Phishing is the most common way small businesses get breached, and it does not target your firewall. It targets your people. One convincing email, one click on a fake invoice, and an attacker is reading your inbox, rerouting payments, or locking your files. Small businesses are favorite targets because attackers assume, usually correctly, that nobody is watching.
What phishing looks like at work
- A fake invoice or payment request. It looks like a vendor you use. The account number is the only thing that changed.
- An email from "the boss." The owner's name, a rushed tone, and a request to buy gift cards or wire money today.
- A login page that is not real. A link says your Microsoft or Google password expired. The page it opens sends your password to the attacker.
- A package or bank alert. A text or email about a delivery problem or frozen account, with a link that installs something you cannot see.
The tell is urgency plus a request. Money, passwords, gift cards, or a login, needed right now, from someone who contacted you first. When those show up together, stop and verify by phone.
What one click can cost
A compromised email account is not just embarrassing. Attackers use it to bill your customers with altered account numbers, spread malware under your name, and reset passwords for everything else you use. Cleanup means downtime, awkward calls to customers, and sometimes real legal exposure if customer data leaks.
How to protect your team
- Turn on two-step verification everywhere. A stolen password alone stops working. This is the single highest-value change a small business can make.
- Verify payment changes by phone. Any email that changes an account number or payment method gets a phone call to a number you already had.
- Give everyone their own account. Shared logins mean one phished password opens everything, and you cannot tell who clicked.
- Talk about it openly. A team that reports a suspicious click in five minutes beats one that hides it for a week. Make reporting safe.
Clicked something already?
Change the affected password from a different device, turn on two-step verification, and tell whoever handles your IT right away. Speed matters far more than blame. If money moved, call your bank immediately.