A solicitor's practice with eleven staff contacted us after a member of the accounts team received what appeared to be an invoice from one of their regular suppliers. The email looked right. The logo was right. The wording was right. The bank details were different. She nearly paid it.
That near-miss is a reasonably typical starting point for conversations we have. The business had antivirus. They had a decent broadband router. They did not have anything that would catch a well-crafted spoofed email before it reached an inbox.
Why phishing still works
The reason phishing remains effective against small businesses is not that the attacks are especially sophisticated. It is that the defences are often absent in ways that take an hour or two to correct.
Most phishing emails that successfully extract money or credentials from small businesses rely on one of three things: the domain can be spoofed so the email appears to come from a trusted address; there is no procedure for staff to follow when something looks suspicious; or both.
The technical controls and the human controls are both necessary. Either one alone is not enough.
Email gateway controls worth checking first
Before talking to staff, it is worth spending time on the configuration of your email domain. Three records — SPF, DKIM and DMARC — determine whether other mail servers can send email using your domain address.
SPF (Sender Policy Framework) tells receiving mail servers which servers are authorised to send email on behalf of your domain. If this is missing or incorrect, anyone can send an email that appears to come from your address.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing mail that allows the recipient's server to verify the message was not altered in transit. It does not prevent spoofing by itself, but it is part of the chain that DMARC relies on.
DMARC (Domain-based Message Authentication, Reporting and Conformance) is the one that actually does the work. It tells receiving servers what to do when an email fails the SPF or DKIM check — and, critically, it can tell them to reject it. Many businesses have SPF and DKIM configured but leave DMARC set to "none," which means those checks produce no action.
You can check your current DMARC policy by looking up your domain in any DNS lookup tool. If the policy value is "none," receiving servers are doing nothing with the authentication results. Moving it to "quarantine" or "reject" is the change that matters.
The procedure that makes the human side work
Technical controls catch a lot. They do not catch everything. When a suspicious email does reach someone, what happens next depends almost entirely on whether there is a clear agreed procedure.
In businesses without a procedure, the outcome is unpredictable. Some people forward it to a colleague to ask what they think. Some people click it to find out. Some people delete it and say nothing. None of these are what you want.
The procedure does not need to be complex. It needs three things: a clear definition of what "suspicious" means so people can make the call confidently; one designated person to send suspicious emails to (not a committee); and a commitment that the person reporting something will not be made to feel foolish for reporting it, even if it turns out to be legitimate.
That last point matters more than most people expect. The main reason staff do not report suspicious emails is that they are worried about looking paranoid or wasting someone's time. If the procedure is set up so that reporting is normal rather than exceptional, reports go up considerably.
A note on invoice fraud specifically
The solicitor's case above was an invoice fraud attempt — sometimes called business email compromise — rather than a credential-phishing attack. The goal was not to steal a password but to change a bank account number in the recipient's mind before a payment was made.
This type of attack is worth addressing separately because the technical controls help less with it. A spoofed invoice may arrive via a legitimate address that was compromised elsewhere. The control that works here is a phone call: if you receive a request to change payment details from any supplier, verify it by phone using a number you already have, not a number in the email.
This sounds obvious. It is worth writing down and putting next to the accounts function anyway. The calls you make are the ones that matter.
Where to start this week
If you are starting from scratch, three things are worth addressing in order. Check and correct your DMARC policy. Write a one-paragraph procedure covering what to do with suspicious emails and who to send them to. Talk to whoever handles payments about the phone-call rule for changed bank details.
None of these require external help or expenditure. They require about two hours of attention from whoever manages the business and whoever manages the email.
If you are not sure what your DMARC status is or how to change it, we can check it for you and explain what needs to change. That call is free.
Email updates
New articles by email when something new goes up.