Phishing emails used to be easy to spot. Bad grammar, weird formatting, a prince who needed your help moving money. Those days are gone.
In 2026, scammers are using large language models to write emails that are indistinguishable from the real thing — perfect grammar, your vendor's actual tone, even references to recent invoices or projects scraped from your public-facing website or LinkedIn. If you run a small business with a lean team, you are exactly the target they're after. You don't have an IT department. You're busy. One click can cost you.
Here's what I'm seeing and what you can actually do about it.
Why Small Teams Are the Prime Target
Large companies have security operations centers, email filtering stacks, and mandatory training. A five-person shop in Mansfield or Fort Worth has none of that — and attackers know it.
AI phishing scales effortlessly. A scammer can generate 10,000 personalized emails overnight, each one tailored to a specific business, written in that business's industry language. Your roofing company gets an email that sounds like it's from your material supplier. Your law office gets something that reads like opposing counsel. Your marketing agency gets a "client" request that matches your usual project intake.
The cost to the attacker is near zero. The cost to you, if you fall for it, can be enormous.
The New Red Flags (Forget the Old Ones)
Stop looking for typos. Start looking for these instead.
Urgency + Authority
AI phishing still leans on the same psychological triggers humans always have. The combination of urgency ("you must act today") plus authority ("this is from your bank / the IRS / your biggest client") is the most common pattern. If an email creates pressure to act fast without giving you time to verify, that's the signal.
Hyper-Personalization That Feels Off
If an email references something specific — your business name, a recent project, a vendor you actually use — don't let that familiarity lower your guard. It might raise it instead. Scammers scrape LinkedIn, your website, Google Business profiles, and public social media. The fact that they got a detail right doesn't mean the email is legitimate.
Requests That Bypass Your Normal Process
Legitimate vendors don't suddenly need you to pay via Zelle instead of your usual method. Legitimate clients don't ask you to click a new portal link out of nowhere. Whenever an email asks you to do something differently than you normally would, that's worth a phone call before you proceed.
Mismatched or Spoofed Domains
This one still works. Hover over the sender's email address and look carefully. billing@quickbooks-invoices.net is not QuickBooks. support@paypa1.com uses a number 1 instead of an L. AI makes the body of the email perfect — it can't fix a fake domain if you actually look.
Unexpected Attachments or Login Prompts
If an email asks you to log into something — Google Drive, Microsoft 365, your bank — go directly to that site yourself instead of clicking the link. AI-generated phishing pages now mimic login portals almost perfectly, including the correct logo, fonts, and layout.
Practical Systems for a Small Team
Knowing the red flags is half the battle. The other half is building habits that make verification automatic.
Use a verification call policy. For any financial request over a set threshold — say, $500 — require a quick phone call to confirm before acting. This one rule stops the vast majority of business email compromise attacks cold.
Set up email authentication. If you manage your own domain (which you should), make sure SPF, DKIM, and DMARC records are properly configured. This doesn't stop all phishing, but it prevents scammers from spoofing your domain to attack your clients or partners. Your web host or DNS provider can help with this, and it takes about 30 minutes to set up correctly.
Turn on multi-factor authentication everywhere. Gmail, Microsoft 365, your bank, your accounting software — all of it. Even if someone gets your password through a phishing attack, MFA is a hard stop. Use an authenticator app (Google Authenticator, Authy) rather than SMS when possible.
Create a short internal checklist. If you have even one employee or contractor, a simple one-page document covering "what to do if an email seems off" is worth its weight. It doesn't need to be fancy. It needs to exist.
Consider a password manager. Tools like Bitwarden or 1Password only autofill credentials on the actual legitimate domain. If you land on a fake login page, your password manager won't fill in anything — that's a built-in phishing detector that works silently in the background.
When You're Not Sure
When in doubt, don't click. Contact the supposed sender through a method you already know — look up their number on their actual website, not in the email — and ask if they sent it. Most legitimate companies would rather you verify than fall for a scam impersonating them.
If you think you've already clicked something suspicious, change your passwords immediately, check your email forwarding rules (attackers often add silent forwarding rules after a compromise), and contact your bank if any financial information was involved.
The Bottom Line
AI hasn't changed the fundamentals of phishing — it's just removed every friction that used to give scammers away. The psychological manipulation is the same. The urgency is the same. The goal is the same.
What's changed is that you can no longer rely on surface-level cues to protect yourself. You need a small set of consistent habits and a healthy skepticism toward any email that asks you to act fast or act differently.
For small business owners across DFW, this stuff matters more than ever. You're running lean, you're moving fast, and you're a target. A few simple systems can make the difference.
If you want help auditing your email setup, configuring authentication records, or putting together a security checklist for your team, let's talk.