How to Spot Phishing Emails Before They Cost Your Business Money

Almost every article on how to spot phishing emails still leads with spelling mistakes and odd greetings. That advice is a decade out of date, and following it is now actively dangerous, because it trains your staff to approve anything that reads well. The messages that take real money from real businesses are grammatically clean, correctly branded, and often sent from a mailbox that genuinely belongs to a company you work with. The FBI IC3 2025 Internet Crime Report recorded $3,046,598,558 in business email compromise losses in a single year — the second-largest loss category in the entire report.

RANGO Technologies supports small and mid-size businesses across Miami-Dade and Broward County from our office in Miami Lakes. This article does two things. It replaces the typo checklist with the signals that still hold up in 2026, and then it argues that detection by eye is the weaker half of the defense. The stronger half is a written verification process that works even when the email is convincing, because sooner or later one will be.

Table of Contents

• Why the Typo Test Stopped Working
• The Signals That Still Work
• Verification Is the Control, Not Inspection
• The Attacks That Get Past MFA
• Making the Process Stick in a Small Team
• What to Do This Week

Why the Typo Test Stopped Working

Modern phishing reads like your vendor wrote it

Three things changed. Phishing kits now clone a login page perfectly, including the logo, the favicon and the password-reset flow. Generative writing tools removed the language errors that used to give non-native senders away. And a growing share of attacks are not sent from a lookalike domain at all — they are sent from a real, compromised mailbox belonging to a supplier, a client or a law firm, arriving inside a thread you started.

That last case defeats every visual check simultaneously. The sender address is correct because it is the correct sender. The signature is right. The thread history is real. The only thing that is wrong is the instruction.

Why "check the sender address" is not enough

Sender inspection catches the low end, and it is still worth teaching. But display names are trivially spoofed, internationalized characters can make a domain look identical at a glance, and on a phone most mail clients hide the underlying address entirely. Ask yourself how many of your staff read email primarily on a phone, and you have your answer about how reliable that check is in practice.

There is also a structural problem with training people to be suspicious of appearance. Appearance is what the attacker controls completely. The things the attacker controls poorly are context, timing and your ability to reach the real person through a different channel. Effective training moves attention to those.

The Signals That Still Work

An unexpected change of instruction

This is the highest-value signal in business email, and it is worth teaching as the single rule if you only teach one. Any message that changes where money goes, how someone is paid, which account to use, or where a document should be sent, is treated as unverified until confirmed by voice — regardless of how legitimate it looks and regardless of who appears to have sent it.

Bank detail changes, updated remittance instructions, a new payroll direct-deposit form, a request to redirect a refund: these are the shapes that BEC takes. The email does not need to be fake for the instruction to be fraudulent.

Pressure combined with channel control

Two features show up together in nearly every successful attack. The first is urgency — the payment is late, the deal closes today, the account locks in an hour. The second is subtler and more diagnostic: the sender steers you away from other channels. They are in a meeting, their phone is broken, please do not call, just handle it by email.

Legitimate urgent requests almost never come with a reason you cannot pick up the phone. When both appear in one message, treat the combination as the alarm, not the tone of the writing. The FTC's small-business cybersecurity guidance makes the same point about payment fraud: the pressure is the tell.

Where the link actually goes

Credential phishing still relies on getting someone to a fake sign-in page. The habit worth building is destination-first: hover on a desktop, long-press on mobile, and read the domain immediately before the first single slash. That is the real host. Everything after it can be made to say anything, including your company name.

Two specific patterns deserve naming. A Microsoft 365 sign-in prompt that appears after clicking a link in an email is almost always worth abandoning — go to the site directly instead. And a legitimate file-sharing notification from a service you use will not need you to re-enter your password on a page you reached from the notification.

Verification Is the Control, Not Inspection

The out-of-band callback

Out-of-band verification means confirming a request through a different channel than the one it arrived on, using contact details you already hold. Not the number in the email signature. Not the number on the invoice. The number in your accounting system, from before this conversation started.

This one habit closes off most of the BEC category, including the compromised-mailbox version that no visual inspection can catch. It costs about ninety seconds. It is the highest return on effort available anywhere in small-business security.

A written payment-change protocol

Verification only survives contact with a busy Friday if it is written down and applies to everyone. A workable protocol for a small business fits on one page and specifies four things: which request types require callback, which phone number is authoritative and where it is stored, who is allowed to perform the verification, and what to do when the caller cannot be reached — which is to hold the payment, not to proceed and follow up later.

Include the owner explicitly. Attackers impersonate the person nobody feels comfortable questioning, and a protocol that quietly exempts leadership has a hole precisely where the attack aims.

A no-blame reporting path

The most expensive minutes in a phishing incident are the ones between someone realizing they clicked and someone telling you. Fear of blame buys the attacker time to change mailbox rules, register a device or move money. Say out loud, in writing, that reporting a click is never a disciplinary matter and that reporting a false alarm is a good outcome.

Give people one destination — a mailbox, a button, a phone number — and acknowledge every report. A reporting path nobody hears back from stops being used within a month.

The Attacks That Get Past MFA

Session token theft

An adversary-in-the-middle phishing page proxies the real login. You enter your password on what looks like the Microsoft sign-in screen, you complete the MFA prompt, and the attacker captures the resulting session cookie. They are now signed in as you without ever knowing your second factor. Changing the password afterwards does not evict them, because the session was already issued — the sessions have to be revoked explicitly.

This is why CISA's #StopRansomware Guide recommends phishing-resistant MFA for all services, particularly email, VPNs and accounts that access critical systems. Hardware security keys and passkeys bind the authentication to the genuine domain, so the proxy cannot complete it. Codes and push approvals cannot make that distinction.

Consent grants and mailbox rules

A quieter variant skips credentials entirely. The user is asked to approve an application's access to their mailbox — a document viewer, a scheduling tool, an invoice reader. Approving it grants a token that keeps working after a password change and does not trigger an MFA prompt again.

Whatever the entry method, the first action after a mailbox compromise is usually the same: a hidden inbox rule that files replies from the finance team into an obscure folder, so the victim never sees the questions being asked. Reviewing consented applications and auditing mailbox forwarding rules belongs in your Microsoft 365 configuration review, and the credential exposure that so often precedes these attacks is covered in how to protect your business from ransomware in 2026.

Making the Process Stick in a Small Team

Who owns what

Assign three roles by name, not by department. One person owns the payment-change protocol and keeps the authoritative contact list. One person receives phishing reports and decides whether to escalate. One person — or your provider — holds the ability to revoke sessions, reset credentials and pull sign-in logs quickly. In a fifteen-person company two of those may be the same individual, which is fine as long as it is written down.

Speed is the whole game after a click. The DBIR records third-party involvement in 48% of breaches, and a compromised mailbox in your business becomes the trusted sender in someone else's, so the clock matters beyond your own walls. Where clients want that response capability outside office hours, our MDR and XDR service covers it, and day-to-day the process sits inside managed IT services.

Training that is not an annual video

Annual compliance videos produce compliance, not behaviour. What changes behaviour is short, frequent and specific: a five-minute item at a monthly meeting using a real message your business received, with the sensitive parts removed. Run simulated phishing if you like, but measure the reporting rate rather than the click rate — a team that clicks occasionally and reports instantly is in far better shape than one that clicks rarely and says nothing.

For context on where phishing sits relative to your other exposures, see the top cyber threats targeting small businesses in 2026.

What to Do This Week

Three actions, in order. Write the payment-change protocol and get the authoritative phone numbers into one place. Tell your team, in writing, that reporting a click carries no consequence. Then start moving your administrators, your finance staff and your owner to phishing-resistant MFA, because that is what holds when a message is good enough to fool a careful person.

Detection by eye will keep catching the easy ones, and it is still worth teaching. It is not a defense you can build a business on, because the attacker chooses how the message looks and you do not. Process is the part you control.

If you would like someone to review how your email is configured and where the gaps are, a free IT assessment from our cybersecurity team covers exactly that. Request a free IT assessment. Every engineer who would look at your environment is based in South Florida. Call (305) 901-8990, Monday through Friday, 8:00 AM to 5:00 PM ET.