A convincing email lands in accounts. It appears to come from a supplier you know. The invoice looks right. The language is good. The person named in the email really does work there. There is just one problem.
The bank details have changed.
This is what phishing looks like now. Not always terrible spelling, strange logos and a message from a Nigerian prince. Sometimes it looks almost exactly like an email your team deals with every day. That is why phishing remains such a problem for small businesses.
According to the UK Government’s Cyber Security Breaches Survey 2025/26, 40% of small businesses identified a phishing attack during the previous 12 months.
Across businesses that experienced a breach or attack, phishing was also the most commonly identified and most disruptive type.
So, how do you stop phishing emails in a business?
The answer is not “Tell people to stop clicking things.”
People are not the weakest link. They are busy people being targeted by criminals who are becoming extremely good at creating convincing emails, login pages, invoices and conversations.
A better approach is to put layers around the person behind the keyboard.
Stop as much as possible before it reaches them. Make accounts harder to steal. Give people enough knowledge to recognise when something feels wrong.
Then make it very easy to speak up when it does. That is where effective phishing protection starts.
Why do phishing attacks work so well?
Phishing attacks tend to exploit something that exists in almost every organisation normal business behaviour.
Invoices arrive by email. Microsoft asks people to sign in. Managers ask staff to do things. Suppliers send documents. Couriers send delivery notifications. HR shares files. Customers send links.
A criminal does not necessarily need malware or some previously undiscovered vulnerability. Sometimes they just need to make a malicious message look enough like one of those everyday interactions.
Small businesses can be particularly attractive because people often wear several hats. The person responsible for finance may also deal with HR. The business owner may approve payments from their phone between meetings. There may not be somebody watching security alerts all day.
That isn’t negligence. It is what running a small business looks like.
Good cyber security needs to work around that reality rather than pretending everybody has a security operations centre down the corridor.
What do modern phishing emails look like?
There is no single phishing email to teach people to recognise.
Common examples include:
fake Microsoft 365 login requests;
fraudulent invoices;
fake requests to change supplier bank details;
messages impersonating directors or managers;
shared OneDrive, SharePoint or Google Drive documents;
fake voicemail notifications;
parcel delivery messages;
QR codes leading to fake login pages;
password expiry warnings;
fake DocuSign requests;
messages sent from genuinely compromised accounts.
That last one is particularly important. A phishing email does not always come from an obviously fake address. We regularly see attacks sent from real accounts that have already been compromised.
That changes things considerably.
The email may pass SPF. It may pass DKIM. It may pass DMARC. It may come from somebody the recipient has emailed before. It may even be part of an existing conversation.
Telling people to “check the sender address” is therefore useful advice, but it is nowhere near enough on its own.
Perfect spelling does not mean an email is safe
Another piece of phishing advice that badly needs retiring is Look for spelling and grammar mistakes.
Poorly written phishing emails certainly still exist, but generative AI has made polished writing available to everybody, including criminals.
Emails can now be well written, appropriately toned and personalised to the recipient. We have written more about that here:
Phishing emails have changed: why perfect spelling is no longer a sign an email is safe
The useful warning signs are increasingly about context rather than spelling.
Is the request normal? Is there unexpected urgency? Has somebody asked you to change payment details? Are you being pushed towards a login page you were not expecting? Does the message discourage you from checking through another route? Has somebody suddenly changed the way they normally communicate with you?
Those are much better questions.
How to stop phishing emails before they reach your inbox
This is where I would start, because while security awareness training matters, our first objective should be to stop as much malicious email as possible before a member of staff has to make a decision about it.
Use proper email security
Microsoft 365 includes useful security controls, particularly with the right licences and configuration.
But “we use Microsoft 365” does not automatically mean every available protection is enabled or that every phishing email will be caught.
Microsoft provides preset security policies, impersonation protection, Safe Links and Safe Attachments within appropriate Microsoft Defender for Office 365 licences.
Those settings are worth reviewing.
For organisations facing regular phishing and business email compromise, we often recommend an additional email security layer such as Check Point Email Security.
It analyses email, links, attachments and account behaviour to help identify threats before they reach the user.
The point is not to buy software for the sake of buying software, it is to reduce the number of occasions where somebody has to make a perfect decision about a convincing email. That is a much better security model.
SPF, DKIM and DMARC help stop people impersonating your domain
There is another side to phishing. Someone may not be trying to fool your staff. They may be trying to fool your customers while pretending to be you.
This is where SPF, DKIM and DMARC matter.
In simple terms:
SPF helps define which systems are allowed to send email for your domain.
DKIM adds a cryptographic signature that helps prove an email has been sent by an authorised system and has not been altered.
DMARC tells receiving organisations what to do when those checks do not line up correctly with the visible sender.
DMARC can also give you visibility of services sending email using your domain.
A DMARC policy of p=none is useful for monitoring, but the longer-term aim for many organisations should be moving safely towards enforcement once legitimate senders have been identified.
If you are wondering:
“How do I stop phishing emails using my company name?”
this is one of the places to start. We have a fuller guide here: How to stop scammers sending emails in your name
One important caveat:
SPF, DKIM and DMARC do not make phishing disappear.
A criminal using a completely different domain or a genuinely compromised account may pass email authentication perfectly well.
They are one layer. Not the whole answer.
MFA matters – but modern phishing can sometimes get around it
Multi-factor authentication remains one of the most important security controls a small business can deploy.
Turn it on for:
Microsoft 365;
administrator accounts;
banking;
payroll;
cloud applications;
remote access;
backup systems;
and other important business accounts.
The NCSC recommends MFA as an important part of making accounts more resistant to phishing. But there is an important change in the threat landscape.
It is no longer accurate to say MFA makes a stolen password useless.
Some modern phishing attacks use adversary-in-the-middle techniques to steal not only the password but also an authenticated session.
We have seen these techniques increasingly targeting Microsoft 365.
That does not make MFA pointless, far from it, but it means organisations should move towards stronger, phishing-resistant authentication such as passkeys, FIDO2 security keys and other modern authentication methods wherever practical.
We explain this type of attack here What is an AiTM phishing attack and why won’t traditional MFA always stop it?
The important thing is to keep improving the layers.
Protect the account after somebody gets through
Suppose a phishing email beats the filter. The user clicks it. The attacker gets into Microsoft 365. What happens next?
This is where identity protection becomes extremely important.
A criminal inside a Microsoft 365 account may:
read previous conversations;
search for invoices;
create forwarding rules;
hide replies;
monitor discussions with suppliers;
impersonate the account owner;
send phishing emails internally;
wait for the right moment to redirect a payment.
This is one of the reasons we also use identity threat detection. Our Huntress ITDR service monitors Microsoft 365 identities for suspicious activity that may indicate an account takeover.
Email security tries to stop the message. Identity protection helps spot what happens if an attacker gets further. Again: layers.
Should you train staff to recognise phishing?
Yes, but training should not be your main defence. There is a huge difference between We trained everybody, so they shouldn’t click and We have put sensible technical controls around people and also help them recognise the attacks that still get through.
The second is how we prefer to approach it.
Security awareness training should give people useful skills.
It should not transfer responsibility for the organisation’s security onto them.
Short and regular beats one long annual session
Think about how much information somebody remembers from a 45-minute compliance video they watched eleven months ago.
Probably not very much.
Short, regular training works much better for something where the threats continually change.
One month might cover invoice fraud.
Another might cover QR code phishing.
Another might explain fake Microsoft logins.
Another could look at compromised supplier accounts.
The aim is familiarity.
When a similar situation happens for real, somebody thinks I’ve seen something like this before. That moment is valuable.
You can read more about our approach to security awareness training and phishing protection for businesses in Chesterfield and Sheffield.
We also provide Huntress Managed Security Awareness Training, which combines short training with realistic phishing simulations.
Should you run phishing simulations?
They can be useful. They can also be done very badly.
Sending a deliberately convincing email, catching somebody out and publishing a league table of who clicked does not create a healthy security culture.
It creates people who are afraid to admit mistakes and that is exactly the opposite of what we want.
A phishing simulation should be a learning exercise.
If somebody clicks, give them some immediate context. Explain what they missed. Show them what they could look for next time. Then move on.
No embarrassment. No public shaming. No “weakest link” nonsense.
We wrote more about this here How to stop staff clicking phishing emails without slowing your business down
For schools and multi-academy trusts, simulations also need particular care. Staff work under pressure, often around safeguarding and pupil welfare, and an unnecessarily aggressive phishing campaign can create more anxiety than useful learning.
The objective is better judgement. Not better click statistics.
The most useful phishing control may be your company culture
Imagine two people click the same phishing link.
Person one immediately says “I’ve just clicked something and I think it might be dodgy.”
Person two thinks “Oh no. I’ll get into trouble.” So they close the browser and say nothing.
Which organisation would you rather be?
The first click might give an attacker a few minutes. The second could give them hours or days.
This is why people can actually become one of your best early-warning systems.
They notice strange things. They recognise unusual requests. They know how their suppliers normally behave.
They spot something that feels wrong.
The important thing is making sure they feel comfortable saying so.
Make reporting ridiculously easy
Everybody should know what to do if they think they have clicked something suspicious. Not there’s a procedure somewhere on SharePoint. Something simple.
Call this number.
Email this address.
Click the Report Phishing button.
Tell your manager.
Contact your IT provider.
Most importantly tell somebody quickly.
Your response should ideally be “Thanks for telling us.”
Not “Why did you click it?”
You can investigate what happened afterwards. Speed comes first.
What should you do if an employee clicks a phishing email?
Do not panic. Do not blame them. Do not simply change the password and assume the problem has gone away.
What happens next depends on what they clicked and what information was entered, but common steps include:
Tell your IT or cyber security provider immediately.
Reset the affected account credentials where appropriate.
Revoke active login sessions.
Review MFA methods registered to the account.
Check for suspicious inbox and forwarding rules.
Look for unusual sign-ins and account activity.
Check whether emails have been sent from the compromised account.
Consider whether customers, suppliers or colleagues may have been targeted.
Contact your bank immediately if payments or financial information may be involved.
Work out what happened and close the gap rather than looking for somebody to blame.
If you need to report suspicious emails in the UK, the NCSC operates the Suspicious Email Reporting Service at report@phishing.gov.uk.
We also have a guide covering how to report cyber crime in the UK.
What is the best phishing protection for a small business?
There isn’t one product that solves phishing. If somebody tells you there is, I would be wary. Good phishing protection combines several layers.
Layer 1: Stop malicious email
Use properly configured Microsoft 365 security or a specialist email security service to identify suspicious messages, URLs and attachments.
Layer 2: Protect your domain
Configure SPF, DKIM and DMARC so criminals find it harder to impersonate your organisation.
Layer 3: Protect accounts
Use MFA and move towards phishing-resistant authentication wherever possible.
Layer 4: Detect account takeover
Monitor Microsoft 365 identities for unusual behaviour and signs that an account has been compromised.
Layer 5: Help people recognise what gets through
Use short, regular, relevant security awareness training.
Layer 6: Make reporting easy
Create a culture where saying “I think I’ve clicked something” gets a thank you rather than a telling off.
Layer 7: Know how you will respond
Have a simple plan for compromised accounts, fraudulent payments and suspicious emails before you actually need it.
That is how you reduce phishing risk.
Not by expecting humans to become flawless email-analysis machines.
Anti-phishing services for small businesses don’t need to be complicated
One of the reasons small businesses sometimes put this off is that cyber security has a habit of becoming unnecessarily complicated.
You do not necessarily need an enterprise security programme.
You may need:
better Microsoft 365 configuration;
stronger MFA;
DMARC;
better email filtering;
account monitoring;
short security awareness training;
and somebody keeping an eye on it.
That is manageable.
At Black Swan Cyber Security Solutions we help small businesses across Chesterfield, Sheffield, Derbyshire, South Yorkshire and beyond put those layers in place.
That can include:
Check Point Harmony Email & Collaboration
Huntress ITDR for Microsoft 365 account protection
Security awareness training and phishing simulations
The starting point is not choosing a product. It is working out where your gaps actually are.
How to stop phishing emails in your business: start with the layers
If you only remember one thing from this article, make it this:
Do not build your phishing strategy around somebody never clicking the wrong thing.
Attackers only need one sufficiently convincing message at the wrong moment.
Your job is to make sure one click does not automatically become a serious incident.
Filter what you can.
Protect the account.
Protect the domain.
Watch for account takeover.
Train people without frightening them.
Make it easy to report something suspicious.
Then have a plan for when one inevitably gets through.
That is a much more realistic approach to phishing protection for small businesses.
It is also a much kinder one.
Because the person who spots the problem and tells you quickly may not be your weakest link at all.
They may be the person who stops a small mistake becoming a very expensive one.
If you are worried about phishing, Microsoft 365 security or business email compromise, we can take a look at what you already have in place and identify the gaps.
No scare stories. No fifty-point shopping list. Just the practical changes that will make the biggest difference.
Frequently asked questions
How do I stop phishing emails in my business?
You cannot guarantee that every phishing email will be blocked, so use layers. Start with good email filtering, MFA, SPF/DKIM/DMARC, strong Microsoft 365 configuration and account monitoring. Combine those technical controls with regular security awareness training and a simple process for reporting suspicious emails.
What is the best anti-phishing software for small businesses?
There is no single best product for every business. Microsoft 365 includes several useful anti-phishing controls, while specialist products such as Check Point Harmony Email & Collaboration can provide an additional layer of email analysis and protection. The right choice depends on your licences, existing controls, business risk and who will manage the system.
Can Microsoft 365 stop phishing emails?
Microsoft 365 includes anti-phishing capabilities, but their effectiveness depends on your licence and configuration. Microsoft Defender for Office 365 can provide features including impersonation protection, Safe Links and Safe Attachments. Some businesses choose to add a specialist email security layer where the risk justifies it.
Does MFA stop phishing?
MFA significantly improves account security and should be enabled wherever possible. However, some modern adversary-in-the-middle phishing attacks can steal authenticated sessions even when conventional MFA is being used. Phishing-resistant authentication such as passkeys or FIDO2 security keys offers stronger protection where supported.
Should I run phishing tests on employees?
Phishing simulations can be useful when they are used for coaching rather than punishment. They should help people recognise realistic attacks and make staff more confident about reporting mistakes. Avoid public league tables, embarrassment or a culture where people are frightened to admit they clicked.
What should I do if an employee clicks a phishing email?
Ask them to report it immediately. Depending on what happened, you may need to reset credentials, revoke sessions, check MFA methods, inspect forwarding rules and review sign-in activity. If financial information or payments are involved, contact the bank quickly. The objective is to contain the incident first and understand what happened afterwards.
Where can I report phishing emails in the UK?
Suspicious emails can be forwarded to the NCSC’s Suspicious Email Reporting Service at report@phishing.gov.uk. If an incident involves fraud or financial loss, additional reporting may also be appropriate depending on the circumstances.
