How to Spot and Stop Phishing Attacks in a Small Business
Phishing is still the easiest way into a small business, because it targets people instead of software. The good news is that most phishing attempts share the same warning signs, and a few simple habits and settings stop the majority of them. Here is how to recognize an attack, verify suspicious requests and make your whole team harder to fool.
Key takeaways
- Phishing works by creating urgency, authority or fear, so slow down whenever a message pushes you to act fast.
- Business email compromise, where criminals impersonate a boss or supplier to redirect payments, is one of the most costly forms of cybercrime reported to the FBI.
- Verify every payment change or unusual request through a separate, known channel, never by replying to the message.
- Combine people, process and technology: training, a simple reporting habit, email authentication and phishing-resistant sign-in.
Phishing is any attempt to trick someone into giving away credentials, money or access by pretending to be a trusted person or organization. It started with mass emails claiming to be from banks. Today it includes highly targeted messages that reference real projects, real suppliers and real colleagues, as well as text messages (smishing), phone calls (vishing), QR codes and fake chat messages.
Verizon's annual Data Breach Investigations Report has consistently found that the human element, including people clicking malicious links, falling for social engineering or making errors, is involved in a majority of the breaches it analyzes. Small businesses are attractive targets because they often lack dedicated security staff while still handling payments, customer data and access to larger partners.
Our general cybersecurity checklist touches on phishing as one item. This guide goes deeper into how attacks work and what to do about them.
The most common types of phishing
Credential phishing
A message asks you to sign in to fix a problem: a full mailbox, a shared document, an unpaid invoice or a security alert. The link leads to a fake login page that captures your password and, in more advanced kits, your one-time code too.
Business email compromise (BEC)
The attacker impersonates someone you trust, such as the owner, a supplier, a client or a lawyer, and asks for a payment, a change of bank details or gift cards. Sometimes they use a look-alike domain. Sometimes they have taken over the real mailbox, which makes the request look completely genuine.
Because many victims never report, the real figure is likely higher. Later IC3 reports have continued to list BEC among the costliest categories of crime, so check the latest edition for current numbers.
Malware attachments and links
An attachment or download link installs malicious software, sometimes ransomware. Common lures include invoices, shipping notices, résumés and "scanned documents."
Smishing, vishing and QR phishing
Text messages about failed deliveries, calls from "IT support" asking you to install remote access software, and QR codes on posters or in emails that lead to fake login pages all use the same tricks in a different channel. QR codes are especially sneaky because people cannot see the destination before scanning.
Warning signs to look for
No single sign proves a message is malicious, but several together should stop you in your tracks.
| Warning sign | What it looks like | What to do |
|---|---|---|
| Urgency or pressure | "Pay today or the account will be suspended" | Pause and verify before acting |
| Unusual request | The owner asking for gift cards or a secret transfer | Call the person on a known number |
| Changed payment details | A supplier says its bank account has changed | Confirm with a known contact by phone |
| Mismatched sender | Display name is right, but the address or domain is slightly off | Check the full address, letter by letter |
| Suspicious link | Hovering shows a domain unrelated to the sender | Do not click; go to the site directly |
| Unexpected attachment | An invoice or document you were not expecting | Confirm with the sender before opening |
| Login page from a link | A message that leads straight to a sign-in screen | Close it and log in from your bookmark |
Common mistake
Relying on spelling errors to spot phishing. Many modern phishing messages are well written, and generative AI tools make polished text easy for criminals to produce. Focus on the request and the context, not the grammar.
The one habit that stops most payment fraud
Business email compromise depends on one thing: you trusting the message. The defense is a firm rule that payment changes and unusual requests are always verified through a separate channel you already know.
- Do not reply to the message. If the mailbox is compromised or spoofed, a reply goes straight to the attacker.
- Find the contact details yourself. Use the phone number in your accounting system, a past contract or the official website, not the one in the email.
- Call and confirm. Ask the person to confirm the request and, for bank changes, the new account details.
- Require a second approver. For new payees or bank changes above a set amount, a second person signs off before money moves.
- Record the check. Note who confirmed, when and how, so the process is visible and repeatable.
Hypothetical example
Suppose a small manufacturer's bookkeeper receives an email from a long-time supplier, sent from what looks like the real address, saying the supplier has switched banks and attaching a letter on its letterhead. Following the company's rule, the bookkeeper calls the supplier using the number in the purchasing system. The supplier knows nothing about a bank change. Its mailbox had been taken over, and a phone call prevented a large invoice from going to a criminal's account.
Build technical defenses
People will occasionally click. Technical controls catch many attacks before they reach an inbox and limit the damage when one gets through.
- Use your email provider's security features. Major business email services include spam and malware filtering, link scanning and warnings for external senders. Review the settings and turn on the recommended protections.
- Set up SPF, DKIM and DMARC. These email authentication records help receiving servers spot messages that fake your domain. Our guide to setting up a domain and business email explains them step by step.
- Turn on multi-factor authentication. CISA recommends MFA as a key defense, and phishing-resistant methods such as security keys and passkeys can stop credential phishing even when someone enters their password on a fake page. Our explainer on two-factor authentication covers the options.
- Use a password manager. Password managers usually autofill only on the real website, which gives a useful warning when a look-alike page asks for your login. Our separate password manager guide covers choosing one.
- Keep devices updated. Updates close the security holes that malicious attachments try to exploit.
- Limit admin rights. Everyday accounts without administrator privileges make it harder for malware to install itself.
Pro tip
Ask your email administrator to add an "External" tag or banner to messages from outside your organization. A message that claims to be from the owner but carries an external banner is an instant red flag that even busy staff will notice.
Train your team without boring them
Security training works best when it is short, frequent and practical. A one-hour annual presentation is quickly forgotten. Instead:
- Share a real phishing example from your own inbox each month and discuss the clues.
- Run short simulated phishing tests if your email or security tools offer them, and treat results as learning, not punishment.
- Make it easy to ask: "Is this real?" should be a normal question, never an embarrassing one.
- Praise people who report suspicious messages, especially when they turn out to be harmless.
What to do if someone clicks
Speed matters more than blame. Make sure everyone knows that reporting a mistake immediately is the right thing to do.
- If a password was entered: change it at once from a known-good device, sign out of all sessions and check that 2FA settings and recovery options have not been changed.
- If an attachment was opened: disconnect the device from the network and contact whoever handles your IT.
- If money was sent: call your bank immediately and ask about recalling the payment. Speed improves the chance of recovery.
- Check for mailbox rules. Attackers often create forwarding or filtering rules to hide replies. Review and remove any you did not create.
- Report it. In the US, CISA and the FBI's IC3 accept reports, and many other countries have national reporting services, such as the UK's Suspicious Email Reporting Service run by the National Cyber Security Centre.
Habits that protect you
- Verifying payment changes by phone
- Logging in from bookmarks, not links
- Reporting suspicious messages quickly
Habits that expose you
- Approving urgent requests by email alone
- Hiding mistakes for fear of blame
- Sharing one login among several people
Your anti-phishing checklist
- Write a one-paragraph rule: all payment changes are verified by phone using a known number
- Require a second approver for new payees and bank detail changes
- Turn on the recommended security settings in your email service
- Add an external sender banner to incoming email
- Set up SPF, DKIM and DMARC for your domain
- Enable multi-factor authentication on all email accounts
- Create a simple way to report suspicious messages, such as a shared address or button
- Share one real phishing example with the team every month
- Write down the first steps to take if someone clicks or sends money
Frequently asked questions
Is it safe to open a phishing email?
Simply opening an email is usually low risk with an up-to-date email app, but clicking links, opening attachments, enabling content or replying can be dangerous. If in doubt, report it and delete it without interacting.
How can I check a link without clicking it?
On a computer, hover over the link to see the real destination. On a phone, press and hold to preview it. Look carefully at the domain, the part just before the first single slash. If it is unfamiliar or slightly misspelled, do not open it.
Does cyber insurance cover phishing losses?
Some policies cover certain social engineering or funds transfer fraud, often with limits and conditions, such as proof that you verified payment changes. Read your policy carefully and ask your broker for specifics.
Are small businesses really targeted?
Yes. Many phishing campaigns are automated and hit any address they can find, and targeted fraud often focuses on smaller firms because their payment checks may be weaker than those of large companies.
Related reading
The bottom line
Phishing relies on speed and trust. Slow down, verify unusual requests through a channel you already know, and back those habits up with email security settings, multi-factor authentication and a culture where reporting is encouraged. Most attacks fail when one person simply pauses and picks up the phone.
