Small businesses: open doors and no one watching them

Why small businesses are hit hardest

Every business has the same doors: an email address, a contact form, a phone number, a booking page, maybe a job posting. Large companies put layers in front of them. Small businesses rely on the owner reading everything, which worked when everything was written by a person. It does not work when most of it is generated.

The damage is also proportionally larger. A redirected invoice that a large company would absorb can end a small one. And the hours an owner spends sorting real enquiries from generated ones come straight out of the business.

The fraud that matters most

Business email compromise was the second costliest crime type in the FBI's 2025 report, at more than $3 billion in US losses. It rarely involves malware. A message arrives, apparently from a supplier, customer or colleague, asking for a payment to go to new bank details. It is fluent, correctly formatted and well timed. Increasingly it is written by AI. The only reliable defence is process: never accept a change of payment details by email alone.

The afternoon checklist

Email

• Publish SPF, DKIM and DMARC records for your domain. They are free, and without them anyone can send mail that appears to come from you. Start DMARC at monitoring (p=none) and tighten it once reports look clean.
• Lock down domains you own but don't send from with a null MX record, v=spf1 -all and a DMARC policy of p=reject.
• Turn on two-factor authentication for every mailbox, especially the one that receives invoices.

Payments

• Confirm any change of bank details by phone, using a number you already had, never one from the email.
• Require a second person to approve new payees above a set amount.

Forms and public channels

• Replace image CAPTCHAs with a modern invisible check.
• Route form submissions to a separate address, not the owner's personal inbox.
• Put a cost on first contact for channels that attract volume. Why a price works.

Accounts

• Use a password manager and unique passwords, so a leak elsewhere can't be replayed against you.
• Remove former staff from shared inboxes and tools on their last day.