Spanish-language phishing: the threat SMBs underestimate

Bruce Schneier has repeated for years that the weakest link is human, not the firewall. In Puerto Rico and broader LatAm that amplifies: many organizations bought email security suites calibrated for corporate English, while attackers draft flawless Spanish with Caribbean or Mexican formal tone depending on the target.

Spanish BEC does not look like spam

Spanish BEC does not look like spam. It looks like the accountant, Popular or FirstBank, or a Caguas materials vendor asking to update ACH details. It includes local references, relevant tax dates, and sometimes replies inside previously compromised real threads. The Hacker News reports regional campaigns monthly; a mid-size distributor's accounting team does not read THN — they read the inbox.

Three signals we teach in cwAWARE workshops: artificial urge

Three signals we teach in cwAWARE workshops: artificial urgency ("close today before 3pm"), payment instruction changes in the same thread, and senders on domains one character off the real one. Nothing revolutionary, but it must be practiced in quarterly simulations, not an annual PDF.

Technically, combine DMARC with reject policy, mark external senders in Outlook or Google Workspace, and block Office macros by default. OWASP is not just for developers: its social engineering cheat sheet is useful reading for non-technical leaders.

Culture matters as much as tooling. In family businesses in PR it is common for the owner to approve transfers via WhatsApp. That channel needs explicit rules: no bank account changes without phone verification to a known number, not the one in the email.

Spanish phishing is not a "developing countries" problem. It is a process maturity problem. The good news: well-run awareness reduces dangerous clicks faster than any new appliance.