EMAIL SECURITY GUIDE
How to spot phishing and business email compromise
A practical guide to recognizing deceptive messages, verifying sensitive requests and responding before the damage spreads.
A convincing email does not need malicious software to cause serious harm. An attacker may imitate a supplier, executive, employee or financial institution and ask someone to change banking details, purchase gift cards, disclose information or sign in through a fraudulent page.
Small businesses are especially exposed when employees move quickly, financial approval depends on one person or important requests are trusted because the sender’s name looks familiar. Protection requires both technical controls and a repeatable verification process.
Phishing, account takeover and business email compromise
Phishing uses deceptive messages to make a person click, sign in, open a file, disclose information or send money. Account takeover occurs when an attacker gains access to a real mailbox or cloud account. Business email compromise uses impersonation or a compromised account to manipulate a trusted business process, often invoicing, payroll, purchasing or payment.
A BEC message can come from a genuine account and may contain no suspicious attachment. That is why spam filtering alone is not enough: employees must verify the requested action, not just the appearance of the message.
Ten warning signs to slow down and verify
A new or changed payment destination
Treat any request to change banking, payroll or electronic-transfer details as high risk—even when it appears inside an existing conversation.
Unusual urgency or secrecy
Messages may pressure the recipient to act immediately, avoid normal approval or keep the request confidential.
A slightly altered sender address
Look beyond the display name. Attackers may substitute a letter, add a word or use a different domain that looks similar at a glance.
A link that does not match its destination
On a computer, hover over a link before opening it. On mobile, use extra caution because the full destination may be hidden.
An unexpected sign-in or document-sharing page
Instead of using the message link, open the known service directly from a saved bookmark or verified address.
An attachment you were not expecting
Confirm unexpected invoices, shared documents, voice messages and compressed files through a separate trusted channel before opening them.
A request for passwords or verification codes
Legitimate administrators and support staff should not ask employees to send passwords, MFA codes or recovery codes through email or chat.
Language or timing that does not fit the sender
Changes in tone, signature, working hours, request type or approval process can be important clues, although polished language does not prove legitimacy.
An unexpected MFA prompt
Do not approve a sign-in you did not initiate. Repeated prompts may indicate that someone already has the password.
A request that bypasses normal controls
Be cautious when someone asks to use a personal account, avoid a purchase system, skip a second approval or communicate only by email.
Verify the action, not the email
For payments, payroll, confidential data, password resets and account changes, confirm the request through a known phone number, approved business chat or established workflow. Do not use contact details supplied inside the suspicious message.
A safe verification process
Controls that reduce email-fraud risk
Use phishing-resistant MFA where available
Protect every mailbox, especially administrators, finance staff and executives. Passkeys or security keys can provide stronger resistance than approval prompts or SMS.
Protect your domain
Configure SPF, DKIM and DMARC for every legitimate email-sending service. Monitor results before moving carefully toward stronger DMARC enforcement.
Require independent financial verification
Confirm new suppliers and changes to payment or payroll details through a trusted channel. Use two-person approval above an appropriate threshold.
Limit mailbox and administrator privileges
Use separate administrator accounts, review forwarding rules and delegated access, and remove access promptly when roles change.
Train with realistic examples
Teach employees how to report suspicious messages without embarrassment or delay. Include impersonation, QR codes, fake sharing notices and payment changes.
Monitor and prepare
Review security alerts and sign-ins, maintain accurate contact lists and document who handles suspected compromise, fraud and privacy incidents.
If someone clicked, signed in or sent money
Report the incident immediately. From a known-clean device, protect the affected account, reset credentials, revoke sessions, review MFA methods, inspect inbox and forwarding rules, and check for unauthorized administrator or application access. Preserve the original messages, headers, timestamps and relevant logs.
If money was transferred or financial details were disclosed, contact the financial institution immediately and ask about stopping or recalling the transaction. Notify affected suppliers or customers through trusted contact information. In Canada, suspected fraud can also be reported to the Canadian Anti-Fraud Centre; serious or active incidents may require law-enforcement, privacy, insurance and legal notification based on the circumstances.
Official guidance and next steps
The Canadian Centre for Cyber Security recommends recognizing common phishing indicators, confirming requests through another communication method and reporting suspicious messages. The Canadian Anti-Fraud Centre provides reporting channels for fraud and cybercrime, while CISA emphasizes MFA, staff awareness and careful handling of suspicious communications.
Review official guidance from the Canadian Centre for Cyber Security, the Canadian Anti-Fraud Centre and CISA’s phishing guidance. Related CommzzTech resources include the small-business cybersecurity checklist and Microsoft 365 security checklist.
Important: This article provides general information. Incident-response, privacy, legal, insurance and reporting requirements depend on the facts and jurisdiction. Obtain appropriate professional advice for significant incidents.
NEED STRONGER EMAIL PROTECTION?
Combine technical controls with a clear verification process.
CommzzTech can help review email security, access, payment-change procedures and incident readiness for your business.