Phishing Protection for Small Teams: Technical Controls, Training and a Payment Rule That Stops BEC
This is general information, not legal, tax, financial, medical or security advice. Rules and prices change, so confirm details with the official sources linked below or a qualified professional.
Phishing protection for a small team rests on three layers: technical controls that block or blunt attacks (email filtering, SPF/DKIM/DMARC, and phishing-resistant MFA), process rules that make fraud fail even when an email gets through (verify every payment change by phone), and short, blame-free training that turns staff into an early warning system. No single layer is enough; together they cover the main ways phishing succeeds.
Phishing is still the most reported cybercrime to the FBI, and its most expensive form, business email compromise, targets exactly the kind of small, trusting teams where one person can approve a payment.
This is general information, not professional security advice.
Key takeaways
- Phishing tops the FBI's complaint list: 191,561 complaints in 2025.
- BEC is the money-maker: $3.05 billion in reported losses in 2025, according to the FBI.
- Phishing-resistant MFA neutralizes stolen passwords. Passkeys and security keys don't work on fake sites.
- A payment verification rule is the cheapest control you'll ever deploy. Call back on a known number before changing bank details.
- Make reporting easy and blame-free. Fast reports limit damage.
How phishing hits small businesses
| Attack | What it looks like | What the attacker wants | Best defense |
|---|---|---|---|
| Credential phishing | "Your mailbox is full," "Shared document," fake login page | Email or cloud password | Phishing-resistant MFA, password manager autofill |
| Business email compromise | CEO or supplier asking for an urgent wire or new bank details | Money | Out-of-band payment verification |
| Invoice fraud | Real-looking invoice from a compromised supplier account | Money | Verify bank changes by phone; dual approval |
| Malware attachment | Fake shipping notice, "invoice.zip" | Device access, ransomware | Filtering, updates, restricted macros |
| Smishing and vishing | Texts or calls posing as banks, IT support or platforms | Codes, passwords, payments | Training, never share codes |
| Platform impersonation | Fake notices from regulators or platforms | Account takeover, data | Go to the site directly, never via the link |
Platform impersonation is common in regulated industries. The US trucking regulator FMCSA, for instance, maintains a running list of fake "Motus portal" and "SAFER" emails aimed at carriers. Shopify's help center warns merchants that its support will only request sensitive documents through a secure upload page on a shopify.com domain. Know how your key platforms really contact you.
Expect lures tailored to your sector: fake shipping and customs notices for e-commerce, fake patient or insurance messages for clinics, fake regulator or load-board messages for logistics companies, and fake invoices everywhere.
Layer 1: Technical controls
Authenticate your domain: SPF, DKIM and DMARC
These DNS records prove which servers may send email for your domain:
- SPF lists the mail servers allowed to send for your domain. Google warns that without SPF, some of your messages may bounce or be marked as spam.
- DKIM adds a cryptographic signature to your outgoing mail.
- DMARC tells receiving servers what to do with messages that fail SPF or DKIM checks (reject, quarantine or deliver) and sends you reports showing who is sending as your domain.
A common approach is to publish DMARC in monitoring mode first, review the reports to find every legitimate sender (your CRM, invoicing tool, newsletter platform), then move to quarantine and finally reject. This protects your customers and suppliers from emails spoofing your exact domain.
Turn on your platform's filtering
Google's small business checklist recommends turning on enhanced pre-delivery message scanning and additional screening for malicious attachments and links in Gmail. Microsoft 365 offers comparable protections, depending on plan. These are often off or at default levels in small tenants.
Use phishing-resistant MFA
Most phishing aims to steal a password. CISA tells businesses to aim for phishing-resistant MFA. Passkeys and FIDO2 security keys only authenticate to the genuine site, so a perfect copy of your login page captures nothing useful. At minimum, use an authenticator app with number matching rather than SMS. See how to set up 2FA and a password manager for a team.
Let the password manager be a phishing detector
Password managers typically autofill only on the domain where the password was saved. If the manager doesn't offer to fill your Microsoft password, you're probably not on Microsoft's site. Teach this explicitly.
Keep devices patched
Malware attachments rely on unpatched software. Turn on automatic updates for operating systems, browsers and office apps, and keep macros blocked by default.
Layer 2: Process rules that defeat BEC
BEC succeeds because it exploits normal business processes, not software. The FBI reported over $30 million in 2025 BEC losses involving AI, such as generated emails or cloned voices, which makes "it sounded like the boss" an unreliable test.
Adopt these rules in writing:
- Verify every new payee or bank-detail change out of band, by calling a phone number you already had on file, never one from the email requesting the change.
- Require two-person approval for payments above a threshold you set.
- Treat urgency and secrecy as red flags. "Do this now and don't tell anyone" is a script, not a business request.
- Never share MFA codes or approve unexpected prompts. No legitimate IT or bank staff will ask for them.
- Confirm unusual requests from executives through a second channel, even if the email looks internal.
Layer 3: Training people to spot and report
CISA's guidance for businesses focuses on equipping staff to recognize and report phishing. Keep training short and specific:
Teach the signs:
- Unexpected urgency, threats or rewards
- Sender address or reply-to that doesn't match the claimed organization
- Links whose real destination (hover to check) differs from the text
- Requests for passwords, codes, gift cards or bank changes
- Unexpected attachments, especially archives or files asking to "enable content"
- Login pages reached from an email rather than a bookmark
Make reporting effortless:
- Add a "report phishing" button or a single shared address
- Respond to every report with thanks, even false alarms
- Share real examples (sanitized) in a monthly two-minute update
What to do after a click:
- Report it immediately.
- If a password was entered, change it from a different, trusted device and sign out of all sessions.
- Check the account for new MFA methods, mail forwarding rules and connected apps.
- If a file was opened, disconnect the device and have it checked.
- If money moved, call your bank's fraud line immediately and file a report with the FBI's IC3. See what to do after a data breach.
Running a fair phishing simulation
Simulated phishing emails can show where training is needed, but run them carefully or you'll damage trust:
- Announce the program in general terms so staff know simulations happen, without revealing dates.
- Use realistic but fair lures, such as a fake shared-document notice, not cruel ones like fake bonuses or layoffs.
- Measure reporting, not just clicking. The goal is a team that reports quickly.
- Give instant, private feedback to anyone who clicks, with a short explanation of the clues they missed.
- Never name and shame. Share aggregate results only.
- Repeat a few times a year and compare report rates over time.
Protect your customers and suppliers too
Attackers who can't break into your accounts may impersonate you to your customers instead. Reduce that risk:
- Tell customers how you'll contact them, and that you will never change bank details by email alone. Put it on invoices.
- Use a consistent sending domain for invoices and receipts, protected by DMARC.
- Register obvious lookalike domains if your brand is a likely target, and monitor for new ones.
- Ask key suppliers about their email security, and agree a call-back procedure for any change to their payment details.
From experience. In voice AI and WhatsApp-based workflows I've worked on, the lesson carries over directly: any channel that can trigger an action needs a verification step that an impersonator can't fake. For payments, that step is a call-back to a number you already trust.
Phishing protection checklist
- [ ] SPF, DKIM and DMARC published; DMARC reports reviewed
- [ ] Enhanced email filtering turned on in Google Workspace or Microsoft 365
- [ ] Phishing-resistant MFA for admins, finance and owners; number matching for everyone else
- [ ] Password manager deployed; staff taught that "no autofill" means suspect
- [ ] Automatic updates on; macros blocked by default
- [ ] Written payment verification and dual-approval rules
- [ ] One-click or one-address phishing reporting
- [ ] Short training every month or quarter
- [ ] "After a click" steps posted where everyone can find them
- [ ] Customers told how you will (and won't) contact them about payments
- [ ] Phishing simulation results reviewed for reporting speed, not blame
Next steps
- Publish SPF, DKIM and a monitoring-mode DMARC record this week, then review reports.
- Write and circulate your payment verification rule today; it costs nothing.
- Move admins and finance staff to passkeys or security keys.
- Harden your email platform with how to secure Google Workspace and Microsoft 365, then work through the small business cybersecurity checklist.
- Need someone to own this across your tools and team? See our fractional CTO service.
Sources
- FBI IC3, 2025 Internet Crime Report: https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- CISA, Teach Employees to Avoid Phishing: https://www.cisa.gov/secure-our-world/teach-employees-avoid-phishing
- Google Workspace, Set up DMARC: https://support.google.com/a/answer/2466580
- Google Workspace, Security checklist for small businesses: https://knowledge.workspace.google.com/admin/security/security-checklist-for-small-businesses-1-100-users
- FMCSA, Fraud Alerts: https://www.fmcsa.dot.gov/registration/fraud-alerts
- Shopify Help Center, Account security: https://help.shopify.com/en/manual/privacy-and-security/account-security/two-step-authentication
Frequently asked questions
What is the best way to protect a small business from phishing?
Layer three things. Technical controls (email filtering, SPF, DKIM and DMARC, and phishing-resistant MFA) block many attacks and limit the damage of others. A simple process rule, such as verifying every payment or bank-detail change by phone using a known number, stops business email compromise. Short, regular training helps people recognize and report what slips through.
What is business email compromise?
Business email compromise (BEC) is fraud where an attacker impersonates or takes over a trusted email account, such as a CEO, supplier or lawyer, to trick someone into sending money or sensitive data. The FBI's 2025 Internet Crime Report recorded $3.05 billion in reported BEC losses from 24,768 complaints, making it one of the costliest scams.
Do SPF, DKIM and DMARC stop phishing?
They stop attackers from easily sending email that appears to come from your exact domain, which protects your customers and staff from direct spoofing. They do not stop lookalike domains or emails from compromised third-party accounts. DMARC tells receiving servers whether to reject, quarantine or deliver messages that fail SPF or DKIM checks, and sends you reports.
What should an employee do after clicking a phishing link?
Report it immediately without fear of blame. If they entered a password, change it from a known-good device and sign out of all sessions. Check for new MFA methods or email forwarding rules on the account. Disconnect the device from the network if something was downloaded, and have IT check it before reconnecting.
How often should we run phishing training?
Short and frequent beats long and annual. A five-minute refresher each month or quarter, plus a walkthrough whenever a new scam appears in your industry, keeps awareness fresh. Focus training on reporting, not punishment. People who feel safe reporting a mistake quickly limit the damage far more than people who hide it.