Phishing is still the number one way small businesses get breached, and most owners find out after the wire transfer already cleared. This guide walks through the exact steps to lock down email, train staff, and build a response plan before an attacker gets the chance.

Why this matters

A single clicked link can hand an attacker your email account, your customer list, and your bank credentials in the same afternoon. Small businesses are targeted precisely because they run lean – one bookkeeper, one shared inbox, no dedicated security team watching for anomalies.

DBSI works with small and mid-sized businesses across Fairfield, NJ and the surrounding area, and the pattern repeats: the company that gets hit is the one still relying on a spam filter alone, no multi-factor authentication, and no plan for what happens after a click. Preventing phishing attacks at a small business isn't one purchase – it's a stack of five or six habits that work together.

What you'll need

• An email platform with spam and phishing filtering enabled (Microsoft 365, Google Workspace, or equivalent)
• Multi-factor authentication (MFA) turned on for every account that touches email, banking, or remote access
• A password manager for staff, so credentials aren't reused across sites
• A written incident response plan and a tested backup schedule
• 30-60 minutes per quarter for staff training – phishing awareness doesn't need a full day
• A relationship with an IT provider who monitors your network, not just one who fixes things after they break

If your business doesn't have any of this in place yet, start with network security services built for small offices rather than trying to patch things together with free tools.

The steps

Step 1: Turn on multi-factor authentication everywhere

MFA is the single highest-impact control against phishing, because it stops an attacker from using a stolen password alone. Even if an employee types their credentials into a fake login page, the attacker still needs the second factor – a phone app code or push notification – to get in.

Enable MFA on your email platform, your VPN or remote access tool, and any banking or payroll portal first. Use an authenticator app instead of SMS codes where possible; SMS can be intercepted through SIM-swap schemes. Expect some pushback from staff in week one – it adds five seconds to login, and that's the whole cost.

Common mistake: turning on MFA for the owner's account and forgetting the shared accounting or HR inbox that everyone uses. Those shared mailboxes are the accounts attackers target first because they're often the least protected.

Step 2: Filter email before it reaches the inbox

A good filter stops the majority of phishing attempts before an employee ever sees the message. Most business email platforms include built-in filtering, but the default settings are often too permissive for 2026-era attacks that use lookalike domains and compromised vendor accounts.

Turn on DMARC, SPF, and DKIM authentication for your domain – these three records tell receiving mail servers whether an email claiming to be from your company is legitimate. Add a banner that flags external emails, so staff can spot a message pretending to be from a coworker.

This is also where a managed network security setup earns its cost – filtering rules need periodic tuning as attackers change tactics, not a one-time configuration.

Step 3: Train staff to spot the red flags

Most phishing emails share tells: urgency (wire this today), a slightly altered sender address, a request to bypass normal approval steps, or a link that doesn't match the display text. Fifteen minutes walking through three or four real examples does more than a generic annual training video.

Run the training quarterly, not once a year. Attack techniques change fast enough that a training session from early 2026 will look outdated by the fourth quarter. Include a simple rule: any request to change payment details or wire money gets a phone call to a known number before it gets actioned, no exceptions.

Common mistake: training only the office staff and skipping field technicians, drivers, or remote employees who check email from personal phones. Attackers target whichever inbox is least protected.

Step 4: Segment your network so one click doesn't spread

If a phishing email does succeed, network segmentation limits the damage to one device or one department instead of the entire office. Put guest Wi-Fi, security cameras, and point-of-sale systems on separate network segments from the computers that handle email and financial data.

This is a network design decision, not a software toggle – it requires proper switch configuration and, in many cases, a review of how your cabling and access points are laid out. A network that was cabled five or ten years ago for a smaller staff often has everything sitting on one flat network by default, which means a single infected laptop can reach the server room.

Step 5: Build a written incident response and backup plan

Every small business assumes phishing prevention will work until it doesn't. When an account does get compromised, the businesses that recover in hours instead of days are the ones with a written plan: who gets called first, which accounts get locked, and how backups get restored.

A solid IT disaster recovery plan covers backup frequency, who has admin access to shut down compromised accounts, and how quickly systems come back online. Test the plan once a year with a tabletop exercise – walk through the steps out loud rather than assuming everyone remembers the procedure.

Step 6: Patch systems and rotate credentials on a schedule

Unpatched software gives attackers a second way in even after a phishing email is caught. Set a monthly patch schedule for operating systems, browsers, and any line-of-business software that touches email or financial data.

Rotate shared passwords – especially for accounting software, POS systems, and vendor portals – every 90 days, and immediately after any employee departure. A former employee's still-active login is one of the more common ways old phishing compromises resurface months later.

Troubleshooting

Staff keep clicking despite training. Shorten the training to 10-minute sessions run monthly instead of a long annual session – repetition beats duration for this kind of habit change.

MFA codes aren't arriving. Switch from SMS-based codes to an authenticator app; carrier delays and SIM-swap risk make text messages the least reliable second factor in 2026.

Filtering is blocking legitimate vendor emails. Whitelist specific sender domains for known vendors rather than loosening the entire filter – a blanket fix reopens the door you just closed.

An account was compromised and you're not sure what the attacker touched. Lock the account, force a password reset, and review the mailbox's sent folder and forwarding rules immediately – attackers often set up silent auto-forwarding to keep reading email after being locked out of the login.

Backups exist but nobody has tested a restore. Schedule a restore test now. A backup that has never been restored is a guess, not a plan.

Tools and resources

• Domain authentication records: DMARC, SPF, DKIM (free to configure through most DNS providers)
• An authenticator app (Microsoft Authenticator, Google Authenticator, or similar) for MFA
• A password manager for staff-wide credential hygiene
• A managed IT support provider that monitors filtering rules and patches on an ongoing basis rather than reactively
• A written, tested incident response and backup plan reviewed at least annually

What to do next

Once email filtering, MFA, and staff training are in place, the next gap is usually the IT relationship itself – a lot of small businesses still call someone only after something breaks. Reviewing how to choose an IT support provider for a small business is the logical next step once the basics above are locked down.

FAQ

One last thing

The fastest-growing phishing tactic in 2026 isn't the fake bank login page – it's the vendor impersonation email that asks to update banking details for an upcoming invoice. It looks routine, references a real project, and skips the urgency red flags most training focuses on. The single best defense against it isn't software at all: a standing rule that any change to payment details gets confirmed by phone call before it's processed, every time, no matter how legitimate the email looks.

Related guides

• Managed IT services for accounting firms
• IT support for financial services firms