How to Protect My Business From Phishing Attacks: A Simple Plan

Late on a Thursday, your office manager gets a polite email from a supplier you’ve paid for years, written in the same friendly tone as every invoice reminder they’ve ever sent. They’ve changed banks. Could this month’s payment go to the new account? No link, no attachment, nothing for a spam filter to catch.

If you’ve been searching for how to protect my business from phishing attacks, start with that email. Phishing is a cyberattack that uses deceptive emails and websites to steal credentials, money or data, and some of the most expensive versions need no malicious link at all. That changes the plan.

You don’t need a security team. What you need is a short plan, the free settings already sitting inside Microsoft 365^® or Google Workspace, and one written rule about money that everyone in the office actually follows.

Below is that plan in three phases: this week, this month and this quarter. Each step names an owner (the business owner, the office manager, or your IT person or managed service provider, the MSP) and roughly how long it takes. You’ll also get a first-hour checklist for when someone clicks. MSPs get a version they can forward to clients as is.

Business Email Compromise Prevention: The Scam With No Link

Business email compromise is the phishing attack that drains small business bank accounts, and it rarely contains anything a filter would flag. The FBI’s Internet Crime Complaint Center (IC3) received 24,768 BEC complaints with $3,046,598,558 USD in reported losses in 2025, second only to investment fraud, according to this breakdown of the 2025 IC3 report. That’s one category of crime.

How BEC usually shows up

The attacker poses as someone your team already trusts. Then they ask for money to go somewhere new, usually with a reason it can’t wait. Watch for these shapes:

• The vendor bank change. A “supplier" sends new remittance details just before a large invoice is due.
• The urgent boss. The “owner" writes from a lookalike address, asks for a quick wire and says they’re stuck in a meeting and can’t talk.
• The payroll switch. An “employee" asks the office manager to update their direct deposit account.
• The hijacked real mailbox. The attacker is inside a genuine account, yours or a vendor’s, and replies in a real thread while hiding their tracks with inbox rules.

Notice what’s missing. No link to scan, no file to sandbox, which is why BEC prevention is a process problem before it’s a software problem.

The controls that stop it

CISA’s advice is refreshingly low-tech: verify any change in payment instructions by calling back on a number you already hold, never one from the email. The same guidance says to keep vendor contact details outside email, limit how many people can approve wire transfers, and confirm payment requests from executives through a second channel. Add one control of your own. A second person approves every change to vendor bank details.

Why this matters: anyone can fake an email, but a fraudster can’t answer the phone number already sitting in your vendor file. MFA covers the other half of the problem, because the hijacked-mailbox version almost always starts with a stolen password.

How to Protect My Business From Phishing Attacks This Week

Start with settings you already pay for. Everything in this section is free inside Microsoft 365 or Google Workspace, and the owner’s only job this week is telling the IT person or MSP, in writing, to get all of it done by Friday.

Turn on MFA for everyone (IT person or MSP, an afternoon)

MFA asks for a second proof, usually a tap in a phone app, before anyone signs in. Your admin can enforce it across Microsoft 365 with Security Defaults or Conditional Access, as Microsoft’s partner security guidance explains, and Google Workspace has its own enforcement setting in the Admin console. No exceptions for the owner. Why this matters: Microsoft says more than 99.9% of compromised accounts don’t have MFA, so a phished password on its own stops being enough.

Add the report-phishing button (IT person or MSP, a short sitting)

In Microsoft 365, the admin deploys the Report Phishing add-in from Settings > Integrated apps, and Microsoft says it can take up to 12 hours to appear for everyone. Gmail already has Report phishing in the three-dot menu. Why this matters: one report lets a Google Workspace admin use the security investigation tool to find every copy of that email and delete it across the domain before a second person clicks.

Tag outside senders (IT person or MSP, a short sitting)

In Gmail, the “Warn for external recipients" setting flags when someone is about to reply to an address outside your organization, and Google says changes can take up to 24 hours to apply. Microsoft 365 admins can switch on an external tag in Outlook^® or add a mail flow rule that stamps a banner on outside mail. Why this matters: a fake “owner" email marked as external is often the only visible clue.

Block auto-forwarding to outside addresses (IT person or MSP, a short sitting)

Attackers who get into a mailbox like to set up forwarding so they keep reading your mail after the password changes. Microsoft lets you turn off automatic external forwarding in the outbound spam filter policy, with named exceptions for anything legitimate. Why this matters: it closes the quietest leak a hijacked mailbox has.

Start DMARC, then tighten it slowly (IT person or MSP, a few weeks)

Sender Policy Framework (SPF) lists who may send mail for your domain, DomainKeys Identified Mail (DKIM) signs it, and Domain-based Message Authentication, Reporting and Conformance (DMARC) tells other servers what to do with mail that fails. Start at p=none to watch, then move to quarantine and reject once your billing and newsletter tools pass; CISA treats a DMARC reject policy as a high-impact, low-cost control. Why this matters: it blocks fakes sent from your exact domain, though not lookalike domains, which is why the payment rule below still matters.

This Month: Write the Payment Rule and Start Light Training

This month’s work is about people, not settings. The owner writes one rule, the office manager turns it into routine, and training becomes a small monthly habit instead of a dreaded annual course.

The payment and bank-detail change rule (owner writes it, office manager enforces it, one staff meeting)

Paste this into your policy handbook. Change the bracketed parts, then read it aloud at your next team meeting so nobody can say they missed it:

Payment verification rule. Before changes any vendor’s bank details, updates an employee’s direct deposit, or sends a wire or Automated Clearing House (ACH) payment to a new account, the request must be confirmed by phone. Call back on a number we already have on file (the vendor record, the signed contract or the employee file), never a number, link or contact detail from the request itself. A second person approves every bank-detail change before it takes effect. Urgency is never a reason to skip this, even when the request appears to come from , and nobody will be disciplined for delaying a payment to follow this rule.

Keep the vendor phone list somewhere other than email, as CISA recommends, so a hijacked inbox can’t feed you a fake number. That last sentence of the rule matters most, because staff who fear the boss will skip the callback.

Training that fits a small team (office manager, a few minutes a month)

Skip the enterprise awareness program. Once a month, show one real phishing email your team received at a regular meeting and ask what gave it away, whether that was the odd sender address, the sudden urgency or the new bank details. That’s the whole format. The guide to securing data for remote work suggests a quarterly minimum with short monthly reminders in between, and it treats simulated phishing tests as a teachable moment rather than a punishment.

Good phishing protection for small business teams depends more on culture than content. Thank the person who reports a suspicious email, even when it turns out to be harmless. Never shame the person who clicked, because the next person will hide it instead, and a hidden click is the expensive kind.

A fast report after a bad click is worth more than a perfect click record.

This Quarter: Close the Gaps Behind the Inbox

Phishing is usually the first step of an attack, not the last. A clicked link or a stolen login is a common way in for ransomware, and this ransomware prevention guide walks through how that chain unfolds. This quarter’s job is making sure one bad click can’t reach everything.

• Harden devices (IT person or MSP, ongoing). Patch operating systems and browsers on a schedule, and run endpoint protection on every work device. These endpoint security best practices cover what to prioritize. Why: a patched device gives a malicious attachment far less to exploit.
• Separate admin accounts (IT person or MSP, an afternoon). Nobody reads email while signed in as an administrator. Why: a phished admin account hands over the keys to everything.
• Test a restore (owner and IT person, a morning). Restore one real folder from backup and note how long it takes. Why: an untested backup is a hope, not a plan.
• Tighten offboarding (office manager, a short checklist). Remove email, payment and remote access on someone’s last day. Why: forgotten accounts make quiet targets.
• Find your gaps (owner, a short sitting). The free cybersecurity grader asks about training, passwords, patching, backups and more, then scores each area with recommendations.

If you outgrow this: once you’re managing dozens of devices or regulated data, a managed detection service, a SIEM or a dedicated email security gateway starts to earn its cost. Most small offices don’t need those on day one. For the wider picture beyond email, read how to protect your employees and business from cybersecurity threats.

Someone Clicked. Here’s Your First-Hour Checklist

Someone will click eventually. What happens in the next hour decides whether it becomes a funny story at the next staff meeting or a week of cleanup, lost invoices and awkward calls to customers. A phishing link can install malware, capture a password on a fake sign-in page, or both. So the checklist covers the device and the account. If your business doesn’t have an IT person or MSP to call, contact us and we can help you work through it.

1. Disconnect the device (the person who clicked, right away)

   Turn off Wi-Fi or unplug the network cable, but leave the machine powered on so your IT person can inspect it. Why: it stops anything that was installed from reaching shared drives and other computers.

2. Reset the password from a different device (IT person or MSP)

   Use a clean phone or computer, and change any other account that shared the same password. Why: assume the attacker already has it.

3. Revoke active sessions (IT person or MSP)

   Sign the user out everywhere in Microsoft 365 or Google Workspace. Why: a stolen session can keep working after the password changes.

4. Check mailbox rules and forwarding (IT person or MSP)

   Look for new rules that forward, move or delete mail. Microsoft’s guidance on suspicious inbox forwarding rules treats them as a separate cleanup step. Why: a password reset alone can leave them running.

5. Call the bank if money moved (owner or office manager, immediately)

   Ask your bank’s fraud team to recall the wire or ACH payment before holding any internal meeting. Why: CISA’s BEC guidance puts fast contact with your financial institution first once funds are gone.

6. Report it and write it down (owner)

   Tell your IT person or MSP, your cyber insurer if you have one, and file a report with the FBI’s Internet Crime Complaint Center. Note what was clicked, when, and every step taken so far.

Who to call shouldn’t be a scavenger hunt. Put your IT person or MSP, your bank’s fraud line and your insurer on one card next to the office manager’s desk, and check the numbers every quarter.

Where Cloud Desktops Limit the Damage (and Where They Don’t)

Where your work lives decides how much one compromised laptop or login can reach. At V2 Cloud, we run managed cloud desktops, so here’s the honest version of what that changes and what it doesn’t.

When apps and files live on a centralized cloud desktop instead of each laptop, a phished home computer holds far less of your data. We enforce MFA and single sign-on (SSO) on the desktop login itself, not just on email, so a stolen password turns into a failed login attempt. For extra containment, our Security Pack add-on layers more protection on top, and daily offline snapshots give you a clean point to restore from if ransomware gets in anyway.

For MSPs: A Client-Ready Phishing Checklist to Forward

MSPs, this section is written to be forwarded as is. Copy the table into a client email or a one-page PDF, write real names in the Owner column, and book the quarterly review before you hit send. Clients rarely argue with a plan that already has their office manager’s name on it.

Want to turn this into a standing client runbook? The post on MSP documentation shows how to organize processes like this one. If you also host desktops for clients, our MSP partner program and our managed service providers page explain how we work with MSPs.

Phishing Protection Frequently Asked Questions

What is the first step to protect a small business from phishing?

The first step to protect a small business from phishing is turning on multi-factor authentication for every account, including the owner’s. Microsoft says more than 99.9% of compromised accounts don’t have MFA. MFA is included in Microsoft 365 and Google Workspace, and an IT person or MSP can enforce it company-wide.

How is business email compromise different from regular phishing?

Business email compromise is a type of phishing that impersonates a vendor, executive or employee to redirect a payment, often with no link or attachment at all. Because the message contains nothing malicious, spam filters rarely catch it. The strongest defense against BEC is a written rule to verify payment changes by calling back on a known number.

What should I do if an employee clicks a phishing link?

If an employee clicks a phishing link, disconnect the device from the network, reset the password from a different device, and sign the user out of every session. Then check the mailbox for new forwarding or delete rules, call the bank immediately if money moved, and report the incident to your IT person or MSP.

How often should a small business do phishing training?

A small business should run phishing training at least quarterly, with short monthly reminders in between. A few minutes at a regular team meeting, reviewing one real phishing example, suits small teams better than a long annual course. Pair phishing training with blame-free reporting so employees flag suspicious emails and admit mistakes quickly.

Can cloud desktops stop phishing attacks?

Cloud desktops don’t stop phishing emails from arriving, but they can limit the damage. When MFA protects the desktop login and company files live on a central cloud desktop rather than each laptop, a stolen password or compromised device reaches much less. Cloud desktops won’t stop a fake payment request, so the callback rule still matters.

Learn More About Protecting Your Business From Phishing

• How to Protect Your Employee and Business From Cybersecurity Threats: the wider security baseline beyond email, from devices to access by role.
• Ransomware Prevention Guide: How to Protect Systems and Data from Cyber Threats: how a phishing click turns into encrypted files, and how to block that path.
• Ransomware Recovery Guide: How to Mitigate an Attack and Regain Data Integrity: what to do if prevention fails and files are already locked.
• How to Secure Data for Remote Work: A Practical Guide for Remote Teams: training and reporting habits for teams that don’t share an office.
• MSP Documentation: Organize Your Processes for Business Growth: how MSPs turn checklists like this one into repeatable client procedures.