Let’s be honest: cybersecurity isn’t exciting—but it IS essential.
Phishing attacks are getting smarter, sneakier, and far more damaging than most small businesses realise. From fake invoice emails to dodgy “CEO” messages, phishing is no longer just a problem for big corporations—it’s an everyday threat to SMEs like yours.
In this issue of Telecoms and IT Insights, we’re looking at how phishing attacks target small businesses—and the simple, effective steps you can take to protect your team.
Why SMEs Are Prime Targets for Phishing
Phishing is one of the most common forms of cyberattacks. It usually involves a scam email or text pretending to be a customer, supplier, bank, or even one of your own staff.
The goal? To get someone on your team to click a malicious link, download a dodgy attachment, or hand over sensitive info like passwords or bank details.
Why SMEs?
✔ Fewer cybersecurity policies in place
✔ Limited IT staff or outsourced support
✔ Lower awareness of scam tactics
✔ High-pressure environments where people click before thinking
We’ve seen it happen:
❌ Invoices paid to the wrong bank account
❌ Staff tricked into resetting passwords via fake login pages
❌ Malware installed from what looked like a supplier’s PDF
And it all adds up to lost time, lost money, and in some cases, lost trust.
7 Common Phishing Tactics That Catch SMEs Off Guard
- “Can You Just…” Urgent CEO Emails A scammer impersonates a director or manager asking for a quick favour—like transferring funds or buying gift cards. 💡 Check the sender’s email address. Urgency is a red flag.
- Fake Invoice Attachments An attachment looks like a bill from a supplier—but it installs malware when opened. 💡 Verify invoices directly before clicking or paying.
- Account Suspension Warnings Emails claiming your email, Office365, or bank account will be locked unless you click a link. 💡 Hover over links before clicking. Does it look legit?
- Delivery Notifications “Your parcel couldn’t be delivered. Click here to reschedule.” 💡 If you weren’t expecting a parcel, it’s probably a trap.
- Compromised Supplier Emails A genuine supplier gets hacked—and their account sends malicious files or payment requests. 💡 If the request seems unusual, double-check via phone.
- Fake Job Applications or CVs Malicious attachments posing as resumes—often sent to admin or HR. 💡 Open files only after verifying the source.
- Login Page Lookalikes You get redirected to a fake Microsoft/Google login. One click, and your credentials are stolen. 💡 Enable two-factor authentication (2FA) to reduce risk.
6 Practical Tips to Strengthen SME Defences
- Train Your Team (Without the Jargon) Hold a 15-minute “phishing awareness” session once a month. 💡 Use real-life examples, not scary tech terms.
- Set Up 2FA Everywhere Email, CRM, cloud storage—two-factor authentication is a no-brainer. 💡 It adds a second lock to your digital front door.
- Use an Email Filter with Phishing Detection Many business email tools now come with built-in scam filters. 💡 Talk to your IT provider to check your settings.
- Get a Password Manager No more reusing “Summer2024!” across 12 accounts. 💡 A password manager creates and stores unique, secure passwords for each platform.
- Have a “Check Before You Click” Rule Encourage staff to pause and ask: “Was I expecting this email? Do I know the sender?” 💡 Better to double-check than deal with a breach.
- Keep Backups Off-Site or in the Cloud If an attack locks your files (ransomware), you’ll need clean backups. 💡 Backups should be automatic, regular, and stored safely.
Everyday SME Scenarios We’ve Helped With
- A logistics company received a fake invoice and nearly paid £6,500 to a scammer. Staff training and two-factor email access stopped it in time.
- A dental clinic had its Gmail hacked through a fake login page. They now use a password manager and 2FA.
- A recruitment firm received a dodgy Word doc posing as a CV. Their antivirus flagged it—but only because it was up to date.
What You Can Do This Week
🔒 Choose one phishing tip from this newsletter and share it with your team.
📣 Add a “Check Before You Click” sticky note to your monitors.
🛡️ Don’t ignore small risks. One click can cause big damage.
If you’re unsure how to spot phishing emails—or just want to sanity-check your setup—I’m happy to help.
📞 0161 388 8188 Let’s chat about practical steps for keeping your data and team safe.
No jargon. No scare tactics. Just advice that works.
What’s the Worst Phishing Email You’ve Ever Seen?
Was it a dodgy Netflix account warning? A fake HMRC tax refund?
Reply in the comments—or message me if you’ve got a question about a suspicious email.
Stay smart. Stay safe.
