Phishing is still the easiest way for criminals to get into a small business, and most of the damage starts with one person clicking one bad link. That link usually leads to a fake login page, a fake invoice, or a file that looks normal until it starts stealing passwords or locking files.
For a small business, this turns into real downtime fast. Email stops working. Payroll gets delayed. Shared files disappear. A criminal gets into Microsoft 365 and starts sending fake messages from your real account. That is how a simple click becomes a money problem.
Phishing usually works by stealing a password or session cookie through a fake login page that looks real.
If you run a 5 to 50 person office, this is for you. I am going to show you what phishing looks like now, what it can cost, what to change this week, and when it is time to get help before a bad email turns into a bad month.
What phishing looks like now
Phishing is not just the old fake bank email anymore. A lot of it now looks like Microsoft 365, DocuSign, payroll notices, shared file links, voicemail alerts, or messages from a boss asking for something urgent.
Attackers are getting more targeted. A recent campaign called VENOM has been used to steal Microsoft 365 logins from senior executives through phishing pages and attacker-in-the-middle techniques, according to Abnormal, Abnormal, BleepingComputer, TechRadar, and Infosecurity Magazine. Another campaign using LucidRook malware spread through spear-phishing emails aimed at specific groups, also reported by Cisco Talos and others.
That matters because small businesses see the same tricks. Maybe not with the same headlines. But the same methods.
In the field, the common versions look like this:
- A Microsoft 365 message saying your password expires today
- A fake shared document that asks you to sign in again
- An invoice with a link instead of a PDF
- A message that says your mailbox is full
- A text from the “owner” asking you to buy gift cards or send payroll data
The page often looks perfect. The logo is right. The colors are right. Sometimes even the address bar looks close enough to fool people who are busy.
That is the point. Phishing is built to catch people in a rush.
What this costs a business if you ignore it
The direct problem is lost access, stolen money, and downtime. The bigger problem is that one stolen login can turn into email fraud, file theft, ransomware, and a long cleanup.
Ransomware is often what comes after a phishing hit. A ransomware attack on healthcare software vendor ChipSoft forced systems offline, according to The Register, The Cyber Signal, DataBreaches.net, and SC Media. That is a big company example, but the same thing hurts small offices even more because they have less backup staff and less room for error.
IBM says the global average cost of a data breach was $4.88 million in 2024, according to the IBM Cost of a Data Breach Report. Small businesses usually do not see a bill that big. But they do feel the same types of costs:
- Employees sitting idle because email or files are down
- Lost invoices and delayed payments
- Bank fraud or wire fraud
- Emergency IT labor
- Legal and reporting work if private data was exposed
- Damage to trust when clients get fake emails from your account
Here is the plain-business version:
| Problem | What it looks like | Typical cost |
|---|---|---|
| Stolen Microsoft 365 login | Fake invoices, mailbox rules, account lockouts | Hours to days of cleanup and staff downtime |
| Business email compromise | Fraudulent payment requests sent from your account | Thousands to tens of thousands in stolen funds |
| Ransomware after phishing | Files locked, server or NAS unavailable | Major downtime, recovery labor, possible data loss |
The fix is almost always cheaper than the mess. Usually by a lot.
What you should do right now
If your business uses Microsoft 365, start there first. Most small business phishing damage runs through email accounts.
Do these five things this week:
- Turn on multi-factor authentication for every user, especially email, payroll, banking, and admin accounts.
- Block sign-ins from countries where you do not do business.
- Check for mailbox forwarding rules you did not create.
- Train staff to stop and verify any message asking for logins, payments, or sensitive files.
- Make sure you have backups that are separate from the main network.
MFA matters because a stolen password alone should not be enough to get in. It is not perfect. But it blocks a lot of basic attacks.
Also check your Microsoft 365 sign-in logs. Look for impossible travel, repeated failed logins, or sign-ins from strange locations. If that sounds too technical, have your IT person do it.
Then teach one simple rule to your staff: do not log in from a link in an email. Go to the site directly. Type it in. Use your bookmark.
That one habit prevents a lot.
How to make phishing a lot less likely long-term
You are not going to train humans into perfection. People are busy. They click fast. So you need layers.
The right setup for a small business is not fancy. It is just consistent.
Here is what I tell clients to keep in place:
- Email filtering that catches spoofing, bad links, and risky attachments before they hit inboxes
- MFA on all accounts, with stronger protection for owners and managers
- Password manager use so staff are not reusing the same password everywhere
- Regular patching for Windows, browsers, Office apps, and firewalls
- Staff phishing drills a few times a year
- Backups tested for actual restore, not just “it says completed”
- Limited admin rights so one bad click does less damage
This is the business impact section most owners really need. The problem is downtime and loss of control. The cost can range from a few hours of cleanup to a full week of disruption, plus fraud losses and outside labor. The fix is usually a mix of MFA, email filtering, backups, and basic account review, and for a small office that is often far cheaper than one emergency incident.
Even if you outsource IT, ask direct questions. Is MFA on for everyone? Are backups tested? Are failed logins being watched? If the answer is vague, push harder.
When to call someone right away
If someone clicked a bad link and entered a password, do not wait. Treat it like a break-in.
Call for help right away if any of these happened:
- An employee typed their password into a page they are not sure about
- You see MFA prompts nobody expected
- Emails are being sent from your account that you did not send
- There are new inbox rules, forwarding rules, or deleted messages
- Files suddenly have strange names or will not open
- Bank details or payment instructions were changed by email
The first steps are simple. Reset the password. Revoke active sessions. Check MFA methods. Review sign-in logs. Look for forwarding rules. Then check the computer itself for malware.
Speed matters here. A lot.
If your office has had close calls with fake Microsoft 365 logins, weird MFA prompts, or email accounts sending messages on their own, this is worth checking now before it turns into downtime. We help small businesses in Oregon find compromised accounts, lock down Microsoft 365, and clean up infected PCs before the damage spreads. You can reach Kusma at kusma.us if you want someone to look at what is happening in plain English and fix the part that is actually broken.
