Look for typos.
Check for a strange sender address. Be suspicious of anything that sounds
"off."
That's still
the core of a lot of phishing awareness training, and it teaches your team to
catch the scams that have mostly stopped arriving. The emails getting through
now are clean and well written. They reference a real vendor, a real invoice or
a real person on your staff. If your people are waiting for bad grammar,
they'll wave the good forgery right through.
Why the old advice stopped working
I wrote a book
on AI business strategy, so I spend a lot of time on what these tools can do
for a business owner: draft a proposal in minutes, summarize a contract, match
a company's tone. Attackers have the same tools. The few seconds it takes you
to polish an email is all it takes them to write one that sounds exactly like
your controller, your largest supplier or you.
Some go
further, with AI-generated voicemails and video that imitate a familiar person.
A careful, well-trained employee can be fooled by a message that looks right
and sounds right. That isn't a training failure. It's a sign your defense can't
rest on people spotting mistakes.
Seven ways phishing shows up now
Phishing isn't
just an email problem anymore. Here's what it looks like in plain terms:
•
Email phishing: A message that looks like it's
from a bank, a vendor or a service you use, with a link or attachment meant to
steal a login or install malware.
•
AI phishing: Built from what's publicly
available about your business (your website, LinkedIn, press releases), so it
mentions real relationships and real job roles.
•
Spear phishing: Aimed at one person. The
attacker has done the homework on who approves payments or who manages payroll.
•
Business email compromise (BEC): Someone
impersonates an owner, employee or vendor to request a wire, change bank
details or reroute payroll. There's often no link or attachment at all, just a
request, which is exactly why filters miss it.
•
Smishing: The same scam by text message: a link,
a callback number or a request to "confirm" account details.
•
Vishing and voice cloning: A call or voicemail
from someone claiming to represent a trusted organization, or a cloned voice of
someone you know, asking for something urgent.
•
QR-code phishing (quishing): A QR code in an
email, invoice, flyer or package that leads to a fake login page. Filters have
a harder time inspecting an image than a link.
Phishing protection for small business: what I actually tell clients
•
Make verification a rule, not a judgment call. Any
request to move money, change banking details or reset credentials gets
confirmed through a second channel, using a phone number you already have on
file, never the one in the message. In the Army, you don't act on an order you
can't authenticate. The same principle works in an accounts payable office.
•
Move sign-in beyond passwords. Multi-factor
authentication everywhere, and passkeys or hardware security keys where your
systems support them. With phishing-resistant sign-in, a stolen password alone
isn't enough. We're piloting hardware keys in our own office before we
recommend a rollout to anyone else.
•
Train for the attacks happening now. Short,
regular training that covers AI-written email, voice cloning and QR codes, not
a once-a-year video about typos.
•
Let email security do the first pass. Filtering
that inspects links, attachments and impersonation attempts stops a lot before
anyone on your team has to make a call.
•
Look hard at what you publish. Staff
directories, org charts and "meet the team" pages help customers find you. They
help attackers too. Decide what actually needs to be public.
•
Keep systems patched. A click is often just the
first step; the attacker still needs an unpatched application to get further.
•
Make reporting easy and blame-free. The employee
who reports a suspicious message in two minutes is worth more than the one who
quietly deletes it. If people expect to get in trouble, they stop telling you.
Where to start
None of this
requires a massive project. Most of it comes down to knowing how money and
credentials move through your business, and where one convincing message could
redirect them.
That's what our
discovery call is for. It's 15 minutes, and it's a conversation, not a pitch.
I'll ask how payment approvals work, who can change vendor or payroll details
and how your team signs in today. We don't quote fixed-scope work sight-unseen,
so if there's a fit, the next step is a closer look at your actual environment,
explained in plain language.
If you run a
business in Louisville or Southern Indiana, schedule a 15-minute discovery
call with us, and let's find out where a well-written phish would land in
your business before an attacker does.
Dean Lause | CEO, Argentum IT
Argentum IT — Veteran Owned
and Run
