Phishing Emails: 5 Checks for Calgary Businesses

Around lunchtime, an email comes through. It might look like a supplier, asking your accounts department to pay an overdue invoice using new banking details.

The name looks familiar. The signature looks right. There is even a gentle reminder that payment is overdue.

So would your team change it or call the supplier first?

Email security at the Calgary business level breaks down to decisions such as this — on a much more regular basis. Phishing messages encourage people to disclose information, open malware, and take steps that benefit an attacker. These tactics are further described by the Canadian Centre for Cyber Security in its guide to spotting phishing attacks.

These five patterns are what your team can refer to when deciding whether or not they should pause and check if a request is justified.

1. Look beyond the sender’s display name

An email displaying your manager’s name does not mean your manager sent it.

Open the sender details and check the full email address. Look for an unfamiliar domain, a slight spelling difference, or an address that does not match the organisation the sender claims to represent.

The Cyber Centre’s email security guidance recommends checking the sender’s credibility and verifying domain names.

Even a familiar address should not end your checks. As the Cyber Centre’s phishing guidance explains, a compromised account can send phishing messages to existing contacts.

Ask whether the request makes sense. Would this person normally ask you to send that information or approve that change?

2. Treat unexpected urgency as a reason to verify

Picture this coming through just as you are about to head into a meeting:

“Your mailbox will be deactivated in 30 minutes. Confirm your password now.”

The short deadline gives you little time to think. That pressure is a reason to pause and verify the request.

Even if you get an alert asking to sign in, go directly to the service via your accepted app or a saved bookmark. Do not click on the link in the email to check if the caution is genuine.

The Cyber Centre advises against clicking links, opening attachments, or scanning QR codes in unsolicited account-login requests. See its guidance on spotting malicious email messages.

Agree on a simple office habit: staff can pause an unusual request long enough to check it, even when it appears to come from someone senior.

3. Verify payment changes through a separate channel

A request to change a supplier’s banking details deserves a separate check.

Dial an established contact using an already existing number in your records. Verification using a phone number provided in the same dubious message would render it reliant on that same message.

When a request you receive is suspicious and you must validate the identity of the sender, Cyber Centre recommends that you contact them through alternative means. This is the approach described by its guidance on how to respond to malicious messages.

Make independent confirmation a standard step when changing payment details. Document who can approve the change and how the confirmation is recorded.

This gives employees a clear process to follow when an email sounds convincing but asks them to do something unusual.

4. Check whether you were expecting the attachment

Before opening an invoice, shared document, or delivery notice, consider the context.

Were you expecting this file? Is it for a job or purchase you currently have? Is the sender requesting that you do something differently than you would normally do?

A file named “Invoice” does not prove that it belongs to a real transaction. The Cyber Centre notes that malicious emails may contain harmful attachments or links designed to prompt unsafe actions. Its email security guidance covers these risks.

So, if you get an email from a new sender with an invoice that nobody recognises then ask the relevant person who purchased before opening it.

A brief internal check can help distinguish a suspicious message from a legitimate invoice sent to the wrong employee.

5. Know how to report a suspicious message

Responses should be simple when it comes to what the employees need to do.

If this email does not look correct who should I contact?

Your process could involve an email reporting button, a support ticket, or a call to your IT helpdesk. Train staff on what method your business uses.

If work devices or accounts are in question then it should be reported to the organization’s IT or security team, according to the Cyber Centre. See its malicious email guidance.

Make the instructions easy to find. A new employee should be able to report a message without asking several colleagues where it belongs.

What if someone has already clicked?

Report it promptly and describe what happened. Opening a link, entering a password, downloading a file, and approving a sign-in request are different events. Your IT provider needs those details to assess the situation.

If you entered a password on a suspicious page, change it through the genuine service from a trusted device and notify IT immediately. If you reused that password elsewhere, those accounts need attention too.

Get Cyber Safe suggests victims of phishing take recovery steps such as changing their passwords and scanning for intrusive software.

Do not blame anyone for reporting an error. A clear, concise reporting process assists your team in elevating concerns early.

Make verification part of the working day

Review one process this week: payment-detail changes, unexpected sign-in requests, or suspicious-email reporting.

Interview some employees about how they would go about tackling it. Get everyone to agree on some simple process and share it with everyone, if the answers vary.