Your inbox is one of the most common ways criminals try to break into a business. Verizon's 2026 breach report found that the human element played a part in 62% of breaches (source). The FBI's Internet Crime Complaint Center also received more than one million complaints in 2025, with phishing and spoofing among the most frequently reported (source). Help Net SecurityFBI
You don't need to be a tech expert to protect you and your coworkers. You just need a handful of habits that you use every time.
- Look at the real sender
The name on an email can say anything. Check the actual email address behind it. A message from "Human Resources" might come from an address like hr@yourcompany-support.net, which is not your company's real domain. Look for misspellings, swapped letters, extra words, and free email services that claim to be an official business. Every email provider and software is a little different, so you can Google search for how to find the sender details for your specific provider.
- Hover before you click
Links can hide where they really lead. On a computer, rest your mouse over a link without clicking and read the web address that pops up. On a phone, press and hold the link to see a preview. If the address looks odd or doesn't match the company it claims to be from, leave it alone.
The same goes for attachments. If you weren't expecting a file, don't open it, even if it looks like an invoice, a shipping notice, or a voicemail.
If you think it may be legit, verify with the sender without using the email in question. Go direct to their website, your account, call or however you need to verify before opening an attachment.
- Treat urgency as a warning sign
Scammers want you to act before you have time to think, they try to manipulate your fear response. Messages like "Your account will be locked in one hour" or "I need this payment sent right now" are built to create panic.
Requests involving money deserve extra care. Business email compromise, where a criminal pretends to be a boss or vendor to redirect payments, caused more than $3 billion in reported losses in 2025 (source). These emails often have no suspicious link or attachment at all. They are simply believable messages from someone who seems to be in charge. HIPAA Journal
When a message pushes you to hurry, that is your cue to slow down. A real manager or vendor will understand if you take a few minutes to check.
- Confirm with a second method
If an email asks for money, gift cards, passwords, or a change to bank details, verify it another way. Call the person using a number you already have, or send them a message on your company chat. Never rely on the phone number or links inside the email in question.
- Skip the link and go straight to the source
Say an email warns that something is wrong with your account. Don't log in through its link. Type the company's web address into your browser or use a bookmark you saved earlier, then sign in there. If there's a real problem, you'll see it. Usually in an alert at the top of your account logged in page.
Also turn on multifactor authentication (MFA) for your accounts whenever it's offered. MFA adds a second step when you sign in, such as a code sent to your phone, so a stolen password alone won't get a criminal in.
- Report it right away
Deleting a scam email protects you, but reporting it protects everyone else in the office. Forward it to your IT team or use the "Report phishing" button in your email program. If you already clicked a link or typed in a password, tell IT immediately. Quick action can stop a small mistake from becoming a big one, and nobody should be embarrassed for speaking up.
A quick checklist
Before you act on any unexpected email, ask yourself:
- Do I recognize the sender's real email address?
- Does the link go where it says it does?
- Is someone pressuring me to hurry?
- Does it involve money, gift cards, or a password?
- Have I confirmed the request another way?
If anything feels off, stop and ask for help.
Get extra protection for your business
Good habits are your first line of defense, but they work best alongside the right tools and training. If your company wants help with email filtering, employee awareness training, and ongoing threat monitoring, take a look at these Cybersecurity Services.
Scammers only need one person to slip up. It only takes one careful person to stop them. Slow down, verify, and report.