Phishing in SMBs: how to protect your team

Preventing phishing in your business starts with understanding what it is

One wrong click and a criminal is inside. That may sound dramatic, but it's exactly how most hacks at SMBs begin. Phishing is by far the number one way businesses get hacked. Not some sophisticated technical attack, but a fake message that tempts one of your employees into clicking a link, entering login details or paying an invoice.

The good news: you can defend yourself against it just fine. Preventing phishing in your business isn't a matter of luck, but of a smart combination of technology, aware employees and clear agreements. In this article we calmly explain how phishing works and how you protect your team without everyone having to become an IT expert.

What exactly is phishing?

Phishing is a form of fraud in which criminals pose as a trusted party. Think of your bank, Microsoft, a supplier or even your own director. The goal is to get you to do something you'd normally never do: enter a password, open an attachment or transfer money.

The messages look more professional all the time. The days of bad grammar and odd logos are over. With AI, criminals now create flawless emails that are barely distinguishable from the real thing. That's why it's important to recognise the different variants.

The main variants of phishing

• Phishing via email. The classic. A mass-sent email that appears to come from a well-known organisation, with a link to a fake website where you enter your details.
• Spear phishing. A targeted attack on a specific person or company. The criminal has done research and uses names, projects or clients that are accurate, which makes the message extra convincing.
• CEO fraud. An employee receives a message supposedly from the director, with an urgent request to quickly make a payment or share data. Often with time pressure: "I'm in a meeting, please sort this out."
• Invoice fraud. You receive an altered invoice from an existing supplier, but with a changed bank account number. If you pay, the money goes to the criminal.
• Smishing. Phishing via SMS or WhatsApp. Think of a text about a parcel that can't be delivered, with a link attached.
• QR phishing. A QR code in an email or on a poster that leads to a fake website. Because you can't see where the code goes, this is a popular and hard-to-spot form.

Why SMBs in particular are a target

Many entrepreneurs think: "We're too small, criminals aren't interested in us." Unfortunately, the opposite is true. SMBs are exactly the attractive target, for a few reasons.

• There's something to gain. Even a company with 30 employees processes payments, customer data and has access to systems that are worth money.
• Security is often lighter. Large companies have entire security teams. SMBs usually don't, which lowers the barrier for criminals.
• Attacks are automated. Criminals send millions of messages at once. Whether you're big or small doesn't matter, you're simply on the list.
• People are the weak link. Phishing doesn't target your technology, but your employees. And they're busy, want to help and click faster than they'd like to admit.

So it's not a question of whether you'll receive a phishing message, but when. That's why preventing phishing in your business works best with multiple layers of protection.

A layered approach: technology, people and process

No single measure stops phishing 100 percent of the time. The strength lies in the combination. If a criminal manages to get past the technology, an alert employee catches it. And if something does slip through, a clear process keeps the damage limited. Let's walk through the three layers.

Layer 1: get the technology in order

With the right technical measures, you already catch the vast majority of phishing attempts before they reach an employee.

• Multi-factor authentication (MFA). This is the most important measure. Even if a criminal captures a password, they can't get in without the second step (for example, a code on the phone). MFA is no longer a luxury, but a basic requirement.
• A good spam filter and Microsoft Defender. A strong email filter blocks most phishing emails. Microsoft Defender for Office 365 actively scans links and attachments and automatically blocks suspicious messages.
• Conditional access. This lets you set rules about who can log in, from where and on which device. A login attempt from a suspicious country or an unknown device is then blocked or gets an extra check.
• A password manager. With a tool like Keeper, everyone uses strong, unique passwords without having to remember them. Bonus: a good password manager only fills in login details on the real website, so nothing happens on a fake site.

Want to know how best to set up this technology? We'll help you with that through our services for IT security and Microsoft security.

Layer 2: aware employees

Technology catches a lot, but people remain the last line of defence. A team that recognises phishing is worth gold.

• Awareness. Teach your employees to recognise the signs: a sense of urgency, an unusual bank account number, a strange sender address or a request that doesn't add up. Short, practical training works better than a thick policy document that nobody reads.
• Phishing simulations. Occasionally send a safe fake phishing email to your team to practise. That way you see where the risks are and people learn in practice, without any real damage.
• A reporting culture. Perhaps the most important of all. Make sure employees dare and want to report a suspicious message, without fear of a telling-off. Anyone who clicks by accident must dare to say so right away. Speed makes the difference between a scare and an expensive disaster.

Layer 3: clear processes

If something does go wrong, your process determines how big the damage becomes. So set out in advance what needs to happen.

• What to do with a suspicious message. Make it clear: don't click, don't reply, but report it to a fixed point of contact or your IT partner. Unsure about a payment request? Always call the person in question on a known number to verify it.
• Four-eyes principle for payments. Always have payments above a certain amount or changes to bank account numbers checked by a second person. This stops CEO fraud and invoice fraud in the bud.
• An incident plan. Know in advance who you call and what steps you take if something goes wrong: resetting passwords, blocking accounts, calling in your IT partner. A plan that's ready prevents panic at the wrong moment.

Here's how to tackle it concretely

Feeling overwhelmed? There's no need. You don't have to arrange everything at once. Start with the measures that deliver the most and build from there.

1. Turn on MFA for all employees. This is the biggest win with the least effort.
2. Check that your spam filter and Microsoft Defender are set up properly.
3. Roll out a password manager for the whole team.
4. Schedule a short awareness training and agree on how employees report suspicious messages.
5. Set out a simple incident plan and make sure everyone knows who to call.

Want to know where your business stands right now? With our security check we map out where your risks lie and what you can tackle first. Do you work with a password manager? Then take a look at what Keeper Password Security can do for you.

And are you already using Copilot or other AI tools? Then also read our article about working safely with Copilot, because handling data securely comes into play there too.

Preventing phishing doesn't have to be complicated

Phishing is and remains the favourite attack method against SMBs, but you're not powerless against it. With a smart combination of technology, aware employees and clear agreements, you make it enormously difficult for criminals. The most important thing is that you get started and take it seriously, before something goes wrong.

At IT-gemak we help you with both sides of the story: setting up the technology properly and training your team to recognise phishing. That way, together we make sure your business can keep working safely and with peace of mind.

Want to know how well your business is protected against phishing? Schedule a no-obligation consultation and we'll look at where you stand together.