Your team is a strong line of defence
Most attacks on small businesses arrive as a message designed to trick a person: a fake invoice, a password reset, a supplier changing bank details, or a boss urgently requesting a payment. With a little awareness and a safe way to check, your staff become one of your most effective defences rather than a weak point.
Help staff recognise and report
Encourage a pause on anything unexpected that creates urgency or asks for money, credentials or data.
Teach people to verify requests through a known, separate channel, not by replying to the message.
Make reporting easy and blame-free, so staff raise concerns early; a fast report limits damage.
Protect accounts with multi-factor authentication so a stolen password is not enough on its own.
Defend against business email compromise
In business email compromise, an attacker uses a real or lookalike email account to request payments or change bank details. Agree a firm rule: any change to payment details, or any unusual or urgent payment, must be confirmed with the supplier or colleague using an established phone number before money moves. Require a second person to approve significant or unusual transfers.
If someone is caught out
Contact your bank or mobile-money provider immediately to try to stop or reverse the payment and secure the account.
Change the password and sign out other sessions on any account that was exposed, starting with email.
Keep the message, transaction details and a timeline, and report the incident through verified channels.
Review what allowed it to happen and adjust your checks, without blaming the individual.
Useful references
Here to help
Something doesn’t look right?
Prepare an incident report with the details that matter.