The advice you were given a few years ago, watch for typos and bad grammar, quietly stopped working, and most businesses never got the memo.

For a long time, spotting a phishing email came down to one thing: the typos. Clumsy grammar, a greeting that got your name wrong, a sentence no real company would send. That worked because the people behind those emails often did not write English well, and the mistakes gave them away. Then the writing tools got good, and the tell disappeared. The FBI's Internet Crime Complaint Center put business email compromise losses at more than $3 billion in 2025, second only to investment fraud, and this was the first year in the center's nearly 25-year history that the report carried a dedicated section on artificial intelligence. The emails driving those losses do not look like scams anymore. For any Gloucester County business that moves money, signs contracts, or handles client data, the distance between "I can spot a fake" and "I honestly can't tell anymore" is exactly where the money goes.

The Old Advice Stopped Working

Teaching your staff to hunt for spelling mistakes feels responsible, and it is more than most businesses bother to do. The trouble is that the thing you are teaching them to look for is gone.

The same writing tools every business now uses to clean up an email can be pointed the other way. An attacker feeds in a few details and gets back a clean, professional, correctly addressed message on demand. So, the email asking your bookkeeper to update a vendor's bank details reads exactly like a message that vendor really would send. Same tone, same signature block, no typo to catch. You are not looking for a bad email anymore. You are looking for a normal one that happens to be lying. We went deeper on how AI changed phishing for New Jersey businesses if you want the longer version.

Bottom line: When the obvious signs vanish, the habit of verifying has to replace the habit of spotting.

What This Actually Looks Like

The version that costs businesses money is not the mass email blasted to ten thousand inboxes. It is patient and quiet. Someone gets into or watches an email account, learns how the company talks and who pays what, and waits for a moment when a payment is already expected. A closing. A big invoice. A supplier payment that was going out that week anyway.

Then one email arrives, looking like it came from a partner, a client, or a vendor, asking for a wire to go out or for payment details to change. A South Jersey firm that was already planning to pay that supplier is the ideal target, because nothing about the request stands out. It does not look like an attack. It looks like Tuesday.

In practice: If an email asks you to move money or change payment information, treat the request itself as the risk, no matter how ordinary it looks.

The Weakest Link Is Always the Same One

Every one of these attacks is really aimed at the same target, and it is not your firewall. It is a person, tired, busy, moving fast, and doing what looks like the reasonable thing. The technology can be perfect, and a single human moment still opens the door, because we are wired to trust what looks familiar and to keep things moving when we are under pressure.

Here is one we ran into that stuck with me. Someone went to call a business, dialed an 866 number when the real one was an 800, and got a recording, "welcome to [company]", that sounded exactly like the real thing. It was a scam call center sitting on the lookalike number, waiting for people to misdial their way in. The automated greeting handed them off to a live "agent," and it was only when that agent started asking questions that did not fit that our user realized something was wrong and hung up. Nothing had been hacked. No email was involved. A person made a completely ordinary mistake, one wrong digit, and a sophisticated operation was already there to catch it.

That is the part most people underestimate. These are not lone hackers guessing passwords. They are organized operations that have thought carefully about the small, human errors people make every day, the mistyped number, the rushed approval, the email that arrives at the worst possible moment, and built a business around being there when it happens. There are polished scams running right now that most business owners do not know exist, and that is exactly what makes them work.

"We're Too Small to Be a Target"

The assumption is that criminals chase big companies with big balances. It sounds reasonable and it is backwards.

Smaller businesses get hit precisely because they tend to have fewer controls, nobody whose actual job is security, and a bookkeeper who can send a wire without a second signature. The attacker is not after your size. They are after one payment, and a forty-thousand-dollar wire from a ten-person shop clears the bank the same as one from a corporation. The businesses that get caught are almost never the ones that thought they were too big to fail. They are the ones that assumed nobody would bother with them.

The One Habit That Stops It

Most of these losses are prevented by a rule that costs nothing to adopt: any request to move money, and any change to payment instructions, gets confirmed by a phone call to a known number before anyone acts on it.

Not a reply to the email. A call to the number you already had for that person, not the one printed in the message, because the number in a fraudulent email goes straight to the person who sent it. The whole scam runs on urgency and on staff who do not want to pester a busy client with a phone call over something that looks routine. One call, made every single time, defeats the entire category, because the fraud only works when nobody checks.

The technical side matters too, email filtering, multi-factor authentication so a stolen password is not enough on its own, and anti-impersonation controls, and that is the part a managed IT provider like Nexus Ideal Solutions puts in place. But the verification habit belongs to you, and it is the single most effective thing your business can start doing this week without spending a dollar.

A Practical Defense Checklist:

  • [ ] Confirm every payment-detail change by phone, using a number you already had, never the one in the email

  • [ ] Require a second person to approve wires over a set amount

  • [ ] Turn on multi-factor authentication for email and banking

  • [ ] Tell staff plainly that clean grammar is no longer proof an email is real

  • [ ] Make sure your email has filtering and anti-impersonation protection

  • [ ] Know who to call the second something looks off, before any money moves

Build It Into the Work, Not People's Memory

A rule that lives in someone's head fails the first genuinely busy week. The businesses that avoid these losses bake the verification step into the process itself, a required approval, a note on the payment screen, a standing instruction finance follows without having to make a judgment call in the moment.

That is the whole difference between hoping a stressed employee catches it and knowing the process will. When the request shows up looking completely normal, and it will, the process is what protects you. Not somebody's instinct at 4:45 on a Friday.

Bringing It Home in Gloucester County

Business email compromise is not a big-city problem or a big-company problem. It goes after the relationship-driven, payment-moving businesses that make up most of the Gloucester County Chamber of Commerce, and it wins when the old typo-spotting advice is the only defense in the building. The fix is not expensive: a verification habit, a few technical controls, and a team that understands the scam emails simply got better at pretending.

Comparing notes with other members on how they handle payment verification is a fast, free way to pressure-test your own approach. If email security is on your mind right now, that is a good conversation to start.

Frequently Asked Questions

How can I tell a real vendor email from a fake one now?

More and more, you cannot tell from the email alone, and that is exactly the point. Stop leaning on how the message looks and move to confirming the request through a separate channel, a phone call to a number you already trust. Treat any email that asks you to move money or change payment details as unverified until you have confirmed it by voice.

The email is no longer where you catch the fraud. The phone call is.

Isn't multi-factor authentication enough by itself?

It is essential, but it guards against a stolen password, not against a convincing request. An attacker who never actually gets into your account can still send a message from a lookalike address asking your staff to act, and MFA does nothing about that. You need the technical control and the human habit, because they cover two different halves of the same attack.

MFA guards the door. Verification guards the decision.

What does real protection cost a small business?

The most effective step, the payment-verification habit, costs nothing but discipline. The technical layer, filtering and anti-impersonation, is usually part of a managed IT service rather than a separate purchase, so the cost depends on what you already have in place. The far bigger number is a single successful wire fraud, which is rarely recovered once the money has left.

Prevention is measured in habits and settings. The loss is measured in wires that do not come back.

What do I do if I think we've already sent a fraudulent payment?

Call your bank immediately, because funds can sometimes be recalled inside a short window and every hour counts. Then report it to the FBI at ic3.gov. Moving in the first few hours gives you the best odds of getting anything back.

The first call after a bad wire is to your bank, not a problem to sleep on.