The email that costs a business the most money rarely looks like an attack. It looks like your accountant asking for an urgent transfer confirmation. It looks like your supplier sending an updated bank account number "due to an internal audit." It looks like a message from "Google" telling one of your staff their account will be suspended in 24 hours unless they verify their password right now. None of these announce themselves. That's the entire point of phishing — it's not trying to break in through a locked door. It's trying to get someone to open the door themselves, politely, because the request seemed reasonable.
We're going to be specific about how this actually plays out in Nigerian small businesses, because generic phishing advice — "don't click suspicious links" — doesn't match how these attacks actually look once they're happening to you.
Why Small Businesses Are Targeted, Not Skipped
There's a common assumption that phishing attacks target big companies, and small businesses are somehow beneath the effort. It's backwards. Small businesses are targeted more, not less, precisely because they usually have weaker defenses and less formal process around anything involving money or credentials. A large company has a finance department with sign-off procedures for wire transfers. A small business often has one person — sometimes the owner directly — who can authorize a payment from their phone in under a minute. That speed and informality, which is normally an advantage, is exactly what a phishing attack is built to exploit.
The attacks aren't usually random either. Someone researching your business on LinkedIn, your website, or your social media can figure out who your suppliers are, who handles your finances, and what your business relationships look like, well enough to write a convincing, targeted message rather than a generic one. This is what security people call "business email compromise" when it specifically impersonates someone inside a company's own communication chain, and it's considerably harder to catch than the obviously fake "you've won a prize" emails most people already know to ignore.
The Three Patterns That Actually Show Up
Most phishing attempts hitting small Nigerian businesses fall into a few recognizable patterns, and it's more useful to train your team to recognize the pattern than to memorize a checklist of red flags that changes with every new scam.
The first is the fake invoice or payment change. Someone impersonates a known supplier or contractor, usually by spoofing an email address that looks almost identical to the real one — a single character different, or a domain that's visually close enough to pass a quick glance — and requests payment to a "new" bank account. This works because it arrives in the middle of a legitimate ongoing relationship, so it doesn't trigger the suspicion a message from a total stranger would.
The second is credential harvesting — a message, often looking like it's from Google, Microsoft, or your hosting provider, warning that an account will be locked, suspended, or requires urgent verification, with a link to a fake login page built to capture whatever username and password gets typed in. These pages are frequently good enough replicas that the visual difference from the real thing is genuinely hard to catch under time pressure, which is exactly the condition the message is designed to create.
The third is the internal impersonation — an email or WhatsApp message that appears to come from the business owner or a senior staff member, usually while that person is "traveling" or "in a meeting," asking someone junior to make an urgent payment, buy gift cards, or share sensitive information. This one specifically targets the power dynamic in a small team — a junior staff member is far less likely to question or verify a request that appears to come from their boss, especially when it's framed as urgent and slightly inconvenient to double-check.
Why "Just Be Careful" Doesn't Actually Work as Training
Telling your staff to "be careful" or "watch out for phishing" is close to useless as a policy, because it gives them no concrete action to take in the moment the attack is actually happening — which is precisely the moment they're under the most pressure to act fast and think least. Effective staff training isn't about awareness in the abstract. It's about building one or two specific habits that survive urgency and distraction, because that's the condition under which these attacks succeed.
The habit that matters most, by a wide margin, is verification through a second channel. If a payment request, a bank account change, or an urgent instruction arrives by email, it gets confirmed by phone or in person before anyone acts on it — not by replying to the same email, which could easily be replying to the attacker, but by calling a known, previously saved number. This single habit, consistently applied, defeats almost every version of the fake invoice and internal impersonation patterns described above, because it breaks the one thing all of them depend on: getting a response before anyone stops to verify.
The second habit is checking the actual sender address, not just the display name. Email clients show a friendly name by default — "First Bank Nigeria" or "Chinedu — Accounts" — and most people never look past that to the actual email address underneath, which is where the mismatch usually shows up. Training your team to tap or hover on the sender name before acting on anything financial or credential-related catches a significant portion of these attempts on its own.
The third is a simple rule around urgency itself: treat urgency as a reason to slow down, not speed up. Every phishing message we've described here depends on creating pressure — an account about to be suspended, a payment that has to go out in the next hour, a boss who's annoyed at being asked to verify something obvious. Legitimate urgent requests exist, but they're rare enough that "this feels urgent" is actually a useful trigger to pause and verify, rather than a reason to move faster.
Building This Into How Your Business Actually Runs
None of this works as a one-time meeting where you tell your staff about phishing and move on. It needs to become a small, boring, repeated part of how the business operates — a clear rule that any payment or account detail change gets verified by phone before it's acted on, a habit of checking sender addresses that gets modeled by whoever's most senior, and a culture where a junior staff member double-checking an "urgent" request from the owner is treated as good judgment, not as an annoying delay. That last part matters more than it sounds — if staff learn that questioning an urgent request gets them a frustrated response, they'll stop questioning, and that's exactly the failure mode phishing is built to exploit.
The businesses we've seen actually avoid falling for this aren't the ones with the most sophisticated technical security. They're the ones where verification is just normal — where nobody feels awkward picking up the phone to confirm something in writing, because that's simply how the business handles anything involving money, before the attack ever shows up to test it.
