How to protect your business from phishing emails and invoice fraud
Updated: Oct 17
Protecting a small business from phishing comes down to two things: making stolen passwords useless and making sure no payment goes out on the strength of an email alone. Phishing is the most common way UK businesses are attacked. The government's Cyber Security Breaches Survey 2025 found that 43% of businesses had a breach or attack in the previous 12 months, and that phishing was involved in 85% of those. Most attempts are caught by email filtering or ignored, but the ones that get through tend to aim at the two things a criminal can turn into money quickly, a login or a payment.
What does phishing look like in a small business?
Most phishing emails try to get someone to type their password into a fake sign-in page, usually one dressed up as Microsoft 365, a shared document or a parcel delivery. Once a criminal has a working password, they can read the mailbox, send email as that person and look through it for invoices, payment runs and supplier conversations to copy.
The more damaging version doesn't ask for a password at all. It's an email that appears to come from a supplier, a client or someone senior, asking for an invoice to be paid to new bank details or for an urgent transfer. UK Finance's Annual Fraud Report 2026 recorded £41.3 million lost to invoice and mandate scams in 2025, and £28 million of that, 68%, was lost by businesses rather than individuals. The report notes that these scams often involve the criminal intercepting emails or taking over a mailbox, which is why the request can arrive in what looks like a genuine conversation.
How do you stop a stolen password being used?
Multi-factor authentication is the most useful single step, because a password tricked out of someone is far less use to a criminal when the sign-in also needs approval on that person's phone. On Microsoft 365, the built-in security defaults switch it on for everyone and block the older sign-in methods that can't use it, and our guide to Microsoft 365 security covers how to check they're still on.
Email filtering is the next layer. Microsoft 365 business plans filter spam, malware and spoofed senders as standard, and Business Premium adds checks on links at the moment someone clicks them and protection against emails impersonating people you deal with. Records on your own domain, called SPF, DKIM and DMARC, stop criminals sending email that pretends to come from you, which protects your customers and suppliers as well as your reputation. Our article on why business emails go to spam explains how they work.
How do you stop a fake invoice being paid?
No filter catches every convincing payment request, so the protection has to sit in how your business pays. The simplest rule is that a change to anyone's bank details is never accepted by email alone: call the supplier on a number you already hold, rather than one in the email, and confirm before the first payment goes to the new details. The same applies to urgent requests from someone senior to pay something outside the usual process.
Two other habits help. Have a second person approve new payees and payments over a set amount, so one person who has been tricked can't send money on their own. And look out for inbox rules nobody remembers setting up, especially ones that forward email outside the business or move messages into an obscure folder, because a criminal who has taken over a mailbox often uses them to hide replies.
What should you do if someone clicks or pays?
Speed matters more than anything. If someone entered their password on a fake page, change it straight away, sign them out of every device and check their mailbox for new forwarding rules. If money has gone to the wrong place, the NCSC's guidance on business payment fraud says to contact your bank directly using its official website or phone number, tell whoever looks after your IT as soon as you can, and report it through gov.uk if you're a UK organisation. The sooner the bank knows, the better the chance of stopping the payment.
It also helps to make owning up easy. Someone who clicked a link and says so within minutes costs far less than someone who stays quiet out of embarrassment.
Is your business protected?
These questions cover the gaps that phishing and invoice fraud most often get through.
Is multi-factor authentication on for everyone, including admin logins?
Would a change of supplier bank details be checked by phone before anything was paid?
Does a second person approve new payees and larger payments?
Has anyone checked for inbox rules that forward email outside the business?
Does your team know who to tell, straight away, if they click something?
Any "no" is worth fixing before the next convincing email arrives.
The short version
Phishing usually aims at a login or a payment. Multi-factor authentication and good email filtering make stolen passwords far less useful, and a firm rule that bank details are only ever changed after a phone call stops most fake invoices being paid. Neither needs anything expensive, but both need someone to set them up and keep them in place.
Our cyber security page explains how we set up and look after email security, device protection and Microsoft 365 backup for small businesses, with a price for the set-up before any work begins.
