Why phishing still hits small businesses

Why it keeps working

Phishing exploits trust, urgency, and routine. A convincing email about an invoice, a delivery, or a password reset only needs to catch someone at a busy moment.

Attacks have also become more targeted, using details from social media and past breaches to look legitimate.

The defences that help most

• Multi-factor authentication — so a stolen password alone isn't enough.
• Well-configured email filtering to catch more before it lands.
• Short, regular awareness prompts for staff — not annual box-ticking.
• A simple, blame-free way for people to report suspicious emails.
• Payment and supplier-change processes that require a second check.

Make reporting easy

The goal isn't to catch people out — it's to make it normal and easy to report anything suspicious. The faster something is reported, the faster you can act.

If someone clicks, respond quickly and supportively. Fear of blame is what delays reporting and makes incidents worse.