The most expensive email a small business receives usually looks boring. It is a supplier saying their bank details have changed, or the owner asking for a quick payment before a meeting. No virus, no strange link. Just a request to send money to a new account.
Filters catch most of the obvious spam. They do not catch a real supplier whose mailbox was taken over, or a lookalike domain with one letter changed. People catch those, if they know what to look for and have a rule to fall back on.
Signs an email or text is phishing
- Urgency or secrecy: "today", "before end of day", "keep this between us", "I'm in a meeting, just handle it".
- A sender address that is close but wrong: an extra letter, a different ending (.co instead of .ca), or a personal Gmail for a company contact. Tap or hover on the name to see the real address.
- A reply-to address that differs from the sender.
- A link that goes somewhere unexpected. Hover or long-press before you tap. A "Microsoft" or "Google" sign-in page on any other domain is fake.
- A sign-in page you reached from an email. Go to the site yourself from a bookmark instead.
- An unexpected attachment, especially a zipped file, an HTML file, or a document that asks you to "enable content".
- A QR code in an email asking you to sign in or pay.
- A request for gift cards, crypto or a wire to a new account.
- A phone call or voicemail that sounds like your boss. Voices can be cloned. Hang up and call back on a number you already have.
Signs of payment-change fraud
- A supplier, contractor or landlord says their banking details have changed.
- An invoice arrives that matches a real job, with the right amount, but a different account number.
- The email is in an existing thread with a supplier, but the tone or timing is slightly off.
- A new payee, or a payee in a different country or at a different bank, for a supplier you have paid for years.
- An employee asks payroll to send their pay to a new account.
The phone-verification rule
Write this down and give it to everyone who can pay a bill:
- Any new payee, any change to bank details, and any urgent or unusual payment request is confirmed by phone before money moves.
- Call a number you already have on file, from an old invoice, a contract or the supplier's website. Never use a number in the email asking for the change.
- Confirm the account details out loud, and write down who you spoke to and when.
- Large or new payments need a second person to approve them in your banking or accounting software.
- Nobody, including the owner, gets an exception by email. If the owner asks for an urgent payment, the rule applies to the owner too. Make that known, so staff never feel they are second-guessing the boss.
Your bank can often stop or recall a transfer only if you call within hours. Keep your bank's fraud line in the same place as this rule.
What to do after a click
Clicking is not the disaster. Staying quiet is. Make it safe and fast to report.
- Do not close it and hope. Tell your manager or IT right away. No blame.
- If you typed a password: change it immediately from a different, trusted device, and sign out of all sessions. In Microsoft 365 or Google Workspace, an admin can revoke sessions and reset MFA.
- If you opened an attachment or allowed something to run: disconnect the computer from Wi-Fi and the network. Leave it on for IT to look at.
- Check the mailbox for new forwarding or inbox rules, which attackers add to hide replies. Delete any you did not create.
- If money was sent: call your bank's fraud line now, then report it to the police non-emergency line and to the Canadian Anti-Fraud Centre (1-888-495-8501 or online).
- Warn the people who might be next: colleagues, and the supplier or client whose name was used.
- Report the phishing email using the Report button in Outlook or Gmail, and forward scam texts to 7726 (SPAM) on Canadian carriers.
10-minute team training script
Run this at a team meeting. One person reads, everyone answers. Repeat it every three to six months with fresh examples.
Minute 0 to 1: why we are doing this. "Most fraud against small businesses starts with an email or a text, not a hacker breaking in. It takes all of us, not just IT. Nobody will be blamed for reporting a mistake."
Minute 1 to 4: spot the fake. Show three real-looking examples on screen or on paper. Use a "bank details changed" email from a supplier, a "your password expires today" sign-in link, and a text from "the owner" asking for gift cards. For each, ask: "What gives it away?" Point out the sender address, the urgency, and the link.
Minute 4 to 6: the payment rule. Read the phone-verification rule out loud. Ask: "A supplier emails that their bank changed and the invoice is due today. What do you do?" The answer is: call the number on file, confirm, get a second approval.
Minute 6 to 8: after a click. "If you click, or type your password somewhere strange, tell [name] right away, on [phone or chat]. Change your password from another device. If something opened, unplug from the network. Telling us fast is the right move and is never punished."
Minute 8 to 9: the report button. Show where the Report button is in your email, and where to forward scam texts.
Minute 9 to 10: one question each. Go around the room: "What is one thing you will do differently?" Note any questions you cannot answer and follow up.
Make it a policy with AI
The prompt below writes a one-page payment-verification and phishing policy for your business, plus fresh training examples based on the suppliers and tools you actually use.
Write a plain-language phishing and payment-verification policy for my small business, plus training material. Business: [name], [industry], [number of staff] Who can approve or send payments: [roles] How we pay suppliers: [e.g. online banking EFT, wire, cheque, credit card] Accounting software: [e.g. QuickBooks Online, Xero, Sage] Email: [Microsoft 365 / Google Workspace / other] Our usual suppliers and payees (types only, no real names): [e.g. 3 building-materials suppliers, landlord, payroll provider] Who staff should report a suspicious email or a click to: [name and how to reach them] Write: 1. A one-page policy under 350 words: the phone-verification rule (call a number already on file, never one from the email), two-person approval above [amount], no exceptions by email including for the owner, and how to report a mistake without blame. 2. A checklist to tape next to the computer of whoever pays bills (8 lines maximum). 3. Three realistic but fictional phishing examples tailored to my business (one payment-change email, one fake sign-in email, one text message), each with the red flags listed underneath. 4. A "what to do after a click" card with 6 numbered steps. 5. Five quiz questions with answers for a 10-minute team refresher. Rules: plain words, short sentences, warm tone, no scare tactics. Canadian English. Include the Canadian Anti-Fraud Centre as the place to report fraud.
Do not paste real bank details, passwords or customer data into an AI tool. Use made-up examples.
Want it done for you?
We run short phishing training for small teams, set up email protection and the payment rules in your accounting software, and help you respond when something gets through.