The Email Looks Real. The Decision Is the Trap.

The dangerous email is not necessarily the badly written one.

It might say, “Please make this payment today.” It might appear to come from your finance person. It might mention a real supplier. It might arrive when you are already late for another meeting.

The pressure is precisely what makes the decision difficult.

The question is not simply whether you can spot a suspicious email. The better question is: what should the business do when an urgent request could be legitimate but the cost of being wrong is high?

How do you decide whether an urgent request is real without relying on instinct alone?

NIST describes phishing as messages designed to trick people into opening harmful links, downloading malicious software, transferring funds, logging into accounts or submitting sensitive information. NIST recommends stopping when a message creates urgency and independently verifying the request using known contact information or a public company website rather than information supplied by the message.

NIST also recommends multi-factor authentication as an additional layer of protection beyond passwords.

Do not make employees responsible for deciding whether something is real when the consequences are expensive. Give them a verification process instead.

Ask four questions before acting.

1. Is the request unusual? New bank details, unexpected invoice, password request, urgent payment or unexpected attachment?
2. Is the request financially or operationally sensitive? The more consequential the action, the stronger the verification should be.
3. Is the sender applying urgency? Urgency does not prove fraud, but it is a reason to slow down.
4. Can the request be verified independently? Call the known phone number, open the vendor's known website instead of clicking the email, or contact the person through an established channel. Do not use contact details supplied by the suspicious message itself.

Create a company rule: no unusual payment, credential request or sensitive-data request is completed from a message alone. Verification must happen through a second, independently known channel.

That rule is deliberately boring. Boring is good. Security processes should not depend on someone being clever while under pressure.

Write a one-page internal policy defining what counts as an unusual request, who approves payments, how payment-detail changes are verified, how employees report suspicious messages, which accounts require MFA and where employees should go when uncertain.

Then rehearse the process with a harmless internal scenario. Do not use real credentials or real financial requests for testing.

A small business can reduce phishing risk by creating a verification process for unusual requests instead of relying only on employees to recognize suspicious messages. NIST recommends caution with urgent requests, independent verification through known contact information, employee training and MFA.

Treat verification as an operating control, not a personality test. If a decision can move money, credentials or sensitive information, build a second-channel verification step into the workflow.

Related reading: \2 · \2

Federal Trade Commission — Advertising FAQs: A Guide for Small Business. Material express and implied advertising claims need a reasonable basis and substantiation.

Evidence boundary: These sources support the underlying principles and context; they do not prove that one universal tactic works for every founder, market or company. SOE separates source evidence from editorial synthesis.