Phishing and Email Scams: How to Protect Your Business

Most cyberattacks begin with an email. A message that looks like it comes from your bank, your supplier, your boss or a courier company invites someone to click, open or pay. One careless moment can hand over a password, install ransomware or send money to a criminal. Understanding how these scams work, and building a few habits, is one of the most effective protections a business can have.

The common types

Phishing

A message pretending to be from a trusted source, designed to make you click a link, open an attachment or enter your credentials on a fake website. Typical disguises include Microsoft or Google login pages, delivery notifications, bank alerts and shared document links.

Spear phishing

A targeted version, tailored to a specific person using details found online: your name, role, suppliers and recent activity. These are much more convincing.

Business email compromise (BEC) and invoice fraud

Criminals impersonate a supplier, executive or customer, or break into a real mailbox, and request a payment or a change of bank details. The invoice looks genuine, the email thread may be real, and the money goes to the criminal's account. This type of fraud causes some of the largest losses for small businesses.

CEO fraud

A message that appears to come from the owner or a director, asking someone in finance to make an urgent, confidential payment or to buy gift vouchers.

Fake notifications and "your account will be suspended"

Urgent warnings about mailbox storage, expired passwords, unpaid invoices or security alerts, aimed at making you act before thinking.

Malicious attachments

Documents, invoices or "voice messages" that install malware when opened, or ask you to enable macros.

SMS and WhatsApp scams

The same tricks arrive by text or chat: parcel delivery fees, bank verification codes and urgent requests from "a friend" or "your boss" on a new number.

Warning signs

Urgency or threats: "Act now or your account will be closed."
Unexpected requests, especially involving money, passwords or sensitive information.
A changed bank account for an existing supplier.
Sender address that is slightly off, such as a swapped letter or a different domain, even when the display name looks right.
Links that do not match: hover over a link to see where it really goes.
Generic greetings where a name should appear.
Poor grammar or odd phrasing, although modern scams are often polished.
Unexpected attachments, especially zip files, executables or documents asking you to enable macros.
Requests for secrecy: "Do not tell anyone."
Reply-to address that differs from the sender address.
A request to move the conversation to a personal email or messaging app.

None of these alone proves a scam, but several together should stop you.

Build verification habits

Technology helps, but process stops payment fraud.

The golden rule for payments

Any change to bank details, and any unusual or urgent payment request, must be verified by phone using a number you already know, not one in the email. Make this a written policy, and apply it to everyone, including the owner. A call takes two minutes and can save a fortune.

Further payment safeguards

Require two people to approve payments above a set amount.
Keep supplier bank details in your accounting system, and treat changes as a controlled process.
Be wary of "urgent" payments that skip the normal process.
Check new suppliers independently before paying.
Confirm large payments with a call, even when the request looks routine.

Links and attachments

Do not click links in unexpected messages. Go to the website by typing the address or using a bookmark.
Open attachments only if you expected them. If unsure, ask the sender through another channel.
Never enter your password after clicking a link in an email. Open the service directly instead.
Treat password reset emails you did not request as suspicious.

What to do if someone clicks

Speed matters, and blame does not help.

Tell IT or your provider immediately.
If credentials were entered, change the password at once, from a safe device, and sign out all sessions.
Make sure MFA is on, and review the account's sign-in activity.
Check mailbox rules. Attackers often create hidden rules that forward or delete messages.
Disconnect the device from the network if malware may have been installed, and have it scanned.
Warn colleagues if a message went to several people.
If money was sent, contact your bank straight away. The sooner they are told, the better the chance of recall.
Report the incident and assess legal duties. If personal information was exposed, South African privacy law may require notifying the Information Regulator and affected people. See POPIA and your business website.
Report the scam to the impersonated organisation and to the authorities as appropriate.

Create a culture where people report mistakes quickly without fear. The staff member who admits a mistake in five minutes helps far more than the one who hides it for a week.

Technical protections

Email filtering

A good spam and phishing filter catches many malicious messages before they reach inboxes. Add attachment scanning and link protection.

Multi-factor authentication

Even if a password is stolen, MFA stops most account takeovers. Enable it everywhere. See cybersecurity basics for small businesses.

Email authentication for your domain

SPF, DKIM and DMARC make it harder for criminals to send email pretending to be from your domain, and help your genuine email reach inboxes. See domains, hosting and business email explained.

External email warnings

Tag emails from outside your organisation with a visible banner. It helps staff spot impersonation of colleagues.

Endpoint protection

Modern endpoint security can block malicious downloads and detect suspicious behaviour even if someone clicks.

Limit what a compromised account can do

Use least-privilege access, so one stolen account cannot reach everything. Restrict admin rights, and review access regularly.

Backups

If ransomware gets in, tested backups let you recover without paying. See online store security and backups.

Train your team, repeatedly

Run short sessions every few months, with real examples relevant to South African businesses.
Use simulated phishing emails and follow up with coaching.
Share recent scam attempts, so people know what is circulating.
Include new staff in onboarding.
Give finance and admin staff extra training, as they are prime targets.
Make it easy to report suspicious messages, ideally with one click or a dedicated address.

Your own brand can be impersonated

Criminals may copy your website or emails to scam your customers. Protect them:

Tell customers how you will and will not contact them. For example: "We will never change our bank details by email."
Display your official bank details only in controlled places.
Monitor for lookalike domains and fake pages.
Secure your own website. See what to do if your website is hacked.

A short checklist

Payment change verification policy, in writing
Dual approval for large payments
MFA on all accounts
Email filtering and external-sender banners
SPF, DKIM and DMARC configured
Endpoint protection and tested backups
Regular staff training and phishing simulations
A simple way to report suspicious emails
A response plan, with contact numbers for IT, your bank and legal advice

Phishing relies on speed, trust and pressure. Slow down, verify through a second channel and make that habit part of how your business works. If you want help putting protections in place, a managed IT provider can set up and monitor them; see what managed IT support costs per user.