Phishing Prevention for Small Business: A Practical Guide
By Nemanja Vukmirović, Lizzard Solutions. Last updated 12 November 2026.
Your bookkeeper gets an email from a regular supplier. Same logo, same signature, same tone. The only difference is one sentence: “We changed banks, please use the new account for this invoice.” She pays. The supplier never sent it.
That is phishing, and it rarely needs clever hacking. It needs one busy person and one believable message. Phishing prevention for small business is about making that moment harder: fewer fake emails reach the inbox, the ones that do are easier to spot, and a single click no longer opens the whole company.
TL;DR
- Phishing is a fake message that tricks someone into clicking, logging in, paying or sharing data. It targets people, not servers.
- Combine four layers: email filtering and authentication, MFA and a password manager, a payment verification rule, and short regular training.
- Make reporting easy and blame-free. A fast report from one employee protects everyone else who got the same email.
What is phishing?
Phishing is a social engineering attack in which a criminal pretends to be a trusted person or company to get the victim to click a link, open a file, enter a password, send money or share sensitive data. It usually arrives by email, but the same trick works over SMS, WhatsApp, Viber, phone calls and fake login pages.
CISA, the US cybersecurity agency, sums up the defence in its guide to recognizing and reporting phishing: recognise the signs, resist the urge to act fast, and report the message. The UK National Cyber Security Centre goes further in its phishing guidance for organisations and recommends several layers of defence, because no single control catches everything.
| Type | What it looks like | Typical goal |
|---|---|---|
| Credential phishing | “Your mailbox is full, sign in here” with a fake Microsoft or Google login page | Steal email or cloud passwords |
| Invoice / payment fraud | A supplier or partner “changes bank details” or sends an urgent invoice | Redirect a real payment |
| CEO fraud | A message that seems to come from the owner asking for a quick transfer or gift cards | Get money before anyone checks |
| Malicious attachment | A “delivery notice”, “offer” or “scanned document” you are asked to open | Install malware or ransomware |
| Smishing and vishing | SMS, messenger or phone calls posing as a bank, courier or IT support | Get codes, passwords or remote access |
How to spot a phishing email
Attackers keep getting better at design and language, so “bad grammar” is no longer a reliable sign. Teach your team to check the request, not the looks:
- Urgency or pressure. “Today”, “within the hour”, “or your account will be closed”.
- An unusual request. New bank details, gift cards, a login you were not expecting, a file from someone who never sends files.
- A mismatched sender or link. The display name is right, but the address or the link domain is slightly off. Hover over links before clicking.
- Requests to bypass the normal process. “Don’t call, I’m in a meeting”, “keep this between us”.
- Login pages reached from an email. Open the service from your bookmark or by typing the address instead.
Rule of thumb
If a message asks you to pay, log in or change something, verify it through a channel you already trust, such as a known phone number or a new email you type yourself. Never use the contact details inside the suspicious message.
8 steps to prevent phishing in a small business
1. Turn on the filters you already pay for
Google Workspace and Microsoft 365 both include spam, malware and impersonation protection. Check that it is enabled, that external emails are visibly tagged, and that nobody has whitelisted whole domains to “stop missing emails”. If you are still choosing a platform, our Microsoft 365 vs Google Workspace comparison covers the security features of each.
2. Authenticate your own domain
SPF, DKIM and DMARC make it much harder for criminals to send email that appears to come from your exact domain, which protects your clients and suppliers from fake invoices in your name. Follow our SPF, DKIM and DMARC setup guide and move DMARC towards enforcement once reports look clean.
3. Make stolen passwords useless with MFA
Credential phishing works because a password alone opens the account. Multi-factor authentication adds a second check. Start with email, banking, the domain registrar and admin accounts, as described in our multi-factor authentication setup guide. Where possible, prefer authenticator apps or passkeys over SMS codes.
4. Use a password manager
A password manager only autofills a password on the real domain, so it quietly refuses to fill a look-alike login page. That makes it one of the most practical anti-phishing tools for non-technical staff. See our team password manager guide for rollout steps.
5. Write a payment verification rule
This single rule stops most invoice fraud: any change of bank details, and any unusual or urgent payment, is confirmed by phone on a number you already had before the request. Put it in writing, tell suppliers about it, and make sure the owner follows it too. Our IT security policy template has a ready section you can adapt.
6. Train in short, regular sessions
One long annual lecture is forgotten by spring. Ten minutes a month works better: show one real phishing example your company received, explain the red flag, and repeat the reporting process. Simulated phishing tests can help, as long as they are used to teach and not to shame people.
7. Make reporting easy and blame-free
Give everyone one simple action: forward the message to a set address (for example security@yourcompany) or use the built-in report button. Gmail explains how in its help page on avoiding and reporting phishing emails. Thank people who report, including those who clicked first and reported second. Fear of blame is what turns a five-minute problem into a five-week one.
8. Plan for the click that gets through
Decide in advance what happens when someone enters a password or opens a bad file: change the password, sign out all sessions, check mailbox forwarding rules, call the bank if money moved, and keep a record. Our incident response plan template turns this into a one-page checklist.
What to do in the first hour after a phishing click
| What happened | Do this immediately |
|---|---|
| Entered a password on a fake page | Change that password (and anywhere it was reused), sign out all sessions, confirm MFA is on, check mailbox rules and forwarding |
| Opened an attachment or ran a file | Disconnect the device from the network, do not wipe it yet, contact your IT support |
| Paid a fraudulent invoice | Call your bank right away to try to stop or recall the transfer, then report it to the police |
| Shared an MFA code | Treat the account as compromised: reset the password and review recent sign-ins and changes |
Small-business reality check
Most of these steps cost nothing but an afternoon. The expensive part is the payment or data you lose when nobody had a plan. If you are not sure where your gaps are, start with the overview in our cybersecurity guide for small business.
Common mistakes
- Relying on training alone. People will click eventually. Technical layers have to catch what training misses.
- Shared logins without MFA. One phished password then opens every account the team shares.
- Punishing people who click. They stop reporting, and you lose your early warning.
- Ignoring messengers and SMS. The same tricks now arrive on WhatsApp and Viber, outside your email filters.
- Forgetting your website. A compromised site or contact form can be used to host fake pages or send spam in your name. A quick website security check shows the basics.
FAQ
Can small businesses really be targets of phishing?
Yes. Most phishing is sent in bulk and does not care about company size, and invoice fraud specifically targets firms that pay suppliers by bank transfer. Smaller teams often have fewer controls, which makes them attractive.
Is a spam filter enough?
No. Filters catch a lot, but well-crafted messages and messages sent from real, hacked accounts get through. You also need MFA, a payment verification rule and a team that knows how to report.
How often should we train employees?
Short sessions every month or quarter work better than one long yearly course. Use real examples your company received, and refresh training whenever someone new joins.
Who should we report phishing to?
Internally, to whoever handles IT. Externally, report it to your email provider and, for fraud with money involved, to your bank and the police. In Serbia, the National CERT of the Republic of Serbia publishes warnings and guidance on current threats.
Want a second pair of eyes on your setup?
We review email security, MFA, backups and your website, then give you a short, prioritised list of fixes.
Talk to Lizzard Solutions