Week 5 · Monday
Phishing in emails, texts, links, and QR codes
Recognize suspicious requests in email, texts, and QR codes, and use a trusted route to check before sharing information or signing in.
Imagine you are getting ready to open your business when a text says your booking account will be suspended unless you verify your details immediately.
The service name is familiar. You have appointments today. Taking a moment to deal with the message feels sensible.
That is exactly the kind of situation worth slowing down for. The useful question is whether the request is real, and you can check without following the route the message provides.
Last week, we looked at your responsibilities when using cloud services. This week, we will practice protecting the accounts, information, and payments behind that work.
What phishing means
Phishing is a deceptive message intended to get you to reveal information, open something harmful, or take an action that helps a scammer. It may arrive as an email, a text, or a message in a service you already use.
A message might claim there is a payment problem, a shared document waiting for you, or a delivery that needs attention. The FTC describes these familiar stories as ways to prompt a click or a response. FTC: Recognizing phishing scams.
You do not need to memorize every scam. Start with what the sender wants you to do.
Signing in, supplying a payment card, sending a verification code, downloading a file, and changing payment details all deserve attention when the request arrives unexpectedly.
Look at the request as well as the message
A warning sign is a reason to pause. It does not, by itself, prove a message is fraudulent.
| What you notice | What to check |
|---|---|
| A threat that a service will stop today | Does the issue appear when you open the service through your normal route? |
| An unexpected file or request to sign in | Were you expecting this work, and can the sender confirm it through an established contact? |
| A familiar name asking for something unusual | Is this the person's actual request, and does it follow your business process? |
| A link or sender address that looks slightly wrong | Does it match the address you already have on file? |
| Pressure to keep the request secret | Who should normally review or authorize this action? |
Spelling mistakes can be a clue, but polished wording is not proof of authenticity. A recognizable logo or the name displayed above an email is not enough to authorize the action either.
For example, imagine an employee receives a message labeled “Owner” asking for account access while you are with a customer. The employee does not need to decide whether the message looks professional. They need a way to reach you and confirm the request before changing access.
A link has a destination
The words displayed on a link and the page it opens can differ. A button labeled “View invoice” does not tell you who operates the destination.
On a computer, hovering over a link may reveal its address without opening it. Interfaces vary, especially on phones. Do not tap a questionable link just to investigate it.
Checking an address can reveal an obvious mismatch, but recognizing a few familiar words is not a complete safety check. The FBI warns that small changes to addresses can make fraudulent messages look legitimate. FBI: Business email compromise.
If you cannot confidently explain where a link goes, leave it alone and use a route you already trust.
A QR code needs the same judgment
A QR code is a square pattern that a phone can read. It can hold information such as a website address. Scanning the pattern does not establish that the destination belongs to the business you expect.
The FTC warns that scammers can replace physical QR codes or send unexpected ones that lead to imitation websites. FTC: Harmful links hidden in QR codes.
If your phone offers a destination preview, check it before opening the page. If a code appears altered, arrives unexpectedly, or asks you to sign in to resolve an urgent problem, verify the request separately.
For a local shop using a QR code on a counter sign, a practical habit is to check that the sign is still yours and that its destination is the one you intended. Staff should know where to report a change.
Verify through a route you already trust
Return to the opening example. Instead of using the text's link, open the booking app you normally use or a saved bookmark you have previously verified. Look for the claimed account issue there.
If you need help, use the provider's contact details already held in your business records. For a supplier or coworker, use an established number. Replying to the suspicious message, or calling the number inside it, keeps the check within the sender's control.
This is the same independent contact approach the FTC recommends for suspicious messages from a company you recognize.
If the normal app shows no issue, that is useful information to give support. It does not mean you must resolve the uncertainty by trying the suspicious link.
Make reporting easy
Choose one person or trusted IT contact to receive suspicious-message reports. Give employees a backup contact for times when that person is unavailable.
Use your email service's reporting feature or the reporting method your IT provider specifies. Avoid circulating a live suspicious link to the whole team as a warning. A short description can explain the concern without inviting more clicks.
Tell staff that reporting is welcome even if they have already clicked. Waiting to be certain about a mistake can delay the help the business needs. Friday's article will explain the next steps.
A ten-minute exercise for your business
Choose one important service, such as email, booking, or invoicing.
- Write down the app or verified bookmark your team should use to reach it.
- Find its support contact in records you already trust.
- Name the person who receives suspicious-message reports, plus a backup.
- Discuss this fictional prompt: “Your account closes today. Follow this link to keep it open.”
- Have each person explain how they would check the claim without opening the link.
Use a written scenario with no working link. The result should be a clear verification route, not a test of who can spot the most spelling mistakes.
Your takeaway: Treat an unexpected request as something to verify. Reach the person or service through a known route before you sign in, share information, or act.
On Wednesday, we will apply that habit to fake invoices, payment changes, and calls that sound like someone you know. Follow the Small Business Learning Series.