UpTrajectory Review

Hilary Osborne's piece in The Guardian US zeroes in on homoglyph attacks — scam emails that swap a single character in a URL for a near-identical one from a different alphabet, so the link looks right but routes you to a criminal's server. The example she leads with is a fake microsoft.com where the 'a' is actually a Cyrillic character, indistinguishable at a glance. The full piece sits behind a 'continue reading' cut, but the setup is clear enough: this is not about sloppy phishing with typos and strange domains. It is about attacks engineered to survive the two-second visual check most of us do before clicking, which is precisely why they work on people who consider themselves careful.

For a small-business operator, this is not an abstract IT problem. Your bookkeeper gets an email that looks like it is from your bank, your payroll provider, or a vendor you actually use, and the link passes every gut check. One click and a login later, the attacker is inside your accounts, or malware is on the machine that holds your customer list and your banking credentials. Small businesses absorb a disproportionate share of these losses because they lack a security team and because one person often wears every hat — the same person who approves invoices also resets passwords. The FBI's IC3 data has consistently shown business email compromise among the costliest cybercrime categories, and homoglyph tricks are one of the ways attackers make those emails look authentic.

What is genuinely new here is less the technique than its polish and scale. Homoglyphs have existed for years — the classic example is paypal.com with a Cyrillic 'a' — but browser makers have largely stopped displaying punycode (the xn-- prefix that once warned users), so the protection most people assume exists quietly disappeared. That is the under-reported part of this story: the security burden shifted to the user without anyone announcing it. We agree with Osborne's framing that the click decision is the weakest link, but we would push further. The real failure is upstream — email authentication standards like DMARC are supposed to catch spoofed senders, yet adoption among small businesses remains patchy, and attackers know it.

The second-order effects cut in a few directions. Employees who fall for these attacks face blame and sometimes dismissal, even though the technique is designed to defeat exactly the scrutiny they applied. IT consultants and managed service providers benefit — demand for email filtering and security training grows with every story like this — but the cost lands on the smallest businesses, where a five-figure loss from a fraudulent wire transfer can be existential. There is also a trust tax: as spoofing gets more convincing, legitimate emails from your own vendors start getting ignored or delayed, which slows down real payments and real orders.

The practical response is straightforward, and none of it requires a security budget. Treat every link in an unexpected email as hostile until proven otherwise: hover to preview the URL, type the address in yourself instead of clicking, and call the sender on a number you already have on file before moving money or changing payment details. Turn on multi-factor authentication for email, banking, and payroll — a stolen password alone should never be enough to get in. And if you run a domain, set up DMARC, SPF, and DKIM records so criminals cannot spoof you to your own customers. Watch whether browsers and registrars start cracking down on lookalike domains again, because right now the burden is entirely on you.

“It just goes to show that the split-second decision you make when clicking a link is often the most vulnerable part of the whole security chain.” — The Guardian US

Takeaway: Never click links in unexpected emails; type the address yourself, verify payment changes by phone, and turn on multi-factor authentication for email and banking.