A suspicious work message: what to check before you click

A message arrives while you are juggling customers and a deadline. It appears to concern an overdue invoice, a shared document or an account problem. Before you follow its instructions, separate two questions: does the message look familiar, and have you independently confirmed the request?

For a small business, the useful habit is a short pause followed by a known way to check. You do not need to prove that a message is fraudulent before asking for help.

Check the request before the appearance

The Federal Trade Commission warns that business scammers impersonate trusted organizations and use urgency to push people into paying or sharing sensitive information. Its small-business scam guide also cautions against unexpected links, attachments and downloads.

Ask what the sender wants you to do. Is this an expected task? Does it change an established payment arrangement? Are you being asked to sign in somewhere unfamiliar or send confidential information? Treat a demand to bypass the usual process as a reason to stop and verify.

A recognizable name or logo does not settle the question. Check the actual sender address for obvious differences, but do not make visual inspection your only safeguard. The decision should depend on confirming the request through a route you already trust.

Start a separate conversation

The FTC's phishing guidance recommends contacting a company through a phone number or website you know is genuine, rather than using contact details supplied in the suspicious message.

In practice, call a colleague through the staff directory or contact a supplier using a number already held in your business records. Open an established bookmark or the service's normal app if you need to check an account notice. Avoid replying to the questionable message to ask whether it is real.

For example, if a familiar supplier appears to request new bank details, pause the change. Ask the person responsible for payments to confirm the request through the business's established verification procedure. This is an illustrative workflow, not a report of an incident at a named company.

If you cannot reach the right person, leave the request pending. A deadline in a message should not replace the business's approval process.

Report uncertainty through the agreed route

Use your organization's designated reporting button or contact your IT provider or named security contact. Explain what arrived, when it arrived and whether you interacted with it. Ask how to preserve the message for review before deleting it. Do not circulate suspicious attachments to colleagues as a warning.

The UK's National Cyber Security Centre accepts reports of suspicious emails even when the recipient is unsure whether they are scams. Its guidance says to avoid opening links in those messages. For US readers, the FTC's phishing page explains its reporting options.

For workplace messages, follow the organization's reporting and confidentiality rules before forwarding content to an outside service. Do not paste customer records, passwords or confidential correspondence into a public checker or an unapproved AI tool. These are privacy recommendations for the workplace, rather than claims about any particular tool.

If you already interacted, say so promptly

Tell the designated contact whether you opened a link, downloaded a file, entered information or authorized a payment. Be specific about what happened without sending passwords or verification codes. Let the responsible team guide account recovery, device checks and any bank contact through trusted channels.

Owners can make that response easier by naming a reporting contact, providing a backup when that person is unavailable and welcoming uncertain reports. A brief staff exercise can rehearse the same sequence: pause, verify separately and report. The aim is a repeatable work habit, with a clear person to help when the answer is unclear.