Top tips: How to spot a scammer pretending to be your boss

Top tips is a weekly column where we highlight what's trending in the tech world and share practical ways to navigate these shifts. This week, we're looking at spear-phishing: how cybercriminals weaponize social engineering, why your natural instinct can act as a security blind spot, and practical steps to verify suspicious requests before you take action.

I would like to make a confession: I’m a well-versed tech expert, but I almost fell for a phishing scam. What you’re about to read is a true story.

The deception did not start with a poorly written email from a distressed prince in a remote country offering me a share of his gold.

It was roughly 7:30am. My phone buzzed next to my bed, dragging me out of a deep sleep. I squinted at the screen to see a message from my manager, asking me to urgently run an errand for him before the workday started. The situation actually seemed reasonable—my manager was out of country at the time, in a significantly different time zone. In the email, he asked me to buy a peculiar item from a nearby computer store, which he mentioned by name. 

Now, if you're wide awake and fully caffeinated, the red flags from my story are already waving violently in your face. But when you're groggy from sleep, staring at a message with your manager's name in the sender field, and conditioned by corporate culture to be a helpful employee, logic tends to take a back seat.

Within minutes, I was pulling on my shoes, ready to comply with this unusual, early-morning request, and actively ignoring a chorus of screaming warning signs. It wasn't until I mentioned the email to a friend that I called on the way to the computer store that they stopped me in my tracks: "That’s a scam. Do not reply!"

That was when the illusion shattered. My manager hadn't suddenly forgotten how to use his corporate email or had an urgent need for me to go to the store. I was being spear phished!

In today’s world, cybercriminals don't just cast a wide net and wish for the best; they do their homework, and they do it well. They know where you work, who you report to, and exactly which psychological buttons to push to lure you in. This makes your alertness and vigilance more necessary than ever. 

Let's take a look at some key tips to help keep your guard up when the scammer makes it personal.

1. Watch out for the "artificial urgency" trap  

Despite how they are typically portrayed in movies, most capable hackers and scammers don't even need to write a single line of code. All they need to do is to exploit basic human psychology.

One way they achieve that is by weaponizing time. They deliberately create a sense of panic, such as dropping a message saying, "I'm heading into a meeting; I need this done now!" to prevent you from stopping to think.

If a request demands immediate action outside of normal procedures, that’s when you need to slam the brakes. Real workplace emergencies rarely rely on a single, out-of-the-blue text message.

2. Implement the "out of band" verification rule  

How do you verify a message without feeling awkward about second-guessing your boss? Simply change the channel. If you get an unusual request via email, verify it via your corporate chat like Slack or Teams, or just make a quick phone call.

Scammers can spoof a phone number or hack an email, but they rarely have access to two distinct communication channels at once.

3. Beware of authority bias  

Most people are wired to say "yes" to leadership, and scammers will use that against you. They know you'll be afraid to look unhelpful or insubordinate, and they know exactly how to exploit this fear at the right moment.

However, a good manager will never fault you for taking sixty seconds to step back and verify a security concern. On the contrary, it proves to them that you are a vigilant and self-aware employee. Therefore, it is crucial to remember that you have the permission to say "no" or "let me double-check"—even to the CEO!

4. Audit your digital footprint  

Wait, how did the scammer know your boss's name to begin with? The answer is more trivial than you think. Your employment information is proudly displayed on LinkedIn, right next to your alma mater, your job history, and maybe even your dog's name!

Now, you don't need to delete all social media, but you do need to view your public profiles through the eyes of a malicious social engineer. The more puzzle pieces you leave lying around the internet, the easier it is for a scammer to build a convincing picture of who you are, who you work for, and therefore, how to exploit you.

Conclusion  

Falling for (or almost falling for) these dirty tricks doesn't make you foolish; it just makes you human. Security isn't about 24/7 paranoia. It's simply about building the habit of pausing before reacting.

Keep these simple tips in mind, and you'll be able to smell a spear-phishing attack from a mile away. Above all else, consider it one of the trivial, yet golden rules of cybersecurity: never rush to act on a frantic work message the moment you wake up. At least give it until the coffee kicks in, and don't be afraid to double-check!