rules you didn’t create and alert your contacts. Getting professional IT help at that point is usually worth it.
Where Insurance Fits In
Good habits lower your risk, but they can’t eliminate it. Many business owners are surprised to learn that a standard business policy may offer little or no protection for data breaches or cyber incidents. Some insurers offer cyber coverage as an add-on to a business policy or as a standalone policy.
Depending on the policy, cyber coverage may help with expenses such as notifying affected customers or employees, credit monitoring, forensic investigation, data restoration and certain legal costs. Limits, exclusions and what counts as a covered event differ a lot, so it’s worth reviewing the details rather than assuming. The team at Callicott Insurance Agency can help you compare options and understand what a given policy would and wouldn’t do.
Frequently Asked Questions
Can phishing really happen over the phone?
Yes. Phone-based scams, sometimes called vishing, use a convincing caller to talk someone into sharing information, approving access or installing software.
Is multi-factor authentication worth the hassle for a small team?
For most businesses, yes. It adds a few seconds to a login and makes stolen passwords far less useful to criminals, especially on email accounts.
Does my general liability policy cover a data breach?
Often not, or only in limited ways. Cyber risks are frequently handled through separate coverage. Check your policy or ask your agent to review it with you.
How often should we train employees on phishing?
Short refreshers several times a year tend to work better than one long session. Sharing real suspicious messages your team receives keeps it practical.
Close the Gaps Before Someone Finds Them
Talk with Callicott Insurance Agency about how cyber coverage could fit alongside your current business insurance.
This article is for general information only. Coverage varies by insurer, policy and state; review your own policy or talk with a licensed agent about your situation.