Most phishing arrives by email, though text messages, phone calls, and QR codes are used too. The message copies a familiar brand, a supplier, or a colleague and creates urgency: an unpaid invoice, a locked account, a shared document. The link leads to a fake sign-in page that captures the password, or the attachment installs malware. Targeted versions aimed at one person are called spear phishing.
Small businesses are targeted because one captured mailbox is enough to do real damage. From inside it, an attacker can read invoices, reply to real conversations, and ask customers to pay into a different bank account. This is known as business email compromise, and it often goes unnoticed until money is missing. Anyone can be caught by one convincing message on a busy day.
No single control stops phishing, so layer them: email filtering, multi-factor authentication on every account, SPF, DKIM, and DMARC to stop others faking your domain, and short, regular staff training. Agree on a rule that any change of bank details is confirmed by phone using a known number. Make reporting a suspicious message easy and blame-free. We configure email filtering and sign-in protection as part of our security services.