So far we've looked at doors in your website. Today's door is you.
The easiest way into a business is often a convincing email. And they've become very convincing. In December 2025, AI wrote more than half of all phishing emails, up from under 5% a few months earlier. Spelling mistakes no longer give them away.
These are the ones website owners get most:
- "Your domain is about to expire. Renew now to avoid losing your website."
- "Your website will be suspended for a policy or copyright violation."
- "Your hosting payment failed. Update your card."
- An invoice from your "web designer" or "SEO company" that looks just like the last one.
- "We've changed our bank details. Please pay this invoice to our new account."
The pattern to spot
Almost every scam has the same three parts:
- Hurry. Today, within 24 hours, final notice.
- Someone official. Google, your bank, your host, your domain company, a supplier.
- An action. Click this link, open this file, pay this account.
When all three turn up together, stop. That's the pattern.
The 10-second check
Don't use the link in the email. Open a new tab and go to the account yourself, using your bookmark or by typing the address. If there's really a problem, you'll see it there. For anything about money or bank details, phone the person on a number you already have, not one in the email.
Today's easy wins
- Bookmark the real login pages for your domain, hosting, website and bank.
- Agree a rule with your team: any change to bank details is confirmed by phone.
- Ask your email or web provider to switch on SPF, DKIM and DMARC. These three settings stop criminals sending email that pretends to come from you.