Halloween might be all about tricks and treats, but there's nothing entertaining about a cybercriminal tricking your business into handing over sensitive information. From convincing phishing emails to fake invoices and impersonation scams, cybercriminals are constantly finding new ways to manipulate employees.

While some scams are easy to spot, others can look remarkably convincing. Understanding the tricks being used can help your employees recognise suspicious activity before it becomes a serious problem.

Beware of Phishing Emails

Phishing remains one of the most common ways cybercriminals target businesses. A seemingly genuine email might ask an employee to click a link, open an attachment, confirm their login details or make a payment.

Cybercriminals may impersonate:

• Suppliers or customers
• Banks and financial services
• Microsoft or other technology providers
• Managers and senior employees
• Delivery companies
• Government organisations

The email might use familiar logos, realistic wording and urgent language to make the request seem legitimate.

Before clicking a link or opening an attachment, employees should check the sender's address carefully and consider whether the request is expected.

Don't Fall for Social Engineering

Cybercriminals don't always rely on sophisticated technology. Sometimes, they simply manipulate people.

Social engineering involves using psychological techniques to persuade someone to reveal information or carry out an action. For example, an attacker might pretend to be a company director who urgently needs a payment made or an employee who has been locked out of their account.

Creating a sense of urgency is a common tactic. Phrases such as "I need this immediately" or "You must do this today" are designed to discourage people from stopping to check whether the request is genuine.

If something feels unusual, take a moment to verify it through another method.

Watch Out for Fake Invoices

Businesses regularly deal with invoices, making them an attractive target for cybercriminals.

A scammer might compromise an email account or impersonate a genuine supplier and request that future payments are sent to a different bank account.

Employees should be cautious when receiving unexpected changes to payment details. Rather than replying to the email, verify the request using a known telephone number or existing contact information.

Don't Let Fake Login Pages Catch You

Another common trick involves sending employees to a fake login page designed to look like a genuine Microsoft 365 or other business service.

The employee enters their username and password without realising they're handing their credentials directly to an attacker.

Never enter your password after following an unexpected link in an email. If you're unsure, navigate to the service using a trusted bookmark or type the official website address directly into your browser.

Multi-factor authentication can also provide an additional layer of protection if a password is compromised.

AI Is Making Scams More Convincing

Cybercriminals can also use artificial intelligence to create convincing emails and messages. AI can help attackers produce polished content, adapt messages to specific targets and create scams with fewer obvious spelling or grammar mistakes.

This means employees can't rely on poor spelling or awkward wording as their only warning sign.

Instead, businesses should encourage employees to look at the wider context, including unexpected requests, unusual payment instructions, suspicious links and changes in normal communication.

Give Your Employees the Tools to Spot the Tricks

Cybersecurity isn't just about technology. Your employees are an important part of your business's defences, so they need to know what to look for and what to do when something seems suspicious.

Regular cybersecurity training can help employees recognise phishing, social engineering and other common scams. Businesses should also have clear procedures for reporting suspicious emails and potential security incidents.

At Edmondson's, we can help your business improve its cybersecurity and give your employees the tools they need to spot potential threats. From Microsoft 365 security and multi-factor authentication to staff guidance and wider IT protection, we can help keep the tricks out of your business this Halloween and throughout the rest of the year.