A Story For National "Gummy Bear Day" (and "National "Tell a Story Day")!
Steve (Bear) Jewell
Benny was a golden gummy bear, and he worked in accounts.
Not literally. He sat on the desk of Marcus, who ran a small plumbing business from a converted garage in Swindon. Three vans, seven staff, one overworked Marcus.
Marcus was a good man. Honest, hard-working, chronically behind on emails.
One Thursday, an email arrived.
It looked perfect. The logo was right. The font was right. It was from “Xero Accounts Team” and it said, in very official language, that his billing details needed urgent verification or his account would be suspended within 24 hours.
Marcus read it at 7pm, tired, half a pie in hand.
He clicked the link.
Benny watched, helpless, from next to the pencil pot.
The page looked exactly like Xero. Marcus typed his email address. Typed his password. Hit confirm.
And somewhere, in a flat nowhere near Swindon, someone now had the login to Marcus’s accounting software. His invoices. His client list. His bank feed.
The next morning, three clients received emails from “Marcus” asking them to pay their outstanding invoices to a new bank account. Urgently. Due to a banking transition.
Two of them paid.
Marcus lost £4,200 before he even finished his first coffee.
Benny could not type. He had no arms. He was made of gelatin.
But if he could have, he would have left Marcus a note:
“It’s a trick! The urgency is the trick. That’s how you know.”
Legitimate software companies do not threaten suspension of financial accounts over email with no prior notice, and ask you to log in via a link. They will give you methods for you to go directly to the site yourself.
One habit. That’s all it takes.
The Moral of the Story
Urgency is a weapon.
Phishing emails manufacture panic because panic skips the part of your brain that notices something is wrong.
Before you click anything in an email:
- Go directly to the website by typing it yourself, never via the link
- Check the sender address properly, not just the display name
- Call the company if something feels off, even slightly
- Enable two-factor authentication on every business tool, full stop
- Brief your team because one tired click from anyone is enough
Small businesses are targeted specifically because they rarely have IT support looking over their shoulder.
Start by building positive habits for your own IT support. Start with the pause before the click.
Or alternatively, just speak to Atmosphere about more effective email security for your business!
Benny was later eaten during a stressful VAT return. He would have wanted it that way.
