How to Prevent Phishing Attacks in a Small Business
Phishing is the front door for most small-business breaches: a convincing email, a rushed click, a stolen password, and suddenly the attacker is inside your mailbox reading real conversations and sending believable payment requests. The defence has two halves — technology that filters, and people who pause. You need both.
How phishing actually works in a small business
Modern phishing is rarely a badly spelled lottery scam. Attackers copy your suppliers' invoice formats, imitate Microsoft 365 and Google sign-in pages, and time messages to real events — a delivery, a tax deadline, a boss's travel day. The most damaging variant, business email compromise, involves no malware at all: the attacker logs in with a stolen password and simply asks your bookkeeper, in your writing style, to change a supplier's bank details.
Technical defences to switch on
1. Multi-factor authentication — the phish that fails
If a password is stolen but MFA blocks the login, the attack usually dies there. Enforce MFA for every user, and prefer app or hardware-key approval over SMS. Also train staff to deny any MFA prompt they did not just trigger — "MFA fatigue" attacks rely on people approving prompts to make them stop.
2. Email authentication: SPF, DKIM and DMARC
These three DNS records prove that email claiming to be from your domain really is. Set DMARC to reject unauthenticated mail from your domain; it stops attackers spoofing YOU to your own customers and suppliers.
3. Filtering, banners and forwarding rules
Enable your platform's advanced phishing and malware filters. Add an "external sender" banner so staff instantly see when a "manager's" message actually came from outside. Block automatic forwarding to external addresses and alert on new inbox rules — attackers quietly create both after a compromise.
The human layer: a 10-second habit
Teach every employee the same three checks before acting on any message that asks for money, credentials or data:
- Sender: is the domain exactly right — or a look-alike with a swapped letter?
- Surprise: is this request unusual, urgent or secret? Urgency is the attacker's main tool.
- Separate channel: for bank-detail changes and big payments, verify by calling a number you already have — never one from the email itself.
Run short refreshers monthly and share real examples (with names removed) whenever a suspicious email reaches your team. People who report phishing quickly are an early-warning system, not a problem.
What to do if someone clicks
- Change the account password immediately and revoke active sessions.
- Check inbox rules and forwarding for tampering.
- Review sign-in logs for unfamiliar locations or devices.
- Warn anyone the mailbox may have emailed, especially about payment requests.
- Record what happened and add the lesson to your next training.
Phishing defence sits inside a wider setup — work through the full cybersecurity checklist, and make sure a successful phish cannot become a catastrophe by having ransomware protection and tested backups in place.
Frequently asked questions
Can software stop all phishing?
No filter is perfect, which is why the human habit and MFA matter: filters reduce volume, awareness catches the rest, and MFA limits the damage when something slips through.
Should we run simulated phishing tests?
Yes, gently — the goal is learning, not blame. Announce that tests happen, debrief kindly, and measure reporting speed, not just clicks.
Keep reading: the small business cybersecurity checklist · how to prevent phishing attacks · ransomware protection for small business