Most break-ins at small businesses no longer start with a crowbar. They start with an email. A fake invoice that looks like it came from a supplier, a "your mailbox is full" warning, a shipping notice, or a message that seems to come from the owner asking someone to buy gift cards. For offices, shops, contractors, and medical and professional practices across Atlantic, Cape May, Cumberland, and Gloucester counties, phishing is the most common way attackers get in. The good news is that most phishing emails share a handful of warning signs, and a few simple habits and settings stop the majority of them.
What phishing looks like at a small business
Phishing is any message that tries to trick someone into clicking a bad link, opening a bad attachment, entering a password on a fake page, or sending money. The most common versions small businesses see are:
- Fake invoices and payment changes. A "vendor" says their bank details changed and asks you to send the next payment to a new account.
- Fake login pages. A message says your Microsoft 365 or Google account needs attention and links to a page that looks real but steals the password.
- Boss or owner impersonation. An urgent note, often "sent from my phone," asks an employee to buy gift cards or wire money quickly and quietly.
- Delivery and shipping notices with a link to "reschedule" a package that was never ordered.
- Text and phone versions. The same tricks now arrive by text message and voicemail, not just email.
Warning signs to teach everyone on your team
Most phishing messages give themselves away if someone slows down for a few seconds:
- Urgency or secrecy. "Act now," "account will be closed," or "don't tell anyone" are pressure tactics.
- A sender address that is slightly off, such as an extra letter, a different ending, or a free email account pretending to be a company.
- Links that don't match. On a computer, hover over the link before clicking. On a phone, press and hold to preview it.
- Unexpected attachments, especially zipped files, invoices you weren't expecting, or documents that ask you to "enable content."
- Requests to change payment details or buy gift cards. Treat these as suspicious every time.
- A login page reached from an email link. When in doubt, close the email and go to the site the way you normally do.
Add a simple verification rule for money
The costliest phishing attacks are about payments, not passwords. Put one rule in writing: any request to change bank details, send a wire, or buy gift cards gets confirmed by phone using a number you already have on file, never the number in the email. It costs a two-minute call and stops the most expensive scams outright.
Settings that catch phishing before it reaches people
Training helps, but the right settings mean fewer bad messages land in the inbox in the first place:
- Turn on multi-factor authentication for email and every important account, so a stolen password alone isn't enough.
- Set up SPF, DKIM, and DMARC on your domain, which makes it much harder for someone to send mail that looks like it came from your business.
- Use your email provider's built-in filtering and turn on warnings for messages from outside your organization.
- Use a password manager, which won't fill a saved password into a look-alike site.
- Keep computers and browsers updated and protected by business antivirus, so a bad attachment has fewer ways to cause damage.
- Keep offsite backups, so a click that leads to ransomware is a bad day instead of a disaster.
What to do if someone clicks
Clicks happen, even to careful people. What matters is speed and a no-blame culture so employees speak up right away:
- Disconnect the computer from Wi-Fi or unplug the network cable if anything strange happens after the click.
- Change the password for any account that was entered on a suspicious page, and sign out of all sessions.
- Call your bank immediately if money was sent. The sooner they are notified, the better the chance of stopping the transfer.
- Check email rules and forwarding. Attackers often add hidden rules that forward or delete messages.
- Call your IT provider so they can check the computer and the account for anything left behind.
Talk to a local IT team
Izzo Network helps small businesses in Mays Landing, NJ 08330 and across South Jersey set up multi-factor authentication, email security settings, password managers, backups, and plain-language phishing awareness for staff. Call or text (609) 415-0011, or use the contact form, to get a quick review of how well your business email is protected.
FAQ
How do I report a phishing email at work?
Don't forward it to coworkers or reply to it. Use the "Report phishing" or "Report junk" option in Outlook or Gmail if it's turned on, let your IT contact know, and then delete the message.
Is phishing training worth it for a business with only a few employees?
Yes. Small teams are frequent targets because attackers expect fewer protections. A short session covering the warning signs and the phone-verification rule for payments goes a long way.
Will multi-factor authentication stop phishing?
It blocks most attacks that rely on a stolen password, which makes it one of the best protections available. It isn't perfect, so pair it with good habits and never approve a sign-in prompt you didn't start.
What if a phishing email looks like it came from our own company?
That usually means your domain is missing or has weak SPF, DKIM, and DMARC settings, or an employee account was compromised. Both are worth checking right away.