You get an email from your bank saying there's a problem with your account. Or a text saying a package couldn't be delivered. Or a message from your boss asking you to quickly grab some gift cards for a client. Each one feels urgent, familiar, and harmless enough to act on. That's exactly the point.
Phishing is the most common cyber threat people face today, and it’s getting harder to spot. It’s also one of the oldest and most effective tricks in the digital world. Understanding how it works is the single best defense most people and small businesses have.
What Phishing Actually Is
Phishing is a scam where someone pretends to be a trusted person or organization to get you to do something you normally wouldn't: click a link, open an attachment, enter a password, share personal information, or send money.
The name comes from "fishing." The scammer casts out bait and waits for someone to bite. Instead of breaking into your systems with sophisticated code, they simply ask you to open the door for them.
Phishing comes in several forms:
- Email phishing is the classic version: fake messages from banks, retailers, delivery companies, or software providers.
- Smishing uses text messages, often about packages, toll payments, or account alerts.
- Vishing happens over the phone, where a caller poses as tech support, a bank, or a government agency.
- Spear phishing targets a specific person using details about their job, coworkers, or habits to make the message more convincing.
- Business email compromise impersonates an executive, vendor, or partner to redirect payments or request sensitive data.
Real Examples That Made Headlines
Phishing isn't just a problem for people who "don't know better." Some of the largest and most technically sophisticated companies in the world have been caught.
Google and Facebook lost over $100 million to fake invoices.
Between 2013 and 2015, a man in Lithuania set up a company with the same name as a real Asian hardware manufacturer both companies did business with. He sent convincing invoices, contracts, and letters, and employees paid them. He later pleaded guilty and was sentenced to prison. The lesson: no company is too big or too smart to be fooled by a well-crafted request that looks routine.
The 2020 Twitter hack started with a phone call.
Attackers called Twitter employees, posed as internal IT staff, and convinced them to enter credentials on a fake login page. With that access, they took over high-profile accounts and posted a cryptocurrency scam that collected money from thousands of followers within hours.
MGM Resorts was disrupted after a help desk call.
In 2023, attackers reportedly found an employee's information online, then called the company's IT help desk pretending to be that person. That single conversation helped them gain access, leading to widespread outages across hotels and casinos and an estimated loss in the tens of millions.
The Everyday Versions You're More Likely to See
Most phishing attempts aren't headline-making. They show up in ordinary inboxes and phones every day:
- A text claiming your package is on hold and asking you to "confirm your address" through a link
- An email that looks like it's from Microsoft 365 or Google saying your password expires today
- A message from a "vendor" saying their bank details have changed and future payments should go to a new account
- An email from your "CEO" or "manager" asking for gift cards, a wire transfer, or W-2 information
- A voicemail from "the IRS" or "Social Security" threatening legal action unless you call back immediately
- A shared document link from someone you know, sent from an account that has already been compromised
Warning Signs to Watch For
Phishing messages tend to share a few telltale traits:
- Urgency or pressure. "Act now," "your account will be closed," "this needs to be done before end of day."
- A sender address that's slightly off. Look for misspellings, extra characters, or a free email account pretending to be a business.
- Links that don't match. Hover over a link (or press and hold on a phone) to see where it actually goes before clicking.
- Unexpected attachments, especially invoices, shipping documents, or files you didn't request.
- Requests for credentials, payment, or personal data through email or text.
- A change in how someone normally communicates, such as a new tone, unusual timing, or a request that bypasses normal process.
Verify my account
How Not to Fall Victim
- Slow down. Urgency is the scammer's best tool. Taking even thirty seconds to pause and think defeats a large share of phishing attempts.
- Verify through a separate channel. If an email asks you to change payment details or send money, call the person or company using a phone number you already have, not the one in the message.
- Go directly to the source. Instead of clicking a link about your account, open a new browser window and log in the way you normally would.
- Turn on multi-factor authentication. Even if a password is stolen, a second verification step can stop an attacker from getting in.
- Keep software updated. Updates often patch vulnerabilities that malicious attachments and links try to exploit.
- Train your team. For businesses, regular awareness training and simple internal rules, like "we never change vendor banking info by email alone," go a long way.
- Report it. If something looks suspicious, report it to your IT provider or email administrator. If you clicked something you shouldn't have, say so right away. Fast action limits damage.
The Bottom Line
Phishing works because it targets people, not technology. The good news is that people can also be the strongest line of defense. A healthy habit of pausing, questioning, and verifying will protect you better than almost any tool on its own.
When in doubt, don't click. Check first.
PointTech Pros helps individuals and small businesses protect their devices, data, and accounts. If you're unsure about a suspicious message or want to strengthen your security habits, reach out to our team.
Frequently asked questions
How can a small business protect itself from phishing?
+
The best protection is several layers working together, not a single tool. That means email filtering to block suspicious messages, multi-factor authentication on every account, regular software updates, staff training and simple internal rules, like never changing payment details based on an email alone. PointTech Pros can review your current setup and show you where the gaps are.
Can scammers send emails pretending to be my business?
+
Yes. Without the right settings, scammers can send emails that appear to come from your business's email address, even if your account was never hacked. They use this to trick your customers, vendors and employees. Three email authentication records, called SPF, DKIM and DMARC, help prevent it, but many small businesses have never had them set up. PointTech Pros can check your domain and configure them for you.
Can my business website be used in a phishing attack?
+
Yes. Hackers often break into small business websites through outdated software, plugins or weak passwords. They then use the site to host fake login pages or send scam messages, and your business's name and reputation get attached to the attack. Keeping your website updated, secured and monitored helps prevent this. PointTech Pros can review your website and modernize it with security built in.
What should my business do if an employee clicks a phishing link?
+
Act quickly. Have the employee disconnect the device from the internet, change the password for any account they entered, and report it to your IT provider right away. If payment information or money was involved, contact your bank immediately. The faster you respond, the less damage a phishing attack can do. If you don't have an IT provider to call, PointTech Pros can help.
Is my small business too small to be targeted?
+
No. Small businesses are frequent targets because they often have fewer protections than large companies but still handle money, customer data and vendor payments. Scammers send phishing messages to thousands of businesses at once, so size doesn't keep you off the list.
How do I train my employees to spot phishing?
+
Start by teaching the warning signs: urgency, unfamiliar sender addresses, mismatched links, unexpected attachments and unusual requests for money or information. Repeat the training regularly, not just once. Make it easy and judgment-free for employees to report a suspicious message. PointTech Pros offers security awareness training for small business teams.
How can I tell if an email is a phishing scam?
+
Look for pressure to act fast, a sender address that doesn't quite match the company, links that go somewhere unexpected when you hover over them, and requests for passwords, payment or personal information. When in doubt, contact the company directly using a phone number or website you already trust.
What is the difference between phishing, smishing and vishing?
+
They are the same scam delivered in different ways. Phishing usually arrives by email, smishing arrives by text message, and vishing happens over a phone call or voicemail. All three try to get you to click, share information or send money.
How do I report a phishing email or text?
+
Forward phishing emails to reportphishing@apwg.org, and forward scam texts to 7726 (SPAM). You can also report scams to the Federal Trade Commission at ReportFraud.ftc.gov. If you lost money, contact your bank right away and file a report with the FBI at ic3.gov. Inside a business, always report it to your IT provider too.
This article is provided for general informational purposes only and does not constitute professional, legal or security advice for any specific situation. No security measure can guarantee complete protection. Company names and trademarks mentioned are the property of their respective owners and are used for informational purposes only; their mention does not imply any affiliation with or endorsement of PointTech Pros. Example messages shown are fictional illustrations created for educational purposes.
