How to Spot and Avoid Phishing & Business Email Scams
Phishing remains one of the most common ways businesses lose money or data, not because the technology behind it is sophisticated, but because it targets people rather than systems. A single convincing email, opened at a busy moment, is often all it takes.
Phishing is a scam where an attacker impersonates a trusted party, a bank, supplier, colleague, or well-known brand, usually by email, to trick someone into revealing sensitive information, transferring money, or installing malware. Recognising the warning signs and verifying anything unusual before acting are the two most effective defences.
Common Business Email Scams to Watch For
- Invoice fraud: an email appearing to come from a real supplier, with bank details changed to redirect a legitimate payment to the attacker’s account.
- CEO fraud (business email compromise): an urgent-sounding message appearing to come from a senior executive, pressuring a junior staff member into an unusual, time-sensitive payment or data request.
- Fake account or password alerts: an email claiming your hosting, bank, or software account needs urgent action, linking to a fake login page designed to capture your real credentials.
- Prize, refund, or tax scams: messages claiming an unexpected refund, tax rebate, or prize, designed to extract personal or financial details.
Warning Signs of a Phishing Email
- A sense of urgency or pressure to act immediately, often with a threat attached (account suspension, legal action, a missed deadline).
- A sender address that looks almost right but isn't quite, a slightly misspelled domain, or a generic address pretending to be a specific person.
- Generic greetings ('Dear Customer') on a message that claims to be personal or urgent.
- Links that, when hovered over without clicking, show a destination that doesn't match the claimed sender.
- Requests for sensitive information, passwords, bank details, or payment, that a legitimate organisation would not normally ask for by email.
- Unexpected attachments, particularly from a sender or context you weren't expecting.
How to Verify a Suspicious Email Before Acting
If an email asks for payment, a change of bank details, or sensitive information, verify it through a separate channel, a phone call to a known number, not one provided in the email itself, before doing anything. This single habit can prevent many invoice-fraud and CEO-fraud attempts, since attackers rely on the request being actioned before anyone checks.
Protecting Your Business From Phishing
- Use a professional, branded business email address on your own domain rather than a free provider; see our guide to email hosting if you haven’t set this up yet.
- Set up SPF, DKIM and DMARC records so it’s harder for anyone to spoof your own domain in an attack against your customers or suppliers; see our guide to updating DNS records.
- Train staff to recognise the warning signs above, since awareness consistently stops more attacks than any single technical control.
- Establish a simple rule: any request to change payment details or bank information must be verified by phone before being actioned, no exceptions.
- Keep devices and email clients updated, since some phishing attempts rely on exploiting outdated software rather than tricking the recipient directly.
What to Do If You've Already Clicked or Responded
Change the password for the affected account immediately, and any other account using the same password. If financial details were shared, contact your bank without delay. If the compromise involves a business email account, contact your hosting or email provider to check for unauthorised access or forwarding rules an attacker may have set up.
Frequently Asked Questions
How can I tell if an email is really from my bank or supplier?
Check the sender’s actual email address carefully, not just the display name, and if anything feels off, verify by calling a number you already have on file, not one provided in the email itself.
What is business email compromise (CEO fraud)?
It’s a scam where an attacker impersonates a senior figure in the business, usually by email, to pressure a staff member into an unusual, urgent payment or sensitive data request that bypasses normal approval steps.
Can a branded business email address prevent phishing?
It doesn’t prevent every attack, but it removes one common tell (a mismatched free-provider address) and, combined with SPF/DKIM/DMARC, makes it harder for attackers to convincingly spoof your own domain against others.
Are phishing attempts increasing in Kenya?
Phishing and related email-based scams remain common cyber threats, making basic awareness and verification habits worthwhile regardless of business size.
What should I do immediately after realising I've been phished?
Change the affected password immediately, alert your bank if any financial details were involved, and check for any unauthorised email forwarding rules or account changes an attacker may have set up.
Move to a secure, professional business inbox withEmail Hosting from Shine Web, orcontact our team if you suspect a compromise.
