Article

How to Protect a Small Business From Phishing (2026 Guide)

October 28, 2026 · 15 min read

Knowing how to protect a small business from phishing matters because the attack needs no technical skill to start and only one rushed click to succeed. Criminals send convincing emails, texts and phone calls that pretend to be a supplier, a bank, a colleague or a software provider, and they hope someone acts before thinking. Small businesses are attractive targets because payments often depend on one or two people and there is rarely a dedicated security team. This guide gives you real-style examples of phishing messages, a 45-minute staff training exercise, a simple response plan and a plain-English explanation of SPF, DKIM and DMARC. Nothing here guarantees you will never be caught out, but each step lowers the odds and limits the damage if someone is.

Key takeaways

• Phishing works by creating urgency and borrowing trust, so train people to check the request itself, not just spelling or logos.
• Never change supplier bank details or approve an unusual payment based on email alone; confirm using a phone number you already hold.
• SPF, DKIM and DMARC stop criminals forging your domain to trick your customers. They do not stop phishing emails arriving in your own inbox.
• Multi-factor authentication limits the damage of a stolen password, and a written response plan saves critical minutes.
• Short, blame-free practice sessions with a reporting habit beat one long annual lecture.

How phishing targets small businesses

Phishing is any attempt to trick a person into handing over credentials, money or access by pretending to be someone trustworthy. It is the most common way attackers get into small organisations in every region, because it targets people rather than software. The delivery channel changes, but the psychology is the same: urgency, authority, fear or curiosity.

The main types you will meet

• Bulk email phishing: generic messages sent to thousands of addresses, such as fake parcel notices or password alerts.
• Spear phishing: a tailored message that uses your name, role, supplier or recent project, often gathered from your website and social profiles.
• Business email compromise (BEC): a fraudster impersonates a boss, supplier or advisor, or takes over a real mailbox, to redirect a payment or request sensitive data.
• Smishing and vishing: the same tricks by text message or phone call, sometimes with a cloned voice.
• QR code phishing: a code in an email, poster or invoice that leads to a fake login page.

Why small teams are exposed

In a small company one person may handle email, payments, and the website login. There may be no second pair of eyes, no formal approval step and no written procedure. Staff also work across personal phones and shared inboxes, which makes it harder to notice something odd. The good news is that small teams can change habits quickly: a single clear rule about payment changes can close the most expensive gap in a week.

Phishing email examples you can show your team

The examples below are fictional but modelled on patterns that are widely reported around the world. Replace the details with your own supplier names and tools when you show them to staff, so the lesson feels real.

Example 1: the supplier who changed bank details

Subject: Updated payment details – invoice 4471. Hi Sam, please note our bank has changed. Pay this week's invoice to the new account below, and confirm once done. Thanks, Priya.

What gives it away: it arrives just before a real payment is due, it asks for a change that benefits only the sender, and the reply-to address may differ slightly from the supplier's usual one. Sometimes the email is genuinely from the supplier's hacked mailbox, so even a correct address is not proof. This is classic business email compromise.

Example 2: the fake account alert

Subject: Your mailbox password expires today. Your password will expire in 2 hours. Keep your current password by signing in here. IT Helpdesk.

What gives it away: artificial deadline, generic greeting, a link whose visible text does not match the real destination, and a sign-in page that is not on your provider's actual domain. Real IT teams rarely ask you to click a link to keep a password.

Example 3: the urgent request from the boss

Subject: Quick favour. Are you at your desk? I am in a meeting and cannot talk. I need you to buy gift vouchers for a client today. I will repay you. Reply only by email.

What gives it away: the "reply only by email" instruction, the secrecy and the unusual request. The display name looks right, but the sending address is a free webmail account. Attackers copy names from your team page, so assume they know who works for you.

Red flags that still work when the writing is perfect

Older advice said to look for spelling mistakes. That is no longer reliable: AI writing tools and translation make scam messages fluent in any language. Training should focus on what is being asked and how, not on how well it is written.

Check the request, not the grammar

• Is it asking for money, credentials, a gift card, a code or a change to payment details?
• Is there pressure to act quickly or keep it secret?
• Does it bypass normal process, such as "skip the purchase order this once"?
• Does it come from an unexpected channel, such as a new phone number or a personal address?

A 30-second safe-check routine

1. Pause. Urgency is the signal, not the reason to hurry.
2. Hover over links, or better, open the site by typing the address yourself or using a saved bookmark.
3. Check the full sender address, not just the display name.
4. Confirm any money or access request through a second channel you already trust.
5. If in doubt, report it using your agreed method and delete nothing until told.

Quick reference table

Type	Typical signal	Safe response
Fake invoice or bank change	New account details, deadline close	Call the supplier on a known number before paying
Account alert	Link to sign in, expiry threat	Go to the service directly; report the message
Boss impersonation	Secrecy, gift cards, urgent transfer	Phone or message the person on a known channel
Shared document lure	Unexpected file, login required	Ask the sender separately whether they sent it
Text or call (smishing, vishing)	Bank or courier claim, request for codes	Hang up, call the official number yourself

Business email compromise: controls for payments and invoices

Business email compromise tends to cost more per incident than ordinary phishing because it targets money directly. The defence is mostly process, which costs nothing but discipline.

Verify by a second channel

Write one rule and keep it simple: any new payee, changed bank detail or unusual payment request is confirmed by phone, using a number from your own records, not from the email. Tell your regular suppliers and clients that you do this, so a request for a callback is never seen as rude.

Split the approval

Where you have more than one person, let one prepare a payment and another approve it. If you are a solo owner, add a delay instead: hold first-time or changed payments for a set time, such as one working day, and use that time to verify. Banks in many countries offer name-checking or confirmation-of-payee tools; availability varies, so ask your bank what it provides in your region.

Watch for hidden mailbox rules

Attackers who gain access often create rules that forward or hide messages so you do not see replies. Periodically check inbox rules and forwarding settings for each mailbox, and review sign-in activity if your email platform offers it. Unexpected rules are a strong sign that an account has been compromised.

SPF, DKIM and DMARC in plain English

These three DNS-based settings help receiving mail servers decide whether a message that claims to be from your domain is real. They protect your customers and suppliers from criminals who forge your address. They do not filter phishing aimed at you, and they will not catch a lookalike domain such as a name with one letter swapped. Think of them as protecting your reputation, not your inbox.

SPF: who may send for you

Sender Policy Framework is a published list of the servers and services allowed to send email for your domain. A simple record looks like this, with your own provider's values in place of the placeholder:

v=spf1 include:_spf.yourmailprovider.example ~all

Include every service that sends as you, such as your email provider, invoicing tool and newsletter platform. A domain should have only one SPF record.

DKIM: a seal on each message

DomainKeys Identified Mail adds a digital signature to outgoing messages. The receiving server checks the signature against a public key you publish in DNS. If the message was altered or sent by someone without your key, the check fails. Most email and marketing providers give you the DNS records to add; you simply paste them in.

DMARC: what to do when checks fail

DMARC ties the two together and tells receivers what to do when SPF and DKIM do not line up with the visible From address. It also sends you reports. A cautious starting record is:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.example

1. Start with p=none to monitor only, and read the reports for a few weeks.
2. Fix any legitimate services that fail checks.
3. Move to p=quarantine, then p=reject when you are confident.

Moving too quickly can send your own invoices to spam, so go step by step. Many email providers publish setup guides, and rules and recommended practice for bulk senders are changing, so check your provider's current documentation.

Technical layers that reduce the damage of a click

No training prevents every mistake, so assume that someday someone will click. The aim is to make a click survivable.

Multi-factor authentication and passkeys

Turn on multi-factor authentication (MFA) for email first, then for banking, accounting and admin accounts. Phishing-resistant options such as passkeys or hardware security keys are stronger than text-message codes, though any MFA is better than none. Rolling it out badly can lock people out, so plan recovery options first; our guide on how to roll out MFA without locking everyone out walks through this.

Filtering, updates and least privilege

• Use your email provider's spam, link and attachment filtering, and keep it on its strictest sensible setting.
• Install updates on devices and browsers promptly, since some attacks follow a click with a known software flaw.
• Give staff only the access they need, so one stolen login cannot reach everything.
• Use a password manager, which also helps because it will not autofill on a fake site.
• Keep backups that are separate from your main systems.

For a ranked list of these steps by effort and impact, see our small business cybersecurity checklist. If you prefer guided learning, the AI-Assisted Cybersecurity Learning Kit combines an ebook, audiobook, AI tutor prompts and exercises on topics like these, all delivered as digital downloads in your online library.

A 45-minute employee phishing training exercise

Employee phishing training works best when it is short, concrete and blame-free. This session suits teams of two to twenty and needs no special software.

Before you start

Collect six to eight messages: three or four real phishing attempts your business received (remove personal data) and three genuine messages that look slightly unusual, such as a real supplier invoice. Mixing them teaches judgement, not suspicion of everything. Agree one reporting method in advance, such as a dedicated address or a chat channel, so people know exactly where to send suspicious items.

Running the session

1. Minutes 0-5: explain that the goal is learning, and that reporting a mistake quickly is always welcome.
2. Minutes 5-20: show each message on screen. Staff individually mark it as safe or suspicious and write one reason.
3. Minutes 20-30: discuss the answers. Highlight the request and the pressure, not just the technical clues.
4. Minutes 30-40: role-play a payment change request. One person plays the "supplier" on the phone while another practises the callback routine.
5. Minutes 40-45: recap the 30-second safe-check routine and confirm how to report.

Measuring and repeating

Track how many suspicious messages staff report, and how quickly, rather than how many people "fail". A rising report rate shows the habit is forming. Repeat a short version every quarter with fresh examples. If you use simulated phishing emails, tell staff the programme exists, avoid humiliating anyone and check local employment and privacy rules, which differ between countries.

A phishing response plan for the first hour and beyond

When someone clicks, the first hour is about speed and calm. Write the plan down now, print it, and keep a copy outside your email system. For a deeper walk-through, read what to do in the first hour after clicking a phishing link.

Roles and first steps

Name an incident lead, a backup, your IT provider or technical contact, and the person who can contact the bank. Then follow these steps in order:

1. The person reports immediately to the incident lead. No blame.
2. Disconnect the affected device from the network, but do not wipe it yet.
3. From a different, clean device, change the password of any account involved and sign out all active sessions.
4. Check that MFA is on and review mailbox rules, forwarding and recent sign-ins.
5. If money was sent or details changed, call your bank at once and ask about recalling the payment. Speed matters.
6. If credentials were entered on a fake site, change the same password anywhere else it was used.
7. Warn staff, and where needed customers or suppliers, that fake messages may be sent from the affected account.
8. Save evidence: screenshots, the original message and its headers, and times.

Reporting and learning

Reporting duties differ by country and sector. Some places require you to notify a data protection authority within a fixed period if personal data is affected; others do not. Many countries have a national fraud or cyber reporting service, and your insurer may need prompt notice. Our article on whether you have to report a data breach explains how to think it through, and local legal advice is wise where personal data is involved. Afterwards, hold a short review: what happened, what worked, which rule would have prevented it, and update the plan.

Conclusion

Protecting a small business from phishing combines people, process and technology. Teach staff to question the request, confirm payment changes by a second channel, publish SPF, DKIM and DMARC so your domain is harder to forge, and turn on MFA so one password is not enough. Practise with short sessions, and keep a written response plan ready so that when a mistake happens, the team knows exactly what to do. These steps reduce risk and limit harm, though no business can remove phishing risk completely.

Frequently asked questions

What is the best way to protect a small business from phishing?

No single step is enough, so combine several. Train staff to question unusual requests, confirm payment changes by phone, turn on multi-factor authentication for email and finance accounts, and keep a written response plan. These layers reduce the chance and the cost of a successful attack.

How can I tell if an email is phishing?

Look at what the message asks for. Requests for money, passwords, codes or changed bank details, combined with urgency or secrecy, are the biggest warning signs. Also check the full sender address and where links really lead, and confirm through a separate channel if unsure.

Do SPF, DKIM and DMARC stop phishing emails reaching my staff?

Not directly. They help receiving servers detect messages that forge your domain, which protects your customers and suppliers. Inbound phishing to your team needs email filtering, training and MFA, and lookalike domains are not caught by these settings.

What is business email compromise?

Business email compromise is fraud where an attacker impersonates a trusted person, or uses a hacked mailbox, to redirect payments or obtain sensitive information. It often involves fake invoices or bank detail changes. A callback check and split approvals are the main defences.

What should I do immediately after clicking a phishing link?

Tell your incident lead straight away, disconnect the device from the network, and change affected passwords from a different clean device. Then check MFA, mailbox rules and recent sign-ins, and contact your bank at once if money or payment details were involved.

How often should employees get phishing training?

A short session at onboarding and a refresher about every quarter works better than one long annual lecture. Use fresh examples, including real attempts your business received, and encourage people to report suspicious messages without fear of blame.

Do I have to report a phishing incident to the authorities?

It depends on your country, your sector and whether personal data was affected. Some jurisdictions require notifying a regulator within a set time, while many offer voluntary fraud reporting. Check your local rules or seek advice, and notify your bank and insurer promptly.

Is simulated phishing a good idea for small businesses?

It can help if it is introduced openly and used for learning, not punishment. A simple discussion-based exercise with example messages is often enough for small teams. Check local employment and privacy rules before sending simulated emails to staff.

All articles