The Email Looked Real. That's the Whole Problem.

By Jordan Polasek · July 6, 2026

A while back, an office manager I know got an email from her boss. Short, polite, a little rushed: "Hey, are you at your desk? I need you to take care of a payment quickly, I'm in a meeting." The name was right. The signature was right. The tone was right. She almost replied before something small nagged at her — the boss never emailed her from that address.

She called him instead. He was, in fact, in a meeting. He had also never sent that email.

That's the thing about the scams hitting small businesses today. They don't look like the clumsy "Nigerian prince" messages we all learned to laugh at. They look like a normal Tuesday. And that's exactly why they work.

The scam isn't technical anymore — it's human

Most people picture hacking as some hooded figure breaking through a firewall. In reality, the easiest way into a business isn't the computer. It's the person sitting at it.

The playbook is almost always the same three ingredients:

• Authority. The message looks like it's from the boss, the bank, a vendor, or the IRS.
• Urgency. "Do this now." "Before end of day." "I'm about to board a flight."
• A quiet ask. Pay this invoice. Update these bank details. Click here to log in. Buy some gift cards.

Stack those three together and you short-circuit the part of the brain that would normally pause and think. That pause is the whole ballgame. Scammers spend all their energy trying to erase it, and increasingly they've got better tools to do it — cleaner writing, real logos, even voice on the phone that sounds like someone you know. You don't need to understand the technology behind that. You just need to stop trusting how something feels and start trusting how you verify it.

The one habit that stops almost all of it

If I could install a single reflex in every employee at every business I work with, it would be this:

When money or passwords are involved, verify on a second channel. Every single time.

That's it. If an email asks you to send a payment, change where a vendor's money goes, or log into something — you don't reply to the email. You pick up the phone and call the person on a number you already have. Not the number in the email. The one in your contacts.

Got a text from "the bank" about suspicious activity? Hang up and call the number on the back of your card. Got an invoice with new wire instructions? Call your vendor's main line and ask. It feels almost rude to double-check. It isn't. Any real boss, bank, or vendor would rather get a 20-second confirmation call than watch you send $9,000 to a stranger.

The scam depends on you staying inside the channel it controls. The second you step outside it, the whole thing falls apart.

A few tells that give it away

Once you slow down, the cracks usually show. Things I'd teach anyone on my team to notice:

• **The address is almost right.** billing@microsft-support.com. yourboss@gmail.com when your boss uses a company address. Hover over the sender before you trust the display name.
• The link doesn't go where it says. Hover over it (or press-and-hold on your phone) and read the real destination before you tap.
• The request skips the normal process. Your company doesn't usually pay invoices by same-day wire, or your boss doesn't usually ask for gift cards — because no one does.
• It pushes you to keep it quiet or hurry. "Don't loop in accounting yet." "Just handle it." Secrecy plus speed is a giant red flag.

None of these require you to be technical. They just require you to be a little skeptical when your money or your login is on the line.

What to do this week

You don't need new software to get most of the way there. You need a shared habit. This week:

• Say the rule out loud to your team. "Any request for a payment, a bank-detail change, or a password gets verified by phone first. No exceptions, no matter who it looks like it's from."
• Give people permission to slow down. Tell your staff you will never be upset that they called to confirm — even if it was really you. Remove the fear of looking paranoid.
• Turn on multi-factor authentication on email and banking if you haven't. It's the seatbelt that catches you when someone does slip.
• Pick your verification numbers now, while it's calm — the real cell numbers and vendor lines — so no one is hunting for them in a panic.

Security for a small business isn't really about fancy tools. It's about building a culture where pausing to check is normal and expected, not something you apologize for.

If you'd like a second set of eyes on your setup — email protection, MFA, or just a plain-English walkthrough of where your business is exposed — that's the kind of thing we do every day at BVTech. No jargon, no scare tactics. Just helping good people not get caught by a very ordinary-looking email.

Stay skeptical, and call the boss.

— Jordan Polasek