April Fools' Day is over—but online tricksters persist.
Phishing attacks usually increase in spring, not from carelessness, but because busy teams move quickly. This pace allows convincing messages to go unnoticed until damage is done.
Below are three schemes that increasingly target diligent, well-intentioned employees, including those who are well-informed.
Scheme 1: The Fake Toll or Parking Text
A text says, “You have an unpaid toll balance of $6.99. Pay within 12 hours to avoid late fees,” and references a real toll system, such as E-ZPass, SunPass, or FasTrak, depending on the state. The small amount and a busy schedule prompt the employee to click, pay, and move on.
However, the link is fake.
In 2024, the FBI received over 60,000 complaints about fake toll texts, and in 2025, that number increased by 900%. Researchers have identified more than 60,000 fake domains mimicking state toll systems.
This scam is effective because a $6 charge seems minor, and since most people have recently used toll roads or parking, it appears plausible.
Legitimate toll agencies will not request payment through text links. Following established processes is your best defense. Set a clear policy prohibiting payments via text-message links. If a message seems legitimate, employees should visit the official website or app directly. Do not reply to the message, even with 'STOP,' as any response confirms the number is active.
Scheme 2: The “Your File Is Ready” Email
An employee receives an email indicating a document has been shared, such as a contract in DocuSign, a spreadsheet in OneDrive, or a file in Google Drive. The sender appears legitimate, and the formatting matches standard file-share notifications.
The employee clicks the link and enters their credentials to log in.
As a result, the attacker obtains these credentials. If a work login is used, the attacker gains access to the company’s cloud environment.
Phishing campaigns abusing trusted platforms like Google Drive, DocuSign, and Microsoft increased 67% in 2025, according to KnowBe4’s Threat Labs. Google Slides-based phishing links alone rose over 200% in a recent six-month period. Employees are seven times more likely to click a malicious link from OneDrive or SharePoint than from an unknown sender, as the notification looks identical to the real thing.
Recent versions of this scheme are harder to detect. Attackers create files within compromised accounts and use the platform’s sharing feature to send notifications. These emails come from legitimate servers, so spam filters do not flag them.
Recommended action: If you did not expect a shared file, do not click the email link. Instead, open a browser and log in to the platform directly; if the file is legitimate, it will appear there. Restrict external file-sharing permissions and enable alerts for unusual login activity. Both measures can be set up quickly and significantly reduce risk.
Developing consistent habits may seem routine, but they remain highly effective against evolving threats.
Scheme 3: The Email That’s Written Too Well
Previously, phishing emails were identified by poor grammar and obvious warning signs. This is no longer a reliable indicator.
A 2025 academic study found that AI-generated phishing emails resulted in a 54% click rate, compared to 12% for those written by humans. These emails appear legitimate, referencing real company names, job titles, and workflows sourced from LinkedIn and company websites.
Targeting has become more precise. HR and payroll teams receive fraudulent employee verification requests, while finance teams encounter vendor payment redirect scams. In a recent test, 72% of employees interacted with a vendor impersonation email, a rate 90% higher than other phishing types. These messages are calm, professional, and subtly urgent, prompting action without raising suspicion.
Recommended action: Verify any request involving credentials, payment changes, or sensitive data through a secondary channel, such as a phone call, chat message, or in-person conversation. Before clicking any link, hover over the sender’s address to confirm the actual domain. Treat any strong sense of urgency in an email as a warning sign.
Remember, effective security relies on calm, not urgency or panic.
The Common Thread
All three schemes exploit familiarity, authority, and timing to make them appear routine parts of the workday.
The main risk is not employee carelessness, but assuming that everyone always acts cautiously under pressure. A single rushed click is a process issue, not a personnel issue, and process issues can be addressed.
How We Can Help
Most business owners want assurance that their business is not unknowingly exposed to risk. They are not looking for additional internal projects or extensive cybersecurity training.
If you are unsure about your team’s current risks, take the next step and let us review them with you.
Schedule a discovery call, and we will review the following:
- Current risks businesses like yours are facing.
- Common points where issues arise during daily operations.
- Practical steps to reduce exposure without slowing your team.
Contact us or give us a call at [763-331-6221] if you'd like to schedule a call.
Whether you become a client or not, taking steps to stay informed reduces business risk. Share this article with anyone who could benefit, and remember: updating your team's processes can make the difference between costly errors and protected operations.
_______________________________________________
About The Mac Guys: We support small businesses that run on Macs, iPhones/iPads, and Apple services. Our focus is practical reliability: setup, troubleshooting, maintenance, security basics, and workflow improvements.
