How to Get Breached, Step 3: Click Every Link. What’s the Worst That Could Happen?

Why phishing still works on smart people, and how to build a “report it, don’t click it” habit across your business

Welcome back to our backwards guide to cybersecurity. Last week you reused one password everywhere. This week, the advice is simple: click every link. An invoice from a vendor you’ve never used? Click it. A shared document from “Micros0ft”? Click it twice. An urgent message from your CEO, who is somehow emailing from a Gmail account? Definitely click that one.

Now for the serious part. Government agencies and industry research agree that phishing remains the most common entry point into small businesses, largely because it blends into normal workflows. The scams have also improved. Generative AI tools now write cleaner, more convincing lures than most human attackers could, so the typo-filled email you learned to ignore is no longer the main threat.

A Hypothetical Monday Morning

Picture a 25-person company. The office manager gets an email that looks like a Microsoft 365 storage warning. She signs in on what looks like the normal login page. Nothing seems wrong.

Behind the scenes, the attacker now has her mailbox. They quietly create a rule that forwards anything mentioning “invoice” to an outside address. Three weeks later, a “vendor” sends updated bank details on a real email thread. A $40,000 payment goes to the wrong account. One click started all of it.

How to Spot a Phishing Email

• Check the real sender address, not the display name. “Accounts Payable” can be attached to any address.
• Look for lookalike domains. Swapped letters (rn for m, 0 for o) and extra words are common.
• Hover before you click. On a phone, press and hold to preview the link.
• Notice pressure. Urgency, secrecy, and authority are the attacker’s main tools.
• Treat unexpected sign-in requests, attachments, and QR codes as suspicious. Microsoft tracked QR-code phishing jumping 146% in Q1 2026, partly because it moves the victim onto a personal phone.
• Question any change to payment details, no matter who appears to send it.

Action Steps for Owners and IT

1. Give staff one place to report. Suspicious email gets forwarded to IT, not deleted and forgotten. Farmhouse Networking clients forward to support@farmhousenetworking.com.
2. Adopt a no-blame policy. The employee who clicks and reports in five minutes is a hero. The one who stays quiet out of embarrassment gives the attacker weeks.
3. Verify money requests by phone. Use a number you already have, never one from the email.
4. Protect your domain from spoofing. Configure SPF, DKIM, and DMARC, and move DMARC to an enforcement policy so criminals can’t send email as you.
5. Tag external email. A visible “External” banner helps staff catch fake internal messages.
6. Run simulated phishing tests. Follow each one with short, practical training rather than an annual slideshow.
7. Require multifactor authentication on email and every cloud app.
8. Monitor for signs of a compromised mailbox, including new forwarding rules and sign-ins from unusual locations.
9. Write a one-page “I clicked” plan. Reset the password, end active sessions, check mailbox rules, and decide who notifies customers if needed.

Questions Your Customers May Ask You

“I got an email from your company asking me to pay a new account. Is it real?”
Our payment details rarely change, and when they do, we confirm by phone. If you ever receive a request like this, call us at the number you already have before sending anything.

“How do I know emails from you are legitimate?”
We have set up email authentication that makes it much harder for anyone to send messages using our domain. If something looks off, forward it to us and we will check.

“What happens if one of your employees clicks a bad link?”
Our team is trained to report it immediately, and our IT partner has a response process ready to contain the issue quickly.

How Farmhouse Networking Can Help

Farmhouse Networking helps small and mid-sized businesses turn phishing defense into a routine instead of a scramble. We run simulated phishing campaigns and short staff training, configure SPF, DKIM, and DMARC to stop domain spoofing, and enforce MFA and Conditional Access in Microsoft 365. Our security monitoring watches for suspicious sign-ins and mailbox rule changes, and dark web monitoring alerts us when employee credentials show up for sale. When someone reports a suspicious email, a real person at our U.S.-based help desk responds.

Get a Free Breach-Readiness Review

Would your team report a phishing email or just click it? Find out before an attacker does. Email support@farmhousenetworking.com to schedule a free breach-readiness review. We will check your email security settings, your domain’s spoofing protection, and how prepared your team is to report what lands in their inbox.

Next week: How to Get Breached, Step 4: Turn Off MFA. Those Pop-Ups Are So Annoying.