The 5 emails that hack small businesses

It shows up on a Tuesday at 9:47 a.m., wedged between a supplier invoice and a customer question. It looks like the forty other emails your office manager will open today. That is the entire trick. Nobody hacks a small business with genius code anymore — they hack the person reading email between phone calls.

The five, ranked by how often we see them

1. The fake invoice. A PDF or a link, a vendor name one letter off from a real one, an amount small enough that nobody escalates it. Sometimes it comes from a real vendor whose mailbox was compromised — meaning the address is one you have actually paid before. The goal is either malware in the attachment or quietly swapped banking details on the remittance page.

2. The boss who needs gift cards. An email or text that looks like it came from the owner: are you at your desk, I need a favor, keep it between us. It ends with an employee at a checkout buying gift cards or wiring a deposit. It works because employees don't ask the boss follow-up questions, and the sender is counting on exactly that.

3. The password reset you didn't request. Unusual sign-in detected, verify your account now. The login page is a pixel-perfect copy of Microsoft or Google. Type your password there once and someone else owns your email — and email is the master key to everything else you log into.

4. The shared document. Someone shared a proposal with you, click to view. One click, one fake login screen, same result as number three. These spike whenever businesses are genuinely swapping files — proposal season, tax season, real estate closings — because that's when the lure looks normal.

5. The payroll switch. A polite note to whoever runs payroll, sent in an employee's name, asking to update direct-deposit details before Friday. Nothing to click. No malware. Nothing for antivirus to flag. Just a paycheck that lands in a stranger's account.

Why smart people click

None of these target stupidity. They target rhythm. Your team processes dozens of routine requests a day, and these are engineered to look routine — right sender name, right timing, the right level of mild urgency. Friday afternoons and Monday mornings are prime time, and so is right now: late September, when Q4 planning has everyone moving fast and approving things from their phones.

What actually stops them

• Email security that filters and flags lookalike senders before a human ever sees them
• MFA on every mailbox, so a stolen password isn't enough on its own
• A standing rule: any banking or payroll change gets confirmed by voice, on a number you already had on file
• A culture where reporting a suspicious email takes ten seconds and nobody gets mocked for asking

That verbal-confirmation rule costs nothing and beats most wire fraud by itself. Write it down. Tell your bookkeeper today, not at the next staff meeting.

Cyber Alamo runs managed email security, MFA, and 24/7 monitoring for Florida businesses on Google Workspace, Microsoft 365, and Proton — and we train teams on exactly these five emails, with real examples. If you'd like to know which of the five would get through your setup as it stands today, book the free assessment and we'll show you.