It's Monday morning, and you're settling in at your desk, hoping your coffee kicks in before 11 a.m. You turn on your computer and start planning your workday. As you check your email, one message catches your attention. It’s from Phil…Phil? From HR? It’s not payday, but you know that he usually runs your payroll, so you open the email. He says the company is switching to a new payroll system, and you need to click the link to login and update your banking information before the end of the day, as it didn’t all move over when switching systems.
The email looks legitimate. It’s 100% from Phil’s actual email address. It has our company branding, his signature, and no typos. But the timing and urgency of the request seem… off. Could Phil's email account have been compromised? And how can you keep someone else from falling for the same request?
What is Business Email Compromise (BEC)?
The FBI's Internet Crime Complaint Center (IC3) defines business email compromise as a “sophisticated scam targeting both businesses and individuals performing a transfer of funds.” This email-based phishing scam uses social engineering or computer intrusion techniques to compromise legitimate business emails.
Typically, these emails want you to click a link, download malicious software, transfer funds, or hand over sensitive information. They often appear to come from someone you already trust. Attackers have gotten smarter over the years, so these emails take more than just a second look now.
Why Phishing Emails Are Getting Harder to Recognize
If an attacker is using a real email account, many of the warning signs employees have been taught to look for may be absent. Traditional warning signs, such as spelling errors or unfamiliar email addresses, are still worth watching for, but they aren't enough on their own.
Many recognizable phishing scams have weird email addresses, large recipient lists, or typos. They used to just be one-time emails asking you to click something. Now, it’s much more strategic. In January-March of 2026, 82%-84% of BEC attacks were initiated with a simple, “Are you at your desk?” email, seemingly sent by someone within your own company. After a response, this would then lead to a chain or conversation containing the typical harmful click or malicious download request.
Today, the biggest warning sign may be what an email is asking you to do, rather than how the email looks. Is someone requesting unusually sensitive information, such as bank information or your Social Security number? Do they seem extremely urgent to get this information from you?
How to Protect Your Business Email Accounts
Recognizing a suspicious request is important. However, businesses also need to reduce the likelihood that their own accounts will be compromised.
Strengthen Sign-In Security
Implementing passwordless practices and multi-factor authentication (MFA) can help protect business email accounts by reducing reliance on passwords alone. These methods add stronger layers of protection against unauthorized access and credential-based attacks.
At RockIT, we like to strengthen sign-in security through single-sign on (SSO) systems, password managers, hardware security keys, passkeys, and more.
Monitor Accounts for Unusual Activity
Even with strong sign-in security in place, businesses should monitor their email accounts for unusual activity. Make time to review unfamiliar devices and suspicious sign-in activity. If your business uses Microsoft 365, you should also keep an eye out for the following:
- Unexpected inbox rules, such as automatic forwarding to unfamiliar addresses.
- Suspicious messages in the Sent Items or Deleted Items folders.
- Unexplained account lockouts.
- Unauthorized changes to email signatures or contact information.
Put Email Security Policies in Place
You can train your employees to recognize unusual requests and suspicious-looking emails, but you also need to establish procedures for when these emails come through. Even if a request appears to come from a coworker, employees should verify unexpected instructions to create accounts, share credentials, or update payment information.
Whether it is a real request or not, always tell your employees to proceed with caution. Before clicking anything, reach out to the sender via another medium such as a phone call. Ask them if they sent the email and if it is legitimate if you were not already expecting it.
Businesses can also implement email authentication standards, such as SPF, DKIM, and DMARC to help prevent domain spoofing. However, these measures cannot stop fraudulent messages sent from an account that has already been compromised.
What to do When an Email Seems Suspicious
If an email seems suspicious, pause before responding or clicking anything. Check both the sender's name and email address, while remembering that legitimate accounts can be compromised. Alsos can over the language and grammar of the email and think about what the email is requesting. Take extra time to verify requests involving money, credentials, or sensitive information.
Ask a coworker or your IT provider for a second opinion if you're unsure. Have them physically come look at the email or take a screenshot and send it to them. If you are still unsure, give the sender a call using a separate, trusted communication channel. Do not call any phone number that is listed in the questionable email.
If you can determine that the email may be a phish, report it to your IT provider. If you or someone in your office clicked a suspicious link or shared information, report it to your office manager and/or IT provider immediately.
Protect the Trust Behind Your Business Emails
Businesses need both technical safeguards and employees who know when to verify a request. A legitimate-looking email isn’t always necessarily a safe email. When you have the right safeguards in place and a proper IT team to back them up, you aren’t just helping your business but also your customers, vendors, and other professional relationships.
RockIT helps small and midsize businesses evaluate their IT security, strengthen account protections, and reduce cybersecurity risks. Contact our team to learn how we can help protect your business email.
0 Comments