How Email Scams Have Changed and What Your Business Should Look For
For many years, one of the simplest ways to spot a phishing email was to check who it came from.
That advice is still good. Looking closely at the sender’s email address remains one of the easiest ways to identify many fraudulent emails before any damage is done.
But email scams have continued to evolve.
Today’s attackers don’t always rely on obviously fake email addresses or poorly written messages. Increasingly they will use compromised accounts, seemingly genuine email conversations, and information gathered about your business to make their emails appear completely legitimate.
For small and medium businesses, understanding these newer tactics is becoming just as important as recognising the traditional warning signs.
The Classic Phishing Email Still Exists
Many phishing emails still follow familiar patterns.
An email appears to come from your bank, a courier company, Microsoft, or another well-known organisation. It asks you to pay an invoice, click a link, open an attachment, or verify your account details.
Often, taking a closer look at the sender’s email address quickly reveals something isn’t right.
You might notice:
- an email address that doesn’t match who it claims to be
- a missing or substituted letter
- an extra number or character
- a domain name similar to the real one
Taking a few seconds to check these details can still prevent many phishing attempts from succeeding, it remains one of the simplest habits you can build.
When the Email Really Does Come From the Right Address
Unfortunately, this is where modern phishing becomes more convincing.
Rather than creating fake email addresses, attackers increasingly target legitimate ones.
If someone successfully compromises a real email mailbox, they can send from that genuine account. To your email gateway, and often to your colleagues, the message appears completely authentic.
Because it comes from a legitimate address, it may appear in an existing email conversation alongside previous messages you’ve already exchanged.
That immediately removes one of the biggest warning signs people have relied on for years.
Attackers Are Using Context Against You
Today’s phishing emails are often built around information that already exists.
If attackers gain access to an email account, they can see previous conversations, customer names, suppliers, invoices, and projects.
Instead of sending a generic scam, they may reply to an existing email thread that you’ve already been involved in.
The conversation looks familiar, the sender is someone you’ve dealt with before, maybe the subject line hasn’t changed.
Then, towards the end of the conversation, comes a seemingly ordinary request.
Perhaps updated bank account details, a request to pay an attached invoice or to urgently transfer funds before the end of the day; or simply a request to log into a shared document.
Everything appears to fit the conversation, making these attacks far more difficult to recognise than traditional phishing emails.
They May Already Know Who You Work With
Many businesses share information publicly through websites, LinkedIn profiles, email signatures, or social media.
On their own, these details are perfectly normal. When used by malicious actors, however, they can help attackers create highly convincing emails.
You might receive a message that mentions your manager by name, references a colleague you’ve worked with, refers to an actual customer or supplier, or appears to show a previous back-and-forth conversation between colleagues or customers/suppliers.
Sometimes these details have been gathered from publicly available information. In other cases, they have been obtained after compromising someone’s mailbox.
Either way, the goal is the same: to make the request feel familiar enough that you don’t question it.
Even Trusted Businesses Can Be Compromised
One of the biggest misconceptions is that if an email comes from a recognised company or a legitimate domain name, it must be safe.
Unfortunately, that isn’t always true.
Businesses of every size can have email accounts compromised.
If that happens, attackers may send phishing emails directly from genuine business addresses before anyone realises the account has been taken over.
That doesn’t mean you should distrust every email you receive, it simply means that a genuine sender address should no longer be your only measure of whether a message is legitimate.
Look Beyond the Sender
Checking the sender’s email address is still an important first step.
But today, it’s equally important to consider the context of the request.
Ask yourself:
- Was I expecting this email?
- Is the request unusual or out of character?
- Is there unexpected urgency?
- Am I being asked to change payment details?
- Am I being asked to share sensitive information?
- Does the message ask me to sign in through an unfamiliar link?
- If this request came from someone I know, would they normally ask this way?
If something feels even slightly unusual, it’s worth taking a moment to verify the request.
If uncertain, you can check the email with your IT team, or make a phone call to the sender.
Those few minutes can prevent a costly mistake.
Technology Still Plays an Important Role
Modern email security tools are far more capable than they were a decade ago. They help filter spam, block known malicious links, and identify suspicious behaviour before messages reach your inbox. However, no technology catches every threat.
Attackers continually adapt their techniques, particularly when targeting individual businesses.
That’s why the strongest defence is usually a combination of good security technology and informed users who know when to pause and question an unexpected request.
What This Means for Your Business
Phishing is no longer just about spotting obvious scams or poorly written emails.
Today’s attacks are often built around trust. They use genuine conversations, familiar names, and legitimate email accounts to convince people that nothing is out of the ordinary.
Taking a few seconds to check the sender’s address is still a valuable habit, but it’s only one piece of the puzzle.
Looking at the overall context, questioning unexpected requests, and verifying anything that doesn’t feel quite right can significantly reduce the risk of your business becoming the next victim.
As email scams continue to evolve, staying aware of how they work remains one of the most effective ways to protect your business, your data, and the people you work with.