Recognising phishing: 7 signs and what to do when an employee has clicked anyway

Of all the ways an SME gets into trouble, the vast majority start with an email. Not a brilliant hacker breaking through your firewall, but a message that looks just real enough to click on. At companies of around fifteen people we see that pattern again and again. In this article we go through seven signs that give a phishing email away, and above all: what to do the moment someone has clicked anyway.

Why phishing is the main way into a small team

Attackers do not deliberately pick your company. They send the same email to thousands of addresses at once and wait to see who bites. An SME with fifteen employees has fifteen mailboxes, and therefore fifteen chances. There is rarely an IT department stopping everything, and everyone is busy. That is exactly what a phishing email counts on: you read it between two other things, on your phone, and you click.

In a small business, roles also sit close together: the person paying the invoices is two desks away from the owner. An email supposedly from the boss asking for a quick payment does not feel strange then. That is what makes invoice fraud so effective at SMEs.

Seven signs that give phishing away

No single sign is conclusive on its own, but anyone who knows these seven will catch the majority of suspicious messages.

1. The sender address is not quite right. The name looks correct, but the address behind it is a free email address or a domain with one letter too many or too few. Always look at the full address, not just the display name.
2. Pressure is applied. 'Pay today', 'your account will be blocked', 'urgent, I am in a meeting'. Urgency is the standard trick to make you act before you think.
3. The link goes somewhere other than the text claims. On a computer, hover your mouse over the link without clicking and look at the real address. On a phone, press and hold the link for a moment.
4. Different payment details. A supplier suddenly sending a new account number is the classic start of invoice fraud. Call the supplier on a number you already had, never on the number in the email.
5. Unexpected attachments. An invoice you were not expecting, a zip file, a document that asks you to 'enable content' or allow macros. Do not open it.
6. The language or tone is off. A colleague who suddenly addresses you formally, a supplier writing sentences that do not quite sound right, a greeting like 'Dear customer' where your name would normally be.
7. Two-step verification prompts you did not request yourself. If you get an MFA push notification while you are not signing in, someone is trying to get in with your password. Do not approve it, even if it keeps coming, and change your password straight away.

In doubt? Then the safest route is always the same: do not click, and have a colleague or your IT partner take a quick look at the message. That costs two minutes. A wrong click costs days.

What do you do when someone has clicked anyway?

It happens, even to attentive people. What counts is how fast you respond: the first hours make the difference between an annoying incident and a real crisis. Go through these steps in this order.

1. Do not blame anyone. People who feel ashamed report too late or not at all. Thank the employee and get to work.
2. Reset the password of the affected account immediately, and also everywhere the same password was reused.
3. Sign out all active sessions. In Microsoft 365 and Google Workspace an administrator can do that centrally. That way an attacker who is already in loses their access.
4. Notify your IT partner or the person who manages your IT. Explain exactly what happened: which email, which link, what was filled in.
5. Forward the phishing email to [email protected], the reporting point of the Centre for Cybersecurity Belgium. That helps others too.
6. Check the mailbox for forwarding rules. Attackers often set up a rule that quietly copies all incoming mail to an external address. Also look for unknown apps that were given access to the account.
7. Warn your colleagues, and if the account was abused, customers and suppliers too. The same email is probably sitting in their inbox as well.

Was a payment made? Then call your bank immediately. The sooner you do, the greater the chance the money can still be stopped.

Reporting must feel safe, and training should be short

Technology catches part of the phishing, but the last line of defence remains the person reading the email. That is why the culture in your team weighs more than any filter.

• Make it clear that reporting is always right, even for false alarms. Someone who reports ten harmless emails will also report the one that matters.
• Keep it simple: one address or one person where suspicious emails go. No form, no three-page procedure.
• Go for short, regular moments. A quarter of an hour at the team meeting with a recent example works better than one long training a year that everyone has forgotten by summer.
• Share real examples you received yourselves. Those stick, generic slides do not.

What we see at clients: where reporting is normal, the first report often comes within minutes of a phishing wave. Where it is embarrassing, we only hear about it once something has already gone wrong.