Phishing remains the single most common way businesses get breached — not because the emails are sophisticated, but because they only need to fool one person, once. A convincing message, a moment of distraction, and a real credential or payment lands in an attacker’s hands. The good news is that phishing is highly defensible with a mix of awareness, a few technical controls, and clear processes. This guide explains how phishing actually works and what a small or mid-size business can do about it without an enterprise security budget.
What phishing actually is
Phishing is any attempt to trick someone into revealing sensitive information or taking a harmful action by pretending to be a trustworthy source. It usually arrives by email, but it also comes via SMS (smishing), phone calls (vishing), and messaging apps. The goal is almost always one of three things: steal login credentials, trick someone into transferring money, or get malware onto a device.
The main types you’ll encounter
| Type | How it works | Typical target |
|---|---|---|
| Bulk phishing | Generic mass emails impersonating banks, couriers, Microsoft 365 | Anyone |
| Spear phishing | Personalized, researched messages aimed at a named individual | Finance, HR, admins |
| Business Email Compromise (BEC) | Impersonating a CEO or supplier to request an urgent payment | Finance teams |
| Clone phishing | A real email copied, with links swapped for malicious ones | Existing contacts |
The warning signs to teach your team
- Urgency and pressure — “act now or your account will be closed.” Urgency is designed to switch off careful thinking.
- Mismatched sender addresses — a display name of “Microsoft” but an address on a random domain.
- Unexpected attachments or links, especially asking you to “enable content” or log in.
- Requests for credentials or payment changes, particularly changing a supplier’s bank details.
- Slightly-off language, logos, or domains —
micros0ft.com,paypa1.com, and similar look-alikes.
Technical defenses that stop most attacks
Awareness alone is not enough — humans are fallible, so layer technical controls behind them. Multi-factor authentication (MFA) is the single most valuable control: even if a password is stolen, the attacker cannot log in without the second factor. Email authentication (SPF, DKIM, and DMARC) makes it far harder for attackers to spoof your own domain. Spam and link-scanning filters catch the bulk of malicious mail before it reaches an inbox, and endpoint protection blocks malware if someone does click. Keeping software patched closes the vulnerabilities that malicious attachments try to exploit.
Process beats heroics
The most damaging phishing attacks — especially BEC — succeed because there is no process to catch them. Introduce a simple rule: any change to payment details or any unusual payment request must be verified out-of-band, by calling a known number, never by replying to the email. Give staff an easy, blame-free way to report suspicious messages, and make it clear that reporting a false alarm is always better than staying silent about a real one.
What to do if someone clicks
- Disconnect the affected device from the network to limit spread.
- Change the exposed password immediately, and any others that reused it.
- Check whether MFA prompts were approved and revoke active sessions.
- Scan the device with endpoint protection and review it for persistence.
- Notify anyone who may be affected, and watch finance systems for fraudulent activity.
Frequently Asked Questions
Does MFA make us phishing-proof?
No single control is a silver bullet — attackers have techniques to bypass some MFA methods — but MFA dramatically reduces the damage of stolen passwords and stops the overwhelming majority of account-takeover attempts. It is essential.
Should we run simulated phishing tests?
They can help if done supportively, as training rather than a “gotcha.” The aim is to build confidence and good habits, not to embarrass staff.
Building a phishing-resistant business
Phishing defense is layered: aware people, strong technical controls, and clear processes that catch mistakes before they cost money. If you would like help rolling out MFA, email authentication, or staff awareness, talk to our engineers, or read our related guide on office network security best practices.