November 2026 · Phishing & Social Engineering

If a message makes you panic, pause before you click.

“Your storage is full.” “Your account will be suspended.” “This offer expires in 24 hours.” Different messages, same pressure: stop thinking and do what the sender wants. A short pause and an independent check can keep an ordinary workday from becoming a security incident.

Talk through your email security Back to the blog

Office workstation where taking time to verify an unexpected request can protect business accounts

The human side of security

A scam does not always start with a broken computer.

Social engineering means manipulating a person into sharing information or taking an action that helps an attacker. Phishing is one way to do it, often through deceptive email or text messages. The same approach can arrive by phone, chat, a QR code, or a convincing conversation.

The pressure may be fear, curiosity, a bargain, respect for authority, or simply wanting to help. The request is what matters: are you being pushed to reveal a password, approve access, install software, send money, or share information before checking?

Good spelling and a polished design are not proof. Neither is a message that knows who you are. For a small office in Charlotte or Central Florida, the target may be a mailbox, customer records, or the next vendor payment rather than a cryptocurrency wallet.

The storage warning that wants your password

Illustrative scam: “Your mailbox is almost full. Upgrade now or your messages will be deleted.” The button leads to a convincing sign-in page, where entering your password gives it to someone else.

A storage warning can be genuine. Open Outlook, OneDrive, or your provider’s app the way you normally do and check the account there. If you are unsure which storage limit is involved, ask Dave before paying for an upgrade or entering a password through the warning.

The offer that expires in 24 hours

Illustrative scam: “You have been selected for a refund, free storage, or a special renewal price. Claim it within 24 hours.” A small shipping or verification charge may be the excuse to collect card details.

A deadline is a reason to verify the offer, not evidence that it is real. Reach the business through its usual app, a saved bookmark, or contact details you already have. A missed discount is easier to recover from than a stolen account.

The support call that creates its own emergency

Illustrative scam: “We are from Microsoft. Your computer is infected. Install this support tool so we can fix it.” A browser warning may even provide the phone number to call.

Do not give an unexpected caller remote control, read out a sign-in code, or approve a login prompt they say is needed to stop a hack. End the conversation and call your known support contact. Caller ID, a familiar logo, and knowledge of your name or company do not prove who is contacting you.

The familiar person asking for an unusual favor

Illustrative scam: A vendor sends new bank details, the owner needs gift cards immediately, or a shared document asks you to sign in again. The message may arrive from a real account that somebody has taken over.

For payment changes, sensitive files, or unexpected access requests, verify with the person using a phone number already in your records. Do not use a replacement number supplied in the request. Agree on a second approval for important payments, even when the request appears to come from the boss.

The opportunity that asks you to install something

Illustrative scam: A recruiter, prospective client, or meeting host asks you to install an unfamiliar app, run a “test,” add a browser extension, or paste a command to make a video call work.

A friendly conversation can still lead to a dangerous request. Verify the organization independently and have unfamiliar software reviewed before using it on a work computer. Do not let a promising job or customer become an exception to your usual device rules.

What if you already clicked or shared information?

Tell Dave or your company’s I.T. contact immediately. Explain what you clicked, what you entered, whether you approved a sign-in, and whether anything downloaded or ran. Keep the message and note the time. Quick reporting gives the business a better chance to limit the damage; hiding a mistake gives an attacker more time.

If you entered a password, use a known-clean device and the genuine service to change it. Your administrator should also review active sessions, recovery settings, mailbox rules, and any new application permissions. A password change alone may not remove every route back in.

If remote access or suspicious software is running, disconnect that computer from the network and call for help from another device. If payment details or money were involved, contact the bank or card provider immediately using its established contact details. Do not keep talking to the person who sent the request.

A recent example

Binance: a believable opportunity became part of a much larger attack.

In its November 3 initial report, Binance said its October 29, 2026 incident affected approximately $6.34 billion in digital assets. Reporting described it as the largest cryptocurrency theft on record. That is a more specific claim than the largest theft of any kind.

According to Binance, an attacker posing as a recruiter arranged interviews with an engineer, built credibility through a video call and a social profile, and eventually asked the engineer to download a technical test. Malicious software ran during setup. The report describes other compromises and later access to wallet systems too; this was a multi-stage attack, not simply one phishing email. The investigation was still ongoing when the report was published.

The lesson for a small business is straightforward: a believable person, a real platform, and a normal-looking task do not make an unexpected download safe. Verification and limits on access need to work together.

Sources: Binance’s initial findings and response update and Associated Press reporting on the theft.

A routine worth practicing

Pause. Verify separately. Then decide.

Notice the pressureUrgency, secrecy, fear, and unusually generous offers should trigger a second look.

Use your own routeCheck through your usual app or a saved contact, rather than the link or number in the message.

Protect approvalsDo not share verification codes or approve sign-in requests you did not initiate.

Question new softwareGet unfamiliar downloads, browser extensions, and access requests reviewed before proceeding.

Report earlyMake it easy for staff to ask a question or report a mistake without embarrassment.

Keep the layersMaintain email filtering, updates, backups, strong sign-in protection, and limited administrator access.

Make checking part of the job.

The safest office is one where employees can say, “This seems strange; can we check it?” Give staff a known contact for suspicious requests and agree that an urgent message never removes the need to verify an important action.

Security tools help, but they should support that habit. Review the layers behind safer business email and why everyday accounts should not hold administrator access.

For more background, see the FTC’s phishing guidance. The scenarios above are illustrative examples, not messages attributed to the Binance incident. Incident information checked November 9, 2026.

Next step

Not sure whether a message is real? Ask before acting.

Hughes I.T. helps small businesses review email security, account access, and practical ways to handle suspicious requests. For an active incident or an urgent question, call or text Dave.

Request a free consultation Call or text 407-284-1192