Phishing is still the front door for most cyberattacks on small and mid-sized businesses. Before ransomware locks up a file server or a fraudster reroutes a wire transfer, there is almost always one email that somebody clicked. The good news: phishing emails follow patterns, and once your team knows the patterns, most attacks die in the inbox.
Here in East Texas, we see the same lures over and over — fake invoices sent to CPA firms in Tyler during filing season, spoofed vendor emails hitting manufacturers in Longview, bogus “payroll update” messages aimed at healthcare clinics, and fraudulent title-company wire instructions targeting law firms. The attackers are not targeting you because you are big. They are targeting you because you are busy.
What Phishing Actually Is
Phishing is any message designed to trick someone into handing over credentials, money, or access. Email is the most common channel, but the same tricks now arrive by text message (“smishing”), phone call (“vishing”), and even Microsoft Teams chat. The goal is almost always one of three things: steal a password, install malware, or convince someone to send a payment to the wrong place.
Most phishing is mass-produced and easy to catch. The dangerous variety is business email compromise (BEC) — targeted messages that impersonate your boss, your bank, or a real vendor you actually work with. The FBI consistently ranks BEC among the costliest cybercrimes in America, and Texas is routinely one of the top states for reported losses.
Seven Signs an Email Is Phishing
1. The sender address doesn’t match the display name
The display name might say “Dogwood Bank Support,” but the actual address is support@dogwood-bank-alerts.net or a random Gmail account. Always check the real address, not just the name. On a phone, tap the sender’s name to reveal it — mobile mail apps hide this by default, which is exactly why so many phishing clicks happen on phones.
2. Urgency and pressure
“Your account will be suspended in 24 hours.” “I need those gift cards before my 2 p.m. meeting.” Manufactured urgency is the single most reliable phishing tell. Legitimate organizations almost never demand immediate action under threat.
3. Requests involving money, credentials, or gift cards
Any email asking you to change payment details, confirm a password, buy gift cards, or approve an unexpected invoice deserves a phone call to a number you already have on file — not the number in the email.
4. Links that don’t go where they claim
Hover over a link before clicking (or long-press on mobile). If the text says microsoft.com but the link goes to login-micros0ft.example.ru, delete the email. Watch for lookalike domains: an attacker impersonating a Longview supplier might register the same domain with one letter changed.
5. Unexpected attachments
Invoices you didn’t expect, “voicemail” attachments, ZIP files, or documents that ask you to “enable macros” or “enable content” are classic malware delivery. When in doubt, call the sender.
6. Generic greetings and odd wording
“Dear Customer” from a company that knows your name is a red flag. So is stilted phrasing — though be careful here: AI writing tools mean modern phishing emails often read perfectly. Grammar alone is no longer a reliable filter.
7. Requests that break your normal process
Your controller has never asked you to wire money via email. Your IT provider has never asked for your password. Anything that sidesteps normal procedure — especially involving payments — should trigger verification by phone or in person, every time.
Why East Texas Businesses Are on the Target List
Attackers running phishing campaigns love smaller markets. A 20-person medical practice in Tyler, a machine shop in Longview, a logging and timber operation near Lufkin, or a defense supplier in Texarkana often holds the same valuable data as a big-city firm — patient records, banking credentials, controlled unclassified information — but with a fraction of the security staff. Criminals know that many East Texas businesses have no dedicated IT department at all, and they price their attacks accordingly.
Regulated industries raise the stakes further. Healthcare providers face HIPAA penalties on top of breach costs. Defense contractors in the Red River corridor risk their CMMC standing and their contracts. Law firms and CPAs risk client trust that took decades to build. One clicked link can put all of it in play.
Building a Human Firewall: What to Do About It
Technology helps, but phishing defense starts with habits. Here is a practical program any business can run:
Verify out-of-band. Make it policy: any request to move money or change payment details gets confirmed by phone using a known number. No exceptions, even for the CEO — especially for the CEO, since executives are the most impersonated people in any company.
Turn on multi-factor authentication (MFA). If a password does get phished, MFA is usually what keeps the attacker out. Enable it on email, banking, and anything remote-accessible. (Note: attackers now use real-time phishing kits to bypass weaker MFA, so prefer app-based or hardware-key methods over text messages.)
Train little and often. One annual slideshow doesn’t change behavior. Short monthly reminders and periodic simulated phishing tests do. Celebrate catches instead of punishing clicks — you want employees reporting suspicious emails fast, not hiding mistakes.
Make reporting easy. Every employee should know exactly where to forward a suspicious email. A reported phish protects the whole company; an ignored one protects no one.
Filter before the inbox. Modern email security can strip malicious links and attachments before anyone sees them. Combined with DNS filtering and endpoint protection, most commodity phishing never reaches a human. Our managed IT services bundle these protections for businesses that don’t have in-house IT.
Have a plan for the bad day. If someone clicks, minutes matter: reset the password, revoke active sessions, check mail-forwarding rules, and notify your bank if money is involved. If you don’t have someone to call at that moment, that’s a gap worth fixing before it happens — our cybersecurity services include incident response for exactly this scenario.
The Bottom Line
You don’t need a Fortune 500 budget to beat phishing. You need suspicious habits, MFA, a verification policy for anything involving money, and filtering that catches the junk before it reaches people. Dogwood Security provides managed security services to businesses across Tyler, Longview, Palestine, Texarkana, Lufkin, and the DFW metro — if you’d like a no-pressure review of your email security, get in touch.
This Week in Security
A few stories from the past week worth your attention:
ShinyHunters claims breach of EY, threatens to leak client tax data (July 28). The extortion group says it stole client tax records from the Big Four accounting firm. If it can happen to a global firm, regional CPA practices holding the same kind of data should take note — client tax files are a prime extortion target. (GBHackers)
Iranian hackers actively exploiting industrial PLCs across U.S. critical infrastructure (July 27). Iran-linked groups are targeting internet-exposed Rockwell, Schneider, and Siemens controllers in water, energy, and manufacturing. CISA followed up July 31 urging water utilities to remove exposed PLCs from the internet — directly relevant to East Texas manufacturers and municipal utilities running internet-connected control systems. (GBHackers, CISA guidance)
One compromised employee mailbox led to a bank data breach (July 29). Bank of Baroda confirmed a breach that started with a single hijacked employee email account — a textbook example of why the phishing habits above matter. (GBHackers)
Outlook “half-click” flaw abused to plant persistent mailbox backdoor (August 1). A threat actor tracked as TA488 is exploiting an Outlook flaw requiring almost no user interaction to install the OWAReaper backdoor. Keep Office patched and treat unexpected Outlook prompts with suspicion. (GBHackers)
Chrome 151 patches 370 security flaws, 7 critical (July 30). If your business standardizes on Chrome, make sure updates are applied — the browser is where your team meets the internet, and this was an unusually large batch of fixes. (GBHackers)
Dogwood Security LLC is a veteran-owned managed IT, cybersecurity, and physical security company based in Palestine, Texas, serving East Texas and the DFW metro.