Is This Email a Scam? A 60-Second Check for Small Business Owners

You’re busy. An email lands that looks almost right — a bill from a vendor, a warning that your account is locked, a note from the boss asking you to buy gift cards real quick. Something feels off, but you’re not sure, and you don’t have time to become a cybersecurity expert.

Good news: you don’t need to be one. Most scam emails fail the same handful of simple tests. Here’s the check I give my own clients. It takes about a minute.

First, slow down. Urgency is the whole trick.

Almost every scam email is built to make you act before you think. “Your account will be closed in 24 hours.” “Payment is overdue — pay now to avoid penalties.” “I need this done immediately, I’m in a meeting.”

That pressure isn’t a coincidence. It’s the scam. Real companies and real coworkers give you time. The moment an email is rushing you, treat it as suspicious until proven otherwise. That instinct alone will stop most of them.

Check who actually sent it (not just the name)

The sender’s display name is easy to fake. The email address behind it is much harder.

Click or tap on the sender’s name to reveal the real address. Then look closely:

Does it match the company it claims to be from? A real message from your bank won’t come from security-alert@mail-verify-account.com.
Look for small misspellings meant to fool a quick glance — micros0ft.com with a zero, amaz0n-support.net, your vendor’s name with an extra letter.
Is it a business claiming to be a big company but writing from a free Gmail or Outlook address? Real vendors use their own domain.

If the address doesn’t cleanly match who they say they are, you’re done. It’s a scam.

Hover before you click. Always.

Scam emails want you to click a button or link that takes you somewhere dangerous. Before you click anything, hover your mouse over the link (on a phone, press and hold) to preview where it actually goes.

If the email says it’s from your bank but the link points to some random web address you don’t recognize, don’t click it. When in doubt, don’t use the email’s link at all — open your browser and type the company’s real website in yourself.

Watch for the classic setups

A few scams show up again and again for small businesses. If an email matches one of these, be extra careful:

The gift card request. “Boss” emails you asking you to quietly buy gift cards and send the codes. No legitimate boss has ever needed this. It’s always a scam.
The fake invoice. A bill for something you don’t remember ordering, hoping you’ll just pay it. Check with whoever handles your purchases before paying anything unexpected.
The “your account is locked” panic. A login page that looks real but is built to steal your password. Never log in through an email link — go to the site directly.
The changed bank details. A vendor “updates” their payment info by email right before a payment is due. Always confirm account changes by calling a number you already have, not one from the email.

When you’re not sure — don’t guess

Here’s the honest truth: some scams are genuinely good now, and even careful people get fooled. If an email passes these checks but still feels wrong, trust that feeling.

The safest move is always the same: don’t reply, don’t click, and verify through a channel you already trust. Call the vendor at the number on a past invoice. Walk over and ask your coworker in person. Type the company’s website in yourself instead of using their link.

Thirty seconds of verifying beats days of cleaning up a drained account.

If it already happened

If you clicked something or entered a password and now you’re worried, act quickly but don’t panic:

Change the password for that account right away — and anywhere else you used the same one.
Turn on two-factor authentication (that extra code sent to your phone) if it isn’t already on.
If money or bank details were involved, call your bank now.
Get a professional to check that nothing was left behind.

The bottom line

You don’t need to fear your inbox — you just need a habit. Slow down, check who really sent it, hover before you click, and verify anything that involves money or passwords. That covers the overwhelming majority of what comes at a small business.

I’m Roger, a software engineer based in Bothell, and I help small businesses around the Seattle area handle their technology without the jargon or the fear. If you’d like a second set of eyes on your business’s security — or you just want someone to forward the sketchy emails to — book a free 30-minute call and let’s talk. No pitch, just straight answers.