The Phishing Email That's Fooling Agency Staff Right Now
You open your inbox on a Tuesday morning. There's an email from what looks like one of your insurance carriers. It says there's an issue with a client's policy renewal and asks you to log in and verify some information. You're busy. The email looks completely normal. You click the link.
That moment — that single click — is how most cyberattacks on small insurance agencies begin.
Phishing emails are the number one-way hackers get into small business networks, and they've gotten remarkably good at it. This isn't the obvious spam of ten years ago. Today's phishing emails are carefully crafted, visually convincing, and designed specifically to trick people who are smart, busy, and trusting — which describes most insurance agency staff pretty well.
Let's break down exactly what these emails look like and how your team can learn to spot them.
What a Modern Phishing Email Looks Like
The phishing emails targeting insurance agencies right now often impersonate:
Insurance carriers — asking you to verify a policy, update payment info, or review a claim
E&O or compliance providers — warning about an urgent deadline or audit
Microsoft or Google — telling you your email account or OneDrive has been flagged
A fellow agent or colleague — asking you to review a document or wire funds
Your own agency's IT or management — requesting a password reset or system update
The emails usually have a sense of urgency. 'Your account will be suspended.' 'Action required before 5pm.' 'Client policy at risk.' That pressure is intentional — it's designed to make you act before you think.
The Red Flags to Watch For
Even well-crafted phishing emails usually have tells if you know what to look for. Train yourself and your staff to pause and check for these:
The sender's email address doesn't quite match — it might say 'Erie Insurance' but the actual address is [email protected]
There's a link in the email, and when you hover over it (without clicking), the web address that appears looks strange or doesn't match the company
The email is asking you to enter a username and password — legitimate companies almost never ask for this via email
Something feels slightly off about the writing, the logo, or the formatting — trust that instinct
You weren't expecting the email — a carrier reaching out about a specific policy you don't recognize
There's an attachment you weren't expecting — especially a .zip, .exe, or even a PDF asking you to 'enable content'
A good rule of thumb: if an email is asking you to click something or enter information, go directly to the website by typing it yourself instead of using the link in the email.
What Happens If Someone Clicks
We want to be clear about this because it's important: if someone on your team clicks a phishing link, it doesn't mean they're careless or did something wrong. These emails are designed by professionals to fool people. It happens to smart, experienced employees at companies of all sizes.
What matters most is what happens next. Depending on the type of phishing attack, clicking can:
Take the person to a fake login page that captures their username and password
Automatically download malware or ransomware onto their computer
Give hackers remote access to that machine and potentially your entire network
Lead to a compromised email account that then sends phishing emails to your clients
The faster you catch it, the better. Which leads to an important question — does your staff know what to do if they think they clicked something bad?
What to Do If You Think You've Been Phished
Don't wait, don't hope it's fine, and please don't try to handle it quietly. Here's what to do immediately:
Disconnect the computer from the internet (unplug the ethernet or turn off Wi-Fi) to stop any potential spread
Do NOT turn the computer off — this can actually make recovery harder in some cases
Change your email password immediately from a different device
Enable multi-factor authentication on your email if it isn't already on
Call your IT provider right away — the sooner they can assess what happened, the better
Acting quickly can make the difference between a minor incident and a serious breach.
The Best Defense Is a Prepared Team
Technology can help filter out a lot of phishing emails before they ever reach your inbox. But no filter catches everything. Your team is your last line of defense, and a team that knows what to look for is genuinely one of the most powerful security tools you have.
Taking 20 minutes to walk your staff through what phishing looks like — and what to do if they're not sure about an email — can prevent a situation that costs you days of downtime and untold damage to client trust.
In our next article, we'll walk through what actually happens to an agency after a data breach — the legal requirements, the client conversations, and the recovery process most owners never think about until they're in the middle of it.
Up Next: Part 3 — What Really Happens to an Agency After a Data Breach
Think your team could spot a phishing email? Contact FTS Technology Group
