Blog Details

Most attacks on small businesses don’t start with clever hacking. They start with a convincing email, message or QR code, and someone in a hurry. This guide covers the scams we see most often at work, the warning signs, and the simple rules that stop them.

1. The invoice with “new bank details”

An email arrives from a regular supplier. Same name, same signature, same invoice format: “Our bank details have changed. Please pay the attached invoice to the new account before the end of the month.” The sender’s address is one letter different. Or worse, it really is the supplier’s mailbox, because their account was hacked. Year-end and month-end are favourite times, because accounts teams are busiest.

What stops it:

• The callback rule: confirm any change of bank details by phone, on a number you already have, never one in the email.
• Two people approve any change to supplier bank details.
• Tag outside emails: Microsoft 365 can mark emails from outside your company as “External”.
• MFA on every mailbox, especially accounts and finance.

2. The fake HR or policy email

“HR: New Leave and Salary Policy. Please review and sign by Friday.” The button opens what looks like a Microsoft sign-in page. A staff member enters their password, and the attacker now has their mailbox.

Warning signs: urgency and a deadline; a sign-in page after clicking a document link; a sender address that’s close to, but not exactly, your domain.

What helps: announce real policy documents in a meeting or on the intranet, not just by email; turn on MFA so a stolen password isn’t enough; and teach staff to report suspicious emails.

3. QR code and UPI payment scams

• A QR sticker placed over the real one at a counter or on an invoice.
• “Scan this to receive your refund”, which actually sends money.
• A call or message asking for your UPI PIN to “verify” a payment.

Rules worth sharing with everyone who pays vendors:

• You never need to enter your UPI PIN to receive money.
• Check the name shown before you approve any payment.
• Confirm new or changed payee details by phone, on a number you already have.
• Report suspected fraud quickly to your bank and to the National Cybercrime Helpline, 1930.

4. The 10-second phishing check

Before you click anything in an unexpected email, take ten seconds to check:

• The sender’s real address, not just the display name. Look for a domain that’s one letter off.
• The link destination: hover over it (or press and hold on a phone) and read where it really goes.
• Urgency or secrecy: “today”, “urgent” and “keep this quiet” are warning signs.
• A request to sign in, pay or change details after clicking a link.

5. The boss who never called: deepfake voice and WhatsApp scams

A WhatsApp voice note from the managing director: “I’m in a meeting, can’t talk. We need to pay a new supplier today or we lose the deal.” The voice was cloned from a short clip of a conference talk. AI makes voices, photos and even video calls easy to fake, so the defence isn’t spotting the fake. It’s a process that doesn’t depend on recognising anyone:

• The callback rule: any request to pay, change bank details or buy gift cards gets a call back on a number you already have.
• Two people approve new payees and bank detail changes.
• Urgency is a warning sign: “today”, “confidential” and “don’t tell anyone” mean slow down.
• A code word: some teams agree a phrase for genuine urgent payment requests.

6. Festive and sale-season scams

• The fake courier: a message says a parcel is stuck and asks for a small redelivery fee. Couriers don’t ask for fees through random links; check the official app instead.
• The free voucher: “HR is giving every employee a gift voucher. Log in to claim it.” The login page steals Microsoft 365 passwords. Confirm any company gift with HR directly.
• Copycat shopping sites: “90% off, today only” sites that take card details and deliver nothing.

Simple rules for the team: personal shopping on personal devices; type a shop’s address yourself instead of following links; and if a work password was entered somewhere odd, tell IT straight away, with no blame.

How to report a phishing email in Outlook

Deleting a suspicious email protects one inbox. Reporting it can protect everyone. In new Outlook, Outlook on the web and recent versions of classic Outlook for Microsoft 365:

1. Select the email, without clicking links or opening attachments.
2. Click Report on the ribbon.
3. Choose Report phishing.

The email is removed from your inbox and, depending on your settings, sent to your IT team and Microsoft. Your IT team can then find the same email in other mailboxes and block the sender for everyone. If you don’t see the Report button, ask your IT team: it’s built into Microsoft 365 and can be switched on centrally.

And if you’ve already clicked a link or typed a password, tell IT straight away. Fast is better than embarrassed.