Digital Strategy BY JOE ALDEGUER


CATCH A BUSINESS EMAIL SCAM > Business email scams often arrive disguised as routine requests: Pay this invoice. Buy these gift cards. Review this document. Update this vendor’s banking information. The messages may use a familiar


name, create urgency and contain no virus or malicious attachment for secu- rity software to detect. That makes employees the last — and often best — line of defense. Knowing when to pause, how to verify a request and what to do after a mistake can prevent a deceptive email from becoming a costly breach. Business email compromise, or


BEC, is a common version of this fraud. A criminal impersonates an owner, employee or vendor to persuade someone to send money, buy gift cards or disclose sensitive information. In one recent case, an email that


appeared to come from a business owner included an invoice from an unfamiliar vendor and offered a 50% discount for sending a five-figure wire that day. In another, employees received messages using the owner’s name and asking for help with a “quick task.” One employee shared her cell number and then began receiving gift-card requests by text. She recognized the scam before making a purchase. A third message, disguised as a voice


memo, attempted to steal the recipient’s password. It contained an unusual attach- ment that could have opened a fraudulent Microsoft or Google sign-in page. Although the messages looked


different, they all relied on the same strategy: creating enough familiarity and urgency to make someone act before verifying the request.


Spot a Scam Email If an email asks you to pay, purchase, send, click, sign in or share information, stop before taking any action. Without clicking on anything, check


the email for these seven warning signs: 1. The email address does not match the sender’s name. (On a phone, tap the display name to reveal the full address.)


2. “Re:” or “Fwd:” refers to a conversation that never occurred.


3. Your email system warns that you do not often receive messages from this address.


4. The message requests money, gift cards, banking information or a phone number.


5. The sender creates urgency or discourages you from making a phone call.


6. The message includes an unexpected link or attachment.


7. The writing, sign-off or lack of context seems unusual for the supposed sender.


One warning sign is enough reason


to pause. If the message involves money, banking information or sensitive data, confirm it directly. Call a number you already have — never one provided in the message. Businesses should also establish


simple internal rules. Require verbal confirmation before changing a vendor’s payment information, and consider requiring a second person’s approval for wire transfers or unusually large payments. Employees should know that slowing down to verify a request is expected, even when the message appears to come from the owner.


Report a Suspicious Email Do not reply, click a link, open an attach- ment or forward the message normally to coworkers. Instead: 


Use the phishing-reporting option in Outlook or Gmail.


 


Follow any procedures established by your IT provider.


If the email involves a payment or vendor account, alert the owner and bookkeeper by phone or in person.


32 FLORAL MANAGEMENT | November/December 2026 | WWW.SAFNOW.ORG


DOWNLOAD Scan to get a scam- prevention checklist


These steps help the business respond


quickly while preventing other employees from interacting with the message.


Act Quickly After a Mistake If you clicked, responded or sent money, quick action can help limit the damage. If you entered a password: Change it


immediately through the service’s official website, sign out of other active sessions and turn on multifactor authentication. If you shared your phone number:


Expect follow-up texts. Do not engage. Block the sender and forward suspicious texts to 7726, which spells SPAM. If you sent money: Contact your


bank’s fraud department immediately and ask it to stop or recall the payment. Then report the incident to the FBI’s Internet Crime Complaint Center at ic3.gov. Report gift-card and other fraud to the Federal Trade Commission at reportfraud.ftc.gov.


Strengthen Your Defenses Ask whoever manages your email whether phishing, impersonation and unfamiliar-sender protections are enabled. Also ask about DMARC, an email-authentication policy that helps prevent criminals from directly spoofing your company’s domain. The scams described here were


stopped because employees slowed down, examined the requests and ver- ified them. Those are teachable skills. Review them with your team before the next holiday rush, when workloads are high and an urgent request may receive less scrutiny.


Joe Aldeguer is director of IT for the Society of American Florists.


SHUTTERSTOCK/RED VECTOR


Page 1  |  Page 2  |  Page 3  |  Page 4  |  Page 5  |  Page 6  |  Page 7  |  Page 8  |  Page 9  |  Page 10  |  Page 11  |  Page 12  |  Page 13  |  Page 14  |  Page 15  |  Page 16  |  Page 17  |  Page 18  |  Page 19  |  Page 20  |  Page 21  |  Page 22  |  Page 23  |  Page 24  |  Page 25  |  Page 26  |  Page 27  |  Page 28  |  Page 29  |  Page 30  |  Page 31  |  Page 32  |  Page 33  |  Page 34  |  Page 35  |  Page 36  |  Page 37  |  Page 38  |  Page 39  |  Page 40  |  Page 41  |  Page 42  |  Page 43  |  Page 44  |  Page 45  |  Page 46  |  Page 47  |  Page 48