How to Spot Phishing Emails: A Guide for Small Businesses

The Most Common Attack (and Why It’s Getting Harder to Spot)

I’ve been helping small firms navigate technology since 1999, and if there is one constant in these 27 years, it’s this: technology doesn’t break into your business—people let the attackers in. Phishing remains the #1 way criminals breach small professional service firms. It isn't because your team is lazy; it's because the attackers have gotten much, much better.

When I started Sentree Systems, a phishing email was easy to spot. It usually had a subject line like "WINNER!" and was written in broken English. Today, I see attacks that are indistinguishable from a legitimate email from your bank, your software provider, or even your own business partner. In 2026, generative AI has eliminated the spelling errors we used to rely on as red flags, making these threats more dangerous than ever for firms with fewer than 100 employees.

Key Takeaways

• AI has changed the game: Don't look for typos anymore; look for the intent and the source of the request.
• Quishing is real: QR code phishing is a major threat in 2026. Never scan a QR code in an email without external verification.
• Verification over Trust: If an email asks for money or data, pick up the phone. A 30-second call can save you $100,000.
• MFA is non-negotiable: Multi-factor authentication is your only reliable safety net when a password is stolen.
• Human error is the target: Technology blocks 99% of attacks, but your team is the final 1% that determines your survival.

The Modern Face of Phishing in 2026

I recently worked with a 12-person accounting firm that nearly lost $45,000 because of a single email. It didn't look suspicious. It looked like a routine invoice from one of their long-term software vendors. The link in the email didn't go to a malware site—it went to a pixel-perfect login page that stole the office manager's credentials. This is the reality for small firms today.

According to the 2025 Verizon Data Breach Investigations Report, human elements (like phishing) continue to drive over 68% of all breaches. For a small firm, the "cost of a click" isn't just a metaphor. The average cost of a data breach for a small business has now climbed toward $4.8 million globally, according to the IBM Cost of a Data Breach Report 2025. For the firms I work with, a breach usually costs between $50,000 and $250,000 in direct recovery costs, not including the reputational damage that can end a practice.

How to Spot a Phishing Email Today

Forget the old advice about looking for "Dear Customer." Attackers now use "Spear Phishing," where they research you on LinkedIn or your firm’s website to make the email personal. Here is what I tell my clients to look for now:

• The "Urgent" Emotional Trigger: I’ve seen hundreds of these. "Your account will be deleted in 2 hours" or "Suspicious activity detected—log in now." They want you to panic so you stop thinking critically.
• Hidden URL Discrepancies: In my experience, this is the most reliable check. Hover your mouse (don't click!) over any link. If the email says it's from Microsoft.com but the link points to login-portal-sec-342.xyz, it's a trap.
• The "New" Invoice/Wire Transfer Request: If a vendor suddenly changes their banking details or asks for an immediate wire transfer, I guarantee you it’s a scam 9 times out of 10. I once had a client receive a "urgent" wire request that looked like it came from me. It didn't.
• Quishing (QR Code Phishing): This has exploded recently. You get an email saying your MFA needs to be reset, and it shows a QR code. When you scan it with your phone, you bypass all the security filters on your PC and hand your credentials directly to the attacker.
• AI-Generated Tone: While the grammar is now perfect, the tone is often "uncanny." If your partner usually signs off with "Best, Dave" and suddenly sends a formal email signed "Sincerely, David R. Thompson," your internal alarm should go off.

Real-World Experiences from the Field

I’ve sat in rooms with business owners who are in tears because they thought they were doing everything right. One specific instance stands out: a small engineering firm I consult for had an employee receive a "voicemail" attachment. It looked like a standard Microsoft Teams notification. He was expecting a call from a client, so he clicked it. Within 15 minutes, their entire file server was encrypted. We recovered it because we had off-site backups, but they lost two days of billable time—roughly $18,000 in lost productivity.

I’ve also seen the "CEO Fraud" play out in real-time. A junior staffer at a local law firm got a text from what she thought was the managing partner asking for $500 in gift cards for a "client event." I tell my clients: No CEO is ever going to ask you to buy gift cards via text or email. Period.

Technical Controls: Your Safety Net

Even the best-trained team will make a mistake on a busy Monday morning. That’s why I insist on a layered defense. You can't just have "IT support"; you need proactive security. At my firm, we focus on four specific layers for every small business:

Security Layer	What it Does	Why You Need It
AI-Powered Email Filtering	Analyzes the intent and metadata of emails, not just links.	Catches 95% of phishing before it even hits the inbox.
MFA (Multi-Factor)	Requires a second form of ID (like an app code) to log in.	Makes a stolen password useless to an attacker.
Endpoint Protection (EDR)	Watches for suspicious behavior on your actual computers.	Stops ransomware from spreading if someone clicks a bad link.
Security Awareness Training	Monthly 5-minute videos and simulated "fake" phishing tests.	Reduces your team's "click rate" from 30% down to under 3%.

The ROI of Prevention

When I sit down with a firm owner, they often ask about the cost. I tell them to look at the math. A proper security stack might cost $150–$250 per user per month. For a 10-person firm, that’s roughly $2,000 a month. A single ransomware event or a successful wire fraud can easily cost $100,000. That’s a 50-to-1 return on your investment. I have watched firms close their doors because they didn't think they were "big enough" to be a target. The attackers don't care about your revenue; they care about your access.

Frequently Asked Questions

What should I do if I accidentally clicked a link in a suspicious email?

First, don't panic, but act immediately. Disconnect your device from the Wi-Fi or unplug the network cable. This stops any potential malware from talking back to the attacker's server or spreading to your colleagues. Immediately notify your security provider or IT department and change your passwords from a different, clean device.

Why did a phishing email get through our spam filter?

Standard spam filters look for known bad links or attachments. Modern phishing emails often use "zero-day" links—meaning they were created five minutes ago and aren't on any blocklist yet. They also use legitimate services like Google Drive or Dropbox to host malicious files, which filters often trust by default. This is why human vigilance is still necessary.

Are Macs safer than PCs when it comes to phishing?

No. Phishing targets the user, not the operating system. If you enter your Microsoft 365 or Google Workspace password into a fake site on a Mac, the attacker has your credentials just as easily as if you were on a Windows PC. In my 26 years of doing this, I've seen just as many credential thefts on Macs as on PCs.

How often should we train our employees on phishing?

Once a year is not enough. I recommend monthly "micro-learning" sessions—5 minutes or less—combined with random phishing simulations. This keeps security at the front of their minds without burying them in technical noise. The goal is to build a culture where employees feel comfortable saying, "Hey Kevin, this email looks weird," rather than being afraid they'll get in trouble.

The Bottom Line

I’ve seen a lot change since 1999, but the vulnerability of the human element hasn't. You don’t need an enterprise-sized budget to protect your firm, but you do need to move beyond the assumption that "it won't happen to us." Start by verifying the requests you get, implementing MFA on every single account, and giving your team the tools to focus on essential email security. If you're overwhelmed by the technical side of this, that's where I come in. Cybersecurity should help you make better business decisions—not keep you up at night.