You can spend heavily on security technology and still be undone by one employee clicking a link in a convincing email. That isn’t a criticism of employees — it’s an accurate description of how nearly every successful attack now begins.
Attackers largely stopped trying to break through firewalls years ago. It turned out to be far easier to send an email that persuades someone to open the door from the inside.
For Placerville businesses, this is genuinely good news, and it’s worth saying why. The most effective defense available isn’t the most expensive one. It’s making sure your team can recognize what’s being sent to them — which is achievable for a business of any size.
What actually reaches your staff
The attacks that succeed rarely look like attacks. The obvious ones — misspelled, implausible, from an address nobody recognizes — get filtered or ignored. What gets through is careful, and it’s built around an ordinary working day.
The invoice that looks routine. From a vendor you genuinely use, referencing work that was actually done, with updated banking details. It arrives around the time an invoice would normally arrive. Payment is made before anyone thinks to question it.
The message from the owner. Appearing to come from the business owner or a senior manager, marked urgent, asking someone to handle a payment or purchase gift cards quickly. It lands at 4:45pm on a Friday, and the tone quietly discourages questions.
The password expiry notice. A Microsoft 365 warning that your password expires today, with a link to a login page that is a pixel-perfect replica. Credentials entered there go straight to an attacker, who now has legitimate access to that mailbox.
The shared document. A file-sharing notification from a name you recognize — a client, a colleague, an accountant. Opening it asks you to sign in again, which feels normal.
The delivery notification. Particularly effective in the weeks around holidays, when everyone is expecting packages and nobody scrutinizes a tracking link.
Each is designed to fit the rhythm of a normal workday. That’s precisely what makes them effective — none of them ask anyone to do something unusual.
What happens after the click
Understanding the sequence matters, because it explains why the damage often appears weeks later.
When someone enters credentials on a fake login page, nothing visible happens. No alarm, no error. The attacker now has access to a real mailbox and typically does nothing dramatic with it for some time.
Instead, they read. They learn who authorizes payments, how the business communicates, which vendors are used, what transactions are pending, and how the owner writes. Some set up quiet mail rules so their activity stays hidden from the account’s real owner.
Then, at a well-chosen moment — a large payment pending, a property closing, an invoice due — they send a message from that legitimate account, requesting a change to payment details. Because it comes from a real address inside a real conversation, it passes every technical check that exists.
The money leaves before anyone notices. In many cases, the business only discovers what happened when the genuine vendor calls to ask why they haven’t been paid.
This is business email compromise, and it costs businesses more each year than ransomware does. It starts with a single click.
Why technology alone doesn’t finish the job
Good email filtering stops a great deal, and it absolutely belongs in place. But filtering works by recognizing patterns, and a message written specifically for your business — referencing your actual vendors, your actual projects — may have no pattern to catch. Some percentage always arrives.
At that point, the last remaining control is the person reading it. Training is what makes that control reliable rather than a matter of luck and mood.
There’s a useful way to think about this. Every technical layer reduces volume. Filtering removes most attempts. Multi-Factor Authentication means a stolen password alone isn’t sufficient. Endpoint protection catches what runs. Training reduces how often any of those layers get tested — and catches the specific attacks that no technical control can distinguish from legitimate business.
What effective training actually looks like
Most businesses that have “done training” ran a long session once, some years ago. That approach doesn’t work, and understanding why points directly at what does.
Short and frequent beats long and annual. Attention fades quickly, and a two-hour session in January is largely forgotten by March. Brief, regular touchpoints — a few minutes, several times a year — hold considerably better.
Simulated phishing teaches more than slides ever will. Sending safe, controlled test emails and showing people what they clicked is memorable in a way explanation isn’t. Handled supportively rather than punitively, click rates drop substantially within a few months. Handled as a gotcha, it breeds resentment and people stop engaging.
Use realistic examples. Generic scenarios about foreign princes don’t land. Training built around the actual vendors, software, and workflows your team uses is recognized instantly, and the lesson transfers directly.
Make reporting easy and genuinely blame-free. This may matter most of all. If employees fear being reprimanded for clicking something, they stay quiet — and a phishing email that goes unreported may be sitting in a dozen other inboxes right now. A culture where reporting is welcomed, and where the person who reports gets thanked rather than lectured, converts your entire staff into an early warning system.
Include leadership, without exceptions. Owners and managers are targeted deliberately because their requests carry authority and their accounts have broad access. Exempting them removes the most valuable targets from the training entirely.
Cover the finance function specifically. Whoever handles payments needs deeper coverage than everyone else, because that’s where the money actually leaves.
The habits worth building
A handful of simple behaviors prevent the majority of losses:
- Verify payment changes by phone, using a number already on file — never one supplied in the email requesting the change
- Pause on urgency. Pressure to act immediately is the single most reliable warning sign across every attack type
- Check where links actually lead by hovering before clicking
- Never re-enter credentials from an email link. Open the application directly instead
- Treat unexpected attachments with suspicion, even from known senders, whose accounts may be compromised
- When something feels off, ask. Thirty seconds of checking beats weeks of recovery
That last habit is the one worth building the culture around. Most of the losses we hear about had a moment where someone thought “that’s a bit odd” and didn’t act on it.
Particularly relevant for Placerville businesses
Smaller businesses in the foothills are sometimes told they’re too small to be targeted. The opposite is true, and the reason is worth understanding.
Most attacks aren’t chosen — they’re automated. Attackers scan broadly for exposed systems and send phishing at enormous volume, then focus attention wherever something responds. Being small doesn’t make you invisible; it frequently makes you easier, because defenses tend to be lighter and there’s rarely anyone watching.
There’s a second factor specific to the region. Businesses in Placerville and the surrounding El Dorado County communities often have thinner access to specialist support than firms in Sacramento, and end up relying on a general computer vendor for work that requires a different discipline entirely.
The advantage a smaller team has is that training is far easier to deliver well. Twelve people can be trained meaningfully in an afternoon and kept current with short quarterly refreshers. It’s one of the few areas where being small genuinely helps — the whole team can develop a shared habit, which is much harder to achieve across two hundred people.
Training sits inside a larger picture
Awareness works best as one layer among several, and it’s worth being clear about what the others do.
Multi-Factor Authentication means a stolen password alone isn’t enough to get in. This is the single highest-value technical control available and should be enforced everywhere.
Endpoint detection and response catches malicious activity if something does get opened.
Verified backups mean an incident becomes a delay rather than an ending.
Continuous monitoring catches unusual activity during the quiet period when an attacker is inside but hasn’t acted yet — which is the best opportunity to stop an attack, and one that’s invisible without it.
Training strengthens every one of these by reducing how often they’re tested in the first place.
How to know whether it’s working
Training that can’t be measured tends to quietly stop happening. A few straightforward indicators tell you whether it’s having an effect.
Simulated click rate. The percentage of staff who click a controlled test email. Most businesses start somewhere between 20% and 30% on their first simulation. With regular, supportive training, this typically falls into single figures within six to nine months. The trend matters more than any single number.
Reporting rate. The percentage who report a suspicious message rather than simply deleting it. This is arguably the more important measure, because it indicates culture rather than knowledge. A team that reports is a team that gives you warning; a team that quietly deletes leaves you blind.
Time to report. How long between a suspicious email arriving and someone flagging it. Minutes means you can remove it from other inboxes before anyone else engages with it. Days means the window has closed.
Repeat clickers. A small number of people usually account for a disproportionate share of clicks. Identifying them isn’t about blame — it’s about giving those individuals additional, targeted support, which is far more effective than repeating general training for everyone.
Near-miss reports. The payment change someone verified by phone. The odd request someone questioned. These are the successes that never become incidents, and they’re worth acknowledging publicly, because recognition is what sustains the behavior.
None of this requires elaborate systems. What it requires is running the exercise regularly and paying attention to the results.
Where to start
Begin with an honest question: if a convincing fake invoice arrived tomorrow, would anyone catch it? And if someone did click something, would they tell you?
If either answer is uncertain, that’s the starting point — and it’s fixable within weeks rather than months.
RJ PRO Tech Group helps Placerville businesses build practical security awareness alongside the technical controls that back it up, with support available when someone needs a second opinion on a suspicious message.
Schedule a complimentary IT assessment for your Placerville business.
