Phishing is the most common way small businesses get into trouble online, and it rarely looks like a Hollywood hacking scene. It looks like an ordinary email: an invoice that needs paying, a password reset you did not request, a delivery notice, or a message that appears to come from your boss, your bank, or a supplier. One click on a convincing link, or one reply with a login code, can hand an attacker the keys to your business email, and from there to your customers, your bank, and your files. The good news is that most phishing attacks are stopped by a handful of basic habits, and none of them require an IT department or an expensive security product.
This guide is written for small business owners in the United States who do not have a security team. It explains how phishing works, what to look for, and the practical steps that protect a business of any size: strong sign-in habits, a clear rule for verifying requests, and a simple plan for what to do when someone clicks. The advice follows the public guidance of the Cybersecurity and Infrastructure Security Agency, the federal agency that advises American businesses on cybersecurity.
What Phishing Actually Is
Phishing is a message designed to trick someone into revealing information or taking an unsafe action. The message may arrive by email, text, phone call, or a chat app, and it usually creates urgency: an account will be closed, a payment is overdue, a package is waiting, or a boss needs gift cards immediately. Urgency is the point. A person who stops to think will often spot the trick, so the message is built to make thinking feel like a delay you cannot afford.
Modern phishing messages are often well written and well designed. They copy real company logos, use correct spelling, and reference real services your business actually uses. Some are targeted: an attacker who has seen your website or social media may know your suppliers, your staff names, and the software you run, and use those details to make a message believable. That is why advice like look for bad spelling no longer works on its own. The check that matters is not how the message looks, but whether the request itself makes sense and can be verified another way.
The goal is usually one of three things: your login credentials, a payment, or access to your computer. A fake login page harvests your password. A fake invoice or changed bank details redirect a payment. A malicious attachment installs software that watches what you type or locks your files. Understanding which of these a message is after helps you decide how serious it is and what to do next.
Spotting the Warning Signs
Start with the sender, not the logo. Check the full email address, not just the display name, because display names are easy to fake. A message from your bank that comes from a free webmail address, or a supplier email with a subtly misspelled domain, deserves suspicion. On a phone, where full addresses are often hidden, open the message details before you act on it.
Next, look at what the message asks you to do. Requests that bypass normal process are a strong warning sign: a password reset you did not ask for, a request to change payment details by email alone, an unexpected attachment, or a demand for secrecy, such as do not tell anyone about this transfer. Legitimate businesses rarely ask you to act in secret or to skip the usual approval step, and your bank will never ask for your password or login code by email.
Hover over links before clicking, on a computer, to see where they actually lead. A link whose text says one company but whose address points somewhere unrelated is a classic sign of a fake page. On a phone, press and hold a link to preview its destination. If anything about the address looks wrong, or if you were not expecting the message at all, do not click. Go to the service yourself by typing its address or opening its app, and check there whether any action is really needed.
Turn On Stronger Sign-In Everywhere
The single most effective protection for a small business is multifactor authentication, often called MFA or two-factor authentication. It asks for a second proof of identity after your password, such as a code from an authenticator app, a fingerprint, or a hardware security key. Even if an attacker steals your password through a phishing page, they still cannot sign in without that second factor. The Cybersecurity and Infrastructure Security Agency recommends MFA for all accounts that offer it, and describes it as one of the simplest steps any business can take to stay safe online.
Not all second factors are equal. Authenticator apps and hardware security keys are stronger than codes sent by text message, because text messages can be intercepted in some attacks. Passkeys, where supported, are stronger still, because they are tied to the real website and do not work on a fake copy of it. Wherever a service offers a choice, pick the strongest option it provides, and save the backup codes it gives you in a safe place, such as a password manager, in case you lose your phone.
Apply MFA first to the accounts that matter most: your business email, your bank and payment accounts, your domain registrar, and any account that can reset other accounts. Business email deserves special attention, because an attacker who controls it can reset passwords elsewhere and send convincing messages to your customers and suppliers. Every person with access to these accounts should have MFA on, not just the owner. One unprotected account is often the way in.
Use a Password Manager and Unique Passwords
Password reuse is what turns one phishing success into a business-wide problem. If the same password opens your email, your shop platform, and your bank, then a single stolen password opens all three. A password manager solves this by generating a long, random, unique password for every account and remembering them for you. You only need to remember one strong master password.
Choose a reputable password manager, turn on MFA for the manager itself, and move your business accounts into it one at a time, starting with the most important. Give every person their own login rather than sharing one admin password across the team. Shared passwords cannot be revoked for one person when they leave, and they make it impossible to tell who did what. Individual accounts also let you remove access quickly when someone’s role changes.
Be careful with passwords in shared documents, chat messages, and email. A password sent in a chat thread lives there forever and is visible to everyone in the thread. If a password has ever been shared that way, change it and move it into the manager. The same applies to old accounts: an account created for a former employee, a past contractor, or a finished project should be closed or have its access removed. Forgotten accounts are a quiet way in.
Make Verification a Normal Part of Work
The strongest defense against phishing is a simple workplace rule: verify sensitive requests through a second channel before acting. If an email asks you to change bank details, pay an unusual invoice, or reset a password, confirm it by phone using a number you already have, or in person, or through the supplier’s own portal. Never use the phone number, email address, or link inside the suspicious message itself, because those may belong to the attacker.
Write this rule down, even if your business is just you and one helper. A one-page procedure that says who approves payments, how bank changes are confirmed, and what to do with a suspicious message removes the pressure to decide in the moment. When everyone knows the rule, an urgent message that tries to skip it stands out immediately. The rule also protects you from social pressure: it is much easier to say I need to verify this first when verification is simply how the business works.
Train yourself and your team with real examples. Once in a while, show the team a phishing message that arrived at your business and talk through what gave it away. People learn to spot phishing from examples, not from a policy document they read once. Keep the tone blame-free: anyone can be fooled by a good fake, and a team that reports suspicious messages quickly is far safer than a team that hides mistakes out of embarrassment.
Keep Software Updated and Backups Separate
Phishing is not only about stolen passwords. Some attacks use malicious attachments or links to install software that locks or steals your files. Keeping your operating system, browser, and applications updated closes the known weaknesses those attacks rely on. Turn on automatic updates wherever they are offered, on computers and phones alike, so updates happen without anyone having to remember.
Backups are your safety net if something does get through. Keep a copy of important business data somewhere an attacker cannot easily reach from your main computer, such as an external drive that is disconnected after backup, or a cloud backup with its own login and MFA. Test the backup occasionally by restoring a file. A backup you have never tested is a hope, not a plan, and the worst time to discover it does not work is during an incident.
Limit who can install software on business computers, and be cautious about free downloads and browser extensions, which are common carriers of unwanted software. If your business uses shared computers, make sure each person signs in with their own account. These small controls do not require new purchases, and they remove several easy paths an attacker might use after an initial phishing success.
What to Do If Someone Clicks
Act quickly and without panic. If a password was entered on a suspicious page, change that password immediately from a clean device, using the service’s real website or app, and turn on MFA if it was not already on. Check the account for changes you did not make: new forwarding rules in email, unknown devices, changed recovery addresses, and unfamiliar sent messages. Attackers often set up email forwarding so they keep receiving your mail even after a password change.
If payment details or bank information were shared, contact your bank right away and follow its fraud process. If a malicious file was opened, disconnect the computer from the network and get help from a trusted IT provider before continuing to use it. Report the phishing message to your email provider and, for messages impersonating a company, to that company as well. Reporting helps providers block the same attack for others.
Finally, treat the incident as a lesson, not a secret. Note what the message looked like, what made it convincing, and which control failed or was missing. Fix that control: turn on MFA, add the verification rule, or close the account that was used. A business that learns from one phishing attempt is much harder to fool the second time.
Frequently Asked Questions
Can phishing affect a business with only one or two people?
Yes. Small businesses are attractive targets precisely because they often lack dedicated security staff, and a single compromised email account can expose customers, suppliers, and bank access. The protections in this guide, MFA, unique passwords, verification of sensitive requests, and backups, are designed to work for a business of any size.
Is a text message code good enough for MFA?
Any second factor is better than none, but authenticator apps, hardware security keys, and passkeys are stronger than text message codes, which can be intercepted in some attacks. Use the strongest option each service offers, starting with your email, bank, and domain accounts.
What should I do with a suspicious email?
Do not click its links or open its attachments. Verify the request through a separate channel you trust, such as the company’s own website, app, or a phone number you already have. Then report the message through your email provider’s phishing report option and delete it.
We already use strong passwords. Is MFA still necessary?
Yes. Strong passwords protect against guessing, but phishing is designed to get you to hand the password over yourself. MFA protects the account even when the password is stolen, because the attacker still lacks the second factor. That is why security agencies recommend it on every account that offers it.