Phishing and Business Email Compromise: A Small Business Guide

Most cyberattacks on small businesses don't begin with a hacker breaking through a firewall. They begin with an email. Someone at the front desk opens a "shared document," types their Microsoft 365 password into a page that looks exactly like the real sign-in, and a criminal quietly takes over the mailbox. A few weeks later, a vendor invoice goes out with new bank details, or payroll for one employee lands in someone else's account, and the money is gone.

That chain, phishing followed by business email compromise (BEC), is the most expensive cybercrime most small offices will ever face. The FBI's Internet Crime Complaint Center (IC3) recorded more than $3 billion in BEC losses in 2025 alone. Unlike ransomware, nothing breaks and no alarm sounds. The first sign is usually a vendor asking why they haven't been paid.

This guide explains how phishing and BEC actually work in 2026, the warning signs that matter, how to set up Microsoft 365 to block most of it, and the simple payment-verification habits that stop the losses even when an email gets through. We'll also cover what to do in the first hour if money has already gone out.

What are phishing and business email compromise?

Phishing is any message designed to trick someone into giving up a password, opening malware or taking an action that helps an attacker. (Our glossary has a short definition of phishing.) It usually arrives by email, but increasingly by text message, phone call, Teams chat or QR code.

Business email compromise is a specific kind of fraud that uses a hacked or faked email account to get a business to send money or sensitive information. The FBI defines it as a scam targeting businesses that work with suppliers or regularly make wire transfers, carried out by "compromising email accounts and other forms of communication such as phone numbers and virtual meeting applications, through social engineering or computer intrusion techniques to conduct unauthorized transfer of funds." (See business email compromise.)

The two are linked. Phishing is often how criminals get into a mailbox; BEC is how they turn that access into cash. Once inside, they read your email for weeks, learn who pays whom, copy your writing style, and wait for the right invoice.

Why small businesses are such good targets

Small offices aren't targeted because they're careless. They're targeted because of how they're built:

• One person often does everything financial. The office manager receives invoices, sets up vendors, enters bank details and releases payments. There's no second person to notice something odd.
• Trust is high and processes are informal. "Dr. Patel emailed and asked me to pay it" is a normal day at a practice, which is exactly what an impersonator relies on.
• Payments are regular and predictable. Supply orders, lab fees, rent, payroll. Criminals reading your email can see exactly when and how much.
• Email security is often left at defaults. Many small businesses pay for Microsoft 365 plans with strong protections and never turn them on.
• Losses are hard to absorb. A $40,000 misdirected payment is a rounding error for a hospital system and a crisis for a five-dentist practice.

None of these are fixed by buying more software. They're fixed by a combination of correctly configured tools and a few simple, written rules that everyone follows.

How big is the problem?

BEC causes more financial damage than almost any other cybercrime, and phishing is the most-reported one. Here's what the FBI's 2025 IC3 Internet Crime Report, published in 2026, shows:

A few things stand out:

• BEC losses are huge per incident. With about 24,800 complaints and $3.05 billion in losses, the average BEC complaint represented roughly $123,000. That's the kind of number that can sink a small practice.
• It's persistent. BEC losses reported to IC3 were $2.95 billion in 2023, $2.77 billion in 2024 and $3.05 billion in 2025, about $8.76 billion over three years.
• Phishing losses are climbing fast. Reported phishing/spoofing losses rose from about $70 million in 2024 to $216 million in 2025.
• AI is starting to show up. IC3 notes that chat tools can quickly write "official-sounding emails mimicking a company's CEO" and that voice cloning can be used to request wire payments. Businesses reported more than $30 million in 2025 losses to BEC scams involving AI.

Verizon's 2026 Data Breach Investigations Report adds that phishing on mobile devices, by text and phone, saw 40% higher click rates in simulations than email, which is why your defenses can't stop at the inbox.

What types of phishing should you know about?

Phishing comes in many forms, but they all try to get you to do one of three things: enter a password, open something malicious, or take an action (pay, share, approve). Knowing the formats helps staff recognize them.

Two of these deserve extra attention because they defeat security that small offices think they already have.

AiTM phishing defeats ordinary MFA. Microsoft's security team described Tycoon2FA, a phishing-as-a-service kit that let even low-skilled criminals bypass MFA, and that at its peak sent "tens of millions of phishing messages reaching over 500,000 organizations each month." Microsoft and Europol disrupted it in March 2026, but similar kits remain. In a separate January 2026 report, Microsoft traced a campaign that started with a phishing email from a compromised trusted vendor containing a SharePoint link, stole session cookies, then created inbox rules to hide replies and sent more than 600 further phishing emails from the victim's account.

Device code phishing uses Microsoft's own pages. In an April 2026 report, Microsoft described an AI-assisted campaign that tricked users into entering a code that authorized the attacker's session "without exposing credentials," then focused on people in "financial, executive, or administrative roles." Microsoft recommends blocking device code sign-in wherever it isn't needed. Microsoft Entra security defaults now block it, and Conditional Access can do the same.

What does business email compromise look like?

BEC is not one scam; it's a family of them. All share the same pattern: a believable request, a reason to act quickly, and a change to where money or data goes.

Vendor invoice fraud

The most common and most expensive form for small businesses. The attacker either compromises your vendor's mailbox (sometimes called vendor email compromise) or registers a look-alike domain, then sends a real-looking invoice with "updated" bank details. Because they've been reading the actual email thread, the invoice number, amount and timing are often correct.

Payroll diversion

An email to HR or the office manager, apparently from an employee: "I've changed banks, please update my direct deposit before Friday's payroll." Microsoft documented a group it calls Storm-2755 that used fake Microsoft 365 sign-in pages placed at the top of search results, stole employees' sessions, emailed HR to change direct-deposit details, and created inbox rules to hide any email containing "direct deposit" or "bank."

Executive impersonation

"I'm in a meeting and can't talk. I need you to send a wire to close a deal today, keep this confidential." Or the smaller version: "Can you buy five $200 gift cards for staff appreciation and send me the codes?" This one hits retail shops and practices often because the owner is frequently away from the front desk.

Real estate and closing fraud

Buying or leasing an office? Wire instructions for a closing are a prime target. The IC3 report describes a 2025 case where a Missouri buyer received a compromised email from the "title company" with wire instructions for over $1.3 million to a fraudulent account. The FBI's Recovery Asset Team stepped in to freeze the receiving account.

Data theft BEC

Not every BEC scam wants money directly. A request for "all W-2s for the accountant" or "the patient list for the new billing company" sends sensitive data to criminals, who use it for tax fraud or identity theft.

What are the real warning signs?

The old advice ("look for spelling mistakes") doesn't work anymore. AI writes clean, professional email, and BEC often comes from a genuine, hacked account. Focus on the request, not the polish.

Red flags in the request itself:

1. Any change to payment details: new bank, new account, "our old account is under audit."
2. Urgency or secrecy: "today," "before the end of business," "don't mention this to anyone."
3. A process exception: "skip the usual approval this once," "I can't talk, just email."
4. A switch of channel: "text me at this new number," "call this number to confirm," "move this conversation to WhatsApp."
5. Gift cards, crypto or unusual payment methods.
6. A sign-in request you didn't start: a document "requiring" you to sign in, or an MFA prompt you didn't trigger.

Technical clues worth checking:

• The display name is right but the actual address isn't (accounts@vendor-billing.com instead of accounts@vendor.com).
• Look-alike domains: rn instead of m, an extra letter, .co instead of .com.
• The Reply-To address differs from the From address.
• An External tag on a message that claims to come from a colleague.
• A link that, when you hover over it, goes somewhere unrelated to the sender.
• A sign-in page whose address bar isn't login.microsoftonline.com (or your organization's known sign-in address).

Want to test your team? Our free phishing quiz walks through realistic examples in a few minutes.

How to spot a fake sign-in page or MFA prompt

Because so much phishing now targets Microsoft 365 passwords, it's worth teaching everyone three specific habits:

1. Never sign in from a link in an email. If a message says you have a shared file or voicemail, open Outlook, Teams or OneDrive the way you normally do and look for it there. If it's real, it will be there.
2. Never sign in from a search result. Bookmark office.com (or your organization's portal) and use the bookmark. Criminals buy search ads and manipulate results so the first "Office 365 login" link is theirs.
3. Deny any MFA prompt you didn't start, then report it. An unexpected prompt means someone has your password. With number matching, you'll be asked to type a number shown on the sign-in screen; if you're not looking at a sign-in screen, there's no number to type, and that's your cue to deny and call IT.

And one habit for owners and managers: when someone admits they entered their password on a suspicious page, thank them. The faster they tell you, the less it costs.

What should you do if someone clicked a phishing link?

Act within minutes, even if no money has moved. A clicked link or entered password is a contained problem if you respond quickly and a full mailbox takeover if you don't.

1. The person reports it immediately to your IT provider (phone, not email, if their mailbox may be compromised).
2. IT resets the password and revokes all active sessions in Microsoft Entra ID. Revoking sessions matters because AiTM kits steal the session itself.
3. IT checks the account's MFA methods and removes any the user didn't add. Attackers often register their own phone or authenticator to keep access.
4. IT reviews inbox rules, forwarding settings and recent sign-ins for the account, and looks for any new app consents.
5. IT checks what was sent from the account. If the attacker sent phishing emails to your contacts, warn them by phone or a separate message.
6. If a file was opened, IT checks the device with EDR and isolates it if anything suspicious ran. (See our ransomware protection guide for why speed matters.)
7. Someone decides whether sensitive data was exposed. For practices and CPA firms, document what the mailbox contained and what the sign-in logs show the attacker accessed. That record drives any notification decision.
8. Pull the original phish from everyone's mailbox so nobody else clicks it.

None of this is complicated, but it needs to be written down and practiced. In the middle of a busy clinic day, nobody remembers step 4 unless it's on a checklist.

How do you protect Microsoft 365 from phishing and BEC?

Turn on the protection you're already paying for, lock down sign-ins, authenticate your domain, and watch for the signs of a takeover. Here's the configuration we use for small offices on Microsoft 365, in priority order.

1. Lock down sign-ins

Most BEC starts with a stolen sign-in, so this comes first:

1. Require MFA for everyone. If you don't have Microsoft Entra ID P1 (included in Microsoft 365 Business Premium), turn on security defaults, which require MFA registration, block legacy sign-in protocols that bypass MFA, and block device code flow. Microsoft states that MFA "can block over 99.2% of identity-based attacks."
2. Use Conditional Access if you have Business Premium. Require MFA, block legacy authentication, block device code flow, and require that people sign in from company-managed devices for sensitive apps.
3. Move toward phishing-resistant MFA. CISA calls it "the gold standard." Microsoft's guidance after the Tycoon2FA takedown is to deploy "FIDO2 security keys, Windows Hello for Business, and Microsoft Authenticator passkeys." Start with admins, the owner, and anyone who approves payments.
4. Restrict app consent so staff can't grant third-party apps access to their mailbox without admin approval.

Our multi-factor authentication guide covers rollout in detail.

2. Turn on Defender for Office 365 properly

Every Microsoft 365 mailbox includes baseline anti-spam, anti-malware and anti-spoofing protection. Defender for Office 365 Plan 1, included in Microsoft 365 Business Premium according to Microsoft Learn, adds the layers that matter most against targeted phishing:

• Safe Links checks links when they're clicked, not just when the email arrives, so a link that turns malicious later is still caught.
• Safe Attachments opens attachments in a sandbox before delivery.
• Impersonation protection flags emails that pretend to be your owner, key staff or important vendor domains. Add your executives and your top vendors explicitly.
• Mailbox intelligence learns who each person normally emails and flags unusual senders.

The quickest way to get sensible settings is Microsoft's Standard or Strict preset security policies, then tune from there. Plan 2 adds attack simulation training and deeper investigation tools; it's included in enterprise E5 plans or available as an add-on.

3. Authenticate your domain with SPF, DKIM and DMARC

Without these records, anyone can send email that says it's from you. Microsoft Learn describes them as "interdependent building blocks" and warns that "anything less than all of the email authentication methods results in substandard protection."

• SPF (Sender Policy Framework) lists the servers allowed to send email for your domain.
• DKIM (DomainKeys Identified Mail) digitally signs each message so receivers can tell it wasn't altered.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) checks that the visible From address matches what SPF or DKIM verified, tells receiving servers what to do with failures, and sends you reports.

A sensible rollout:

1. List every service that sends email as your domain: Microsoft 365, your practice-management or billing system, appointment reminders, marketing tools, the copier's scan-to-email.
2. Publish SPF including all of them, then turn on DKIM signing in Microsoft 365.
3. Publish DMARC at p=none with reporting, and read the reports for a few weeks.
4. Fix anything legitimate that fails, then move to p=quarantine, and finally p=reject.
5. Publish "null" SPF and DMARC reject records on domains you own but don't send from, so criminals can't use them either.

Check your domain in seconds with our free email security checker.

4. Tag external email

External sender identification adds an External tag to messages from outside your organization in Outlook on Windows, Mac, the web and mobile. It's enabled with the Set-ExternalInOutlook command, and Microsoft notes it can take 24–48 hours to appear. It's simple, and it catches the classic trick of an outsider using your owner's display name.

5. Watch for signs of account takeover

Attackers who get into a mailbox almost always create inbox rules to hide their tracks: moving replies to an obscure folder, deleting messages containing "invoice," "payment," "bank" or "direct deposit," or forwarding mail outside the company. Every Microsoft security report we've cited above mentions them.

• Alert on new inbox rules, especially ones that delete, move to RSS/Archive folders, or forward externally.
• Block automatic forwarding to outside addresses in the outbound spam policy, with documented exceptions only.
• Alert on sign-ins from unusual countries or impossible travel.
• Review mailbox audit logs during any investigation (keep auditing on).

6. Make reporting easy

Turn on the built-in Report button in Outlook so staff can flag a suspicious message in one click. Reported messages go to your IT provider for review, and if a phish is confirmed, it can be pulled from every mailbox. Microsoft's zero-hour auto purge does some of this automatically.

Microsoft 365 anti-phishing settings at a glance

What payment verification procedures stop BEC?

The most effective defense against BEC isn't technology. It's a written rule that money never moves to new bank details based on email alone. Even if every filter fails and a mailbox is compromised, this rule stops the loss.

The core rules

1. Verify every bank detail change by phone. Call the vendor, employee or client using a number you already had on file (from a previous invoice, contract or your vendor master list), never a number in the email or one the requester gives you.
2. Two people for every payment change. One person verifies, a second approves the change in your accounting system.
3. A cooling-off period. New or changed bank details aren't used for 3–5 business days, and the first payment to new details is verified again.
4. No exceptions for urgency or seniority. Write down that the owner will never ask anyone to skip verification, and that anyone who does follow the process will never be blamed for a delay.
5. Payroll changes in person or through the payroll portal only, with confirmation sent to the employee's previous contact details.
6. Gift cards are never a payment method.

Verification by request type

Bank-side protections

Ask your business bank about:

• Positive Pay for checks and ACH, which flags payments that don't match what you issued.
• ACH debit blocks or filters so only approved companies can debit your account.
• Dual approval in online banking for wires and new payees.
• Callback verification for wires above a set amount.
• Out-of-band alerts by text or app for any new payee or wire.

These are usually low-cost or free for business accounts and add a final check outside your email entirely.

What should you do if you've sent money to a scammer?

Call your bank immediately. Every hour matters. The FBI's 2025 IC3 report is direct: "If you discover a fraudulent transfer, time is of the essence."

1. Call your bank's fraud department now. Ask them to recall the wire or ACH and to contact the receiving bank. Ask what indemnification paperwork they need.
2. File a complaint at IC3.gov "regardless of the amount lost," with full transaction details: amount, date, sending and receiving banks, account numbers. IC3 may initiate its Financial Fraud Kill Chain to help freeze funds.
3. Call your local FBI field office for large amounts.
4. Secure the compromised mailbox. Reset the password from a clean device, revoke all sessions, remove unknown MFA methods, and delete malicious inbox rules. Microsoft warns that "in AiTM attacks, since the sign-in session is compromised, password reset is not an effective solution" on its own.
5. Check other mailboxes. Attackers often phish onward from the first account.
6. Preserve evidence. Don't delete the fraudulent emails; export them with full headers.
7. Call your cyber insurer. Social engineering or "funds transfer fraud" coverage is often a separate, lower sublimit, and you may need to notify promptly.
8. Warn the affected vendor, client or employee using a known phone number.
9. Assess notification duties. If the mailbox held patient or client data, you may have a breach to report (see below).

How effective is fast action? IC3's Recovery Asset Team worked 3,900 incidents in 2025 involving about $1.16 billion in attempted theft and froze $679 million, a 58% success rate. Those freezes depend on reports arriving while the money is still in the first account.

What does this mean for healthcare and professional firms?

For medical and dental practices and CPA firms, a phished mailbox isn't just a fraud risk. It's often a data breach.

HIPAA and compromised mailboxes

Practice email is full of protected health information (PHI): referral letters, lab results, insurance details, appointment confirmations. If an attacker had access to a mailbox, you have to determine what they could see. Under the HIPAA Breach Notification Rule, unauthorized access to PHI is presumed to be a breach unless a documented risk assessment shows a low probability the information was compromised. If it is a breach, you must notify affected patients within 60 days of discovery and report to HHS.

Phishing is also a common route to ransomware. When HHS's Office for Civil Rights settled with BST & Co. CPAs in August 2025 (an accounting firm handling PHI as a business associate for a medical group), OCR said the ransomware attack had been triggered by a phishing email and that the firm hadn't done the required risk analysis. The firm paid $175,000 and agreed to a corrective action plan.

Reducing how much PHI sits in email in the first place helps. Use your EHR's messaging or encrypted email for patient information. See our guide to HIPAA-compliant email encryption.

CPA and tax firms

Tax season brings a predictable wave of phishing: fake clients sending "my documents" links, fake IRS notices, and requests to change where a client's refund is deposited. CPA firms covered by the FTC Safeguards Rule are required to use MFA for anyone accessing customer information and to have a written information security plan. More in our guide to IT security for CPA firms.

Phishing and BEC scenarios: how they play out

These are illustrative scenarios based on common attack patterns, not specific clients.

Dental office: the supply invoice

The office manager at a six-chair dental practice gets an email from the dental supply company's real address, replying to last month's genuine invoice thread: "Please note our banking details have changed effective this month. Updated invoice attached." The supplier's mailbox had been compromised.

What stops it: the practice's written rule that bank changes are verified by calling the supplier's rep at the number on the original contract. The rep has no idea what the office manager is talking about, and the payment never goes out. The practice also warns the supplier, who discovers the breach.

Medical office: the direct deposit

A medical assistant's Microsoft 365 password is captured by a fake sign-in page after she searches "Outlook login" on a home computer. The attacker emails the practice administrator from her real account asking to change her direct deposit before payroll.

What stops it: the practice requires payroll changes through the payroll portal (which has its own MFA) and confirms with the employee in person. The administrator mentions it to the assistant at lunch; IT revokes her sessions, finds an inbox rule hiding emails containing "deposit," and investigates what patient information was in the mailbox for HIPAA purposes.

CPA firm: the client refund

During tax season, a partner gets an email from a long-time client asking to change the bank account for their refund. The email address is one letter off from the client's real domain.

What stops it: impersonation protection flags the look-alike domain, the External tag is visible, and the firm's procedure requires verbal confirmation of any change to refund deposit details using the phone number in the client file.

Small retail shop: gift cards

A sales associate gets a text from the "owner" (a new number) asking her to buy $1,000 in gift cards for a customer promotion and text photos of the codes.

What stops it: the owner has told staff in writing that she will never ask for gift cards, and that any payment request by text gets a call to her known cell number. The associate calls; the owner is at home, and the scam goes nowhere.

How do you train staff to spot phishing?

Effective training is short, frequent and practical, and it rewards reporting rather than shaming clicks. Annual hour-long slideshows don't change behavior; monthly five-minute lessons and realistic simulations do.

A program that works for a 10–30 person office:

1. Onboarding: 20 minutes covering phishing, BEC, the payment-verification rules, and how to report.
2. Monthly micro-lessons: 3–5 minutes on one topic (QR code phishing, fake MFA prompts, gift card scams).
3. Simulations: a realistic simulated phish every month or quarter, using lures relevant to your industry (insurance EOBs for practices, IRS notices for CPAs, shipping notices for retail).
4. Immediate, private feedback for anyone who clicks: a short lesson, not a public callout.
5. Track the right metrics: report rate and time-to-report matter more than click rate. A team that reports within five minutes is a team that limits damage.
6. Role-specific sessions for whoever handles payments, payroll and vendor setup.
7. A quarterly tabletop: walk through "we just wired money to a fake vendor — what now?"

Our phishing quiz is a quick, free way to start the conversation at a staff meeting.

Questions to ask your IT provider about email security

If you're not sure how well your email is protected, these questions will tell you quickly (they're also useful when choosing a managed IT provider):

1. Is MFA enforced for every mailbox, and are legacy sign-in protocols blocked?
2. Which of our staff use phishing-resistant MFA, and what's the plan for the rest?
3. Is device code sign-in blocked?
4. Are Safe Links, Safe Attachments and impersonation protection turned on, and which people and vendor domains are on the impersonation list?
5. What's our DMARC policy today, and when will we reach p=reject?
6. Who gets alerted when someone creates an inbox rule that forwards or deletes mail, and how fast do they act?
7. If a staff member enters their password on a phishing page at 7 p.m., what happens, and who does it?
8. Can we see a monthly report of phishing caught, user reports and simulation results?

Vague answers to questions 6 and 7 are the most common gap we find. Detection without someone responding doesn't stop a takeover.

Mistakes we see

• Trusting the email because it came from the vendor's real address. In BEC, it often did.
• Calling the number in the email to verify. That number belongs to the criminal.
• MFA on email but legacy sign-in protocols left open, letting attackers bypass it.
• Resetting the password but not revoking sessions after a compromise.
• Never checking for inbox rules during an investigation.
• DMARC stuck at p=none for years, providing reports nobody reads and no protection.
• No written payment policy, so staff feel they can't push back on the owner.
• Treating a phished mailbox as "just IT" without assessing whether patient or client data was exposed.
• Assuming cyber insurance will cover it without checking the social-engineering sublimit and conditions.

Phishing and BEC protection checklist

Sign-in security

• MFA required for every user (security defaults or Conditional Access)
• Legacy authentication blocked
• Device code sign-in blocked unless specifically needed
• Phishing-resistant MFA (passkeys or security keys) for admins, owner and payment approvers
• User consent to third-party apps restricted

Email protection

• Defender for Office 365 (or equivalent) with Safe Links and Safe Attachments on
• Impersonation protection configured for executives and key vendors
• SPF, DKIM and DMARC configured, with DMARC moving toward p=reject
• External sender tagging enabled
• Automatic forwarding to external addresses blocked
• Report button available in Outlook

Detection and response

• Alerts on new suspicious inbox rules
• Alerts on risky or unusual sign-ins
• Mailbox auditing on
• Documented steps for a compromised mailbox (reset, revoke sessions, remove rules, investigate)

Payments

• Written policy: bank changes verified by phone using known numbers
• Two-person approval for new payees and changed bank details
• Cooling-off period for new bank details
• Payroll changes only through portal or in person
• No gift card payments, ever
• Bank protections: Positive Pay, ACH filters, dual approval, alerts
• Bank fraud phone number and IC3 link in the incident plan

People

• Onboarding security training
• Monthly micro-training and regular simulations
• Role-specific training for finance, payroll and front desk
• Reporting celebrated, not punished

The bottom line

Phishing gets criminals into your mailbox; business email compromise turns that access into money. You can block most of the first with Microsoft 365 configured properly (strong MFA, Defender for Office 365, SPF/DKIM/DMARC, external tags and inbox-rule alerts), and you can stop nearly all of the second with one habit: never change where money goes without a phone call to a number you already trust.

BEC is also the doorway to bigger problems. The same stolen sign-in can lead to ransomware, and many cyber insurance applications now ask about these exact controls.

If you'd like us to check your Microsoft 365 email security and help you write a payment-verification policy your team will actually follow, see our managed IT and security services or book a free 20-minute call.