Key Takeaways

  • Small businesses are disproportionately targeted by phishing attacks — and modern scams are far more sophisticated than a badly worded email.
  • Telling employees to “be careful” isn’t a security strategy. Systemic fixes to accounts, email settings, and app permissions do far more than awareness training alone.
  • Phishing-resistant login methods like passkeys block over 99% of automated identity attacks, according to Microsoft’s Digital Defense Report.
  • Five specific controls — covering login methods, email authentication, app permissions, legacy protocols, and email scanning — work together to close the most common entry points scammers use.
  • TechEd Shield breaks these protections down into plain-language, actionable steps built specifically for business owners who don’t have an IT team.

Phishing is still the number one way scammers break into small business accounts. But the attacks look nothing like they did five years ago. They’re polished, personalized, and engineered to slip past filters that used to catch them. The good news? A handful of well-placed system changes can block the vast majority of them — no technical background required.

Small Businesses Are the Easiest Target — and Scammers Know It

Small businesses with fewer than 100 employees are 350% more likely to be targeted by social engineering attacks than larger companies, and 91% of cyberattacks start with a phishing email. That’s not scare talk — it’s the reality of running a business online without a dedicated security team.

Small businesses get hit so often because scammers go where defenses are weakest. Large enterprises invest heavily in security infrastructure; small businesses often run on default settings, shared passwords, and hope. Attackers exploit exactly that gap.

What’s changed is the quality of the attacks. Phishing used to be easy to spot — typos, awkward phrasing, suspicious addresses. Those red flags are mostly gone. Today’s attacks are tailored, context-aware, and built to look like a real contact reaching out. “Just look for typos” no longer cuts it.

Resources like TechEd Shield exist to bridge that gap — turning IT-team-level protections into clear, step-by-step guidance any business owner can actually follow and finish.

Why ‘Don’t Click’ Advice Isn’t Enough Anymore

Employee training has its place. But the idea that phishing protection begins and ends with teaching people to spot suspicious emails is dangerously out of date. Modern attacks are engineered to fool even cautious, security-aware people, using tools now far more accessible to scammers.

AI-Written Lures That Look Perfectly Legitimate

Generative AI has erased one of the last reliable red flags: bad writing. Attackers now draft hyper-personalized messages matching the tone and context of real business communication — targeted, polished, and indistinguishable from a genuine email from a colleague or vendor.

Email filters mostly scan for known bad patterns: flagged phrases, suspicious domains, malformed headers. An AI-written email referencing a real project, with correct grammar, from a near-right domain, gives filters little to catch.

QR Code Scams That Traditional Email Filters Miss

QR codes in phishing emails — “quishing” — are a fundamentally different attack. Instead of a clickable link that security tools can scan, attackers embed an image containing a QR code. Most email security systems analyze text and URLs; they can’t read what’s inside a picture.

When someone scans the code, the redirect happens on their phone — outside the security controls running on a work computer or network. Malicious QR code detections increased fivefold in late 2025, making this one of the fastest-growing attack types precisely because it sidesteps defenses most businesses already have.

The MFA Bypass Most Business Owners Don’t Know Exists

Multi-factor authentication is widely recommended, for good reason. But an Adversary-in-the-Middle (AiTM) attack can bypass standard MFA entirely — and no longer requires special skill.

Here’s how: the attacker sets up a fake login page acting as a silent go-between. When a victim enters their password and approves the MFA prompt, the fake site relays everything to the real service in real time — including the session token generated after login. The attacker ends up with an authenticated session, never knowing the password or touching the MFA device. Commercially available phishing kits automate this, within reach of almost any criminal.

This is the core problem with “don’t click” advice: it assumes the threat is obvious enough to avoid. AI lures, QR codes, and MFA bypass are designed so a careful person can still fall for them. The fix isn’t better reflexes. It’s better systems.

Step 1: Switch to Login Methods Scammers Can’t Steal

The most effective single change a small business can make is switching to a login method that can’t be intercepted — even if an employee lands on a fake website. That means moving from standard verification codes to phishing-resistant authentication.

Why Standard Two-Factor Codes Can Still Be Intercepted

Common MFA forms — SMS codes, email links, authenticator app codes — share one critical flaw: they rely on a secret that gets transmitted. When someone types a code into a login box, it travels from their device to a server. On a proxy site built to intercept it, that code goes straight to the attacker instead.

Push notifications share the same vulnerability. When an employee taps “approve” on a fake site, the approval passes through the attacker’s relay to the real service — completing the attacker’s login, not the employee’s. Standard MFA beats no MFA, but it wasn’t built to stop real-time relay attacks.

How Passkeys and Security Keys Block Phishing Attacks Effectively

Passkeys and FIDO2 hardware security keys work on a completely different principle. Instead Passkeys and FIDO2 hardware security keys work differently. Instead of transmitting a secret, they use public-key cryptography tied to the exact domain requesting the login:

  • Setting up a passkey creates a unique cryptographic pair — one key stays on the device, one is registered with the legitimate service.
  • At login, the real service sends a challenge. The device signs it with the private key — but only if the requesting domain exactly matches the one registered at setup.
  • On a fake or proxy site, the domain won’t match, so the device refuses to sign. No credentials ever reach the attacker.

A Simple 3-Phase Rollout for Non-Technical Teams

Switching to passkeys doesn’t have to happen all at once. A phased approach keeps it manageable:

Phase 1 (Weeks 1-2): Identify high-risk roles — admins, billing/payroll, HR with sensitive records — and equip them with FIDO2 hardware keys ($30-$60 each) for device-bound protection that can’t be bypassed remotely.

Phase 2 (Weeks 3-4): Roll out platform passkeys to everyone else using built-in device support (Windows Hello, Face ID/Touch ID, Android fingerprint) via FIDO2 registration through Microsoft Entra ID or Google Workspace, with a 14-day setup window.

Phase 3 (Weeks 5-6): Once adoption hits 95%+, enforce phishing-resistant authentication for critical apps, phase out SMS/voice OTP, and enable number matching as an interim safeguard for anyone still on push notifications.

Step 2: Stop Scammers From Impersonating Your Business Email

One of the most damaging phishing attacks doesn’t target your inbox — it uses your domain to target other people. An attacker sends an email that looks like it came from you, tricking customers, suppliers, or staff into acting on fraudulent instructions. Three standards — SPF, DKIM, and DMARC — exist to prevent this, forming a reliable shield against domain impersonation.

What SPF, DKIM, and DMARC Actually Do (In Plain Terms)

Think of these as a layered verification system for outgoing email:

  • SPF (Sender Policy Framework) publishes a list in the domain’s DNS of servers allowed to send email on its behalf. An email claiming to be from the domain but sent from an unlisted server fails SPF.
  • DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email, proving it wasn’t tampered with in transit, verified against a public key in the domain’s DNS.
  • DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties it together, telling receiving servers what to do with messages that fail SPF or DKIM — deliver, spam-folder, or reject — and generates reports on who’s sending email from the domain, including unauthorized senders.

DMARC is a necessity regardless of company size. Email fraud targets whoever has the weakest authentication setup. Without it, there’s no instruction for servers to follow even when SPF and DKIM fail.

Start With Monitoring, Then Gradually Lock Things Down

The biggest mistake is jumping to a strict policy before knowing what sends email on the domain’s behalf. A gradual three-phase rollout avoids blocking legitimate mail while building toward full protection:

Phase 1 — Monitor (Weeks 1-4): Publish a DMARC record set to p=none, collecting reports on sending activity without affecting delivery. Use a report parser to identify every service sending email from the domain — including third-party tools like Mailchimp that may not yet be properly authenticated.

Phase 2 — Quarantine (Weeks 5-8): Once legitimate sources align with SPF and DKIM, upgrade to p=quarantine. Unauthorized emails land in spam instead of the inbox. Monitor for deliverability issues for at least two weeks before advancing.

Phase 3 — Reject (Weeks 9-12): With confirmed clean alignment, enforce p=reject. Receiving servers now block any email failing authentication that claims to come from the domain — including every impersonation attempt.

During alignment, watch SPF record complexity. SPF has a hard limit of 10 DNS lookups. Businesses using multiple third-party tools often hit this ceiling, causing legitimate emails to fail. Flattening SPF records — converting nested includes into direct IP definitions — solves this before it becomes a deliverability problem.

Step 3: Close the ‘No Password Needed’ Backdoor in Your Apps

Passwords and MFA codes aren’t the only way attackers get into business accounts. A lesser-known method bypasses both — leaving an attacker with ongoing access to emails, files, and contacts even after a password reset.

How Consent Phishing Grants Persistent Access Without Stealing a Password

Modern business software — Microsoft 365, Google Workspace, most SaaS tools — uses OAuth to let third-party apps connect to accounts. When an app asks to “read your calendar” or “send email on your behalf,” that’s OAuth, and it’s legitimate.

The problem: attackers create fake apps using that same process. A scammer sends a link appearing to open a useful tool — a document viewer, file converter, shared workspace. Instead, it triggers an OAuth authorization screen asking for account access. If the user clicks “Accept,” the attacker’s app receives an OAuth token — a persistent key granting access to mailboxes, files, or directories — surviving password resets since it never depended on the password.

This is what makes consent phishing effective: it exploits the legitimate OAuth flow instead of stealing credentials, giving durable access that bypasses authentication entirely.

Restrict Who Can Approve Third-Party App Access

The fix: remove employees’ ability to approve app connections, routing decisions through admin review. Microsoft recommends restricting consent so standard accounts can only approve verified, low-impact apps — centralizing authorization with identity administrators.

  • Weeks 1-2: Audit every third-party app connected to the tenant. Revoke permissions for anything unused, unrecognized, or unverified.
  • Week 3: Block standard users from approving new app connections. In Microsoft Entra ID, require admin approval for all new apps.
  • Week 4: Enable an Admin Consent Workflow, routing blocked requests to a review queue so employees can still request tools without disruption. Require two administrators per request.

Once in place, configure every approved app so only specific users or groups can access it — not the whole organization. This limits damage if an integration is ever abused.

Step 4: Cut Off the Protocol That Makes MFA Pointless

It’s possible to have phishing-resistant MFA fully deployed and still have a back door wide open. Legacy email protocols can completely circumvent MFA — and many businesses have them running without realizing it.

The Hidden Risk of Older Email Protocols Still Running in the Background

Protocols like POP3, IMAP4, and SMTP AUTH were built decades before MFA existed. They don’t support MFA or conditional access — they accept a username and password, and if those match, access is granted, full stop.

That’s a problem if a password is ever exposed in a breach, guessed via password spraying, or bought from a credential list. An attacker doesn’t need to trick anyone into approving an MFA prompt — they connect straight to the legacy endpoint and log in. Over 99% of password spray attacks and 97% of credential stuffing attacks use legacy authentication, and disabling it cuts account compromises by 67%.

How to Identify, Migrate, and Disable Legacy Access Globally

Before disabling anything, find out what’s using these protocols — printers, shipping label systems, and older accounting software are common culprits.

Phase 1 (Weeks 1-3): Find active legacy connections. In Microsoft Entra ID’s sign-in logs, filter for client apps listed as “Authenticated SMTP,” “POP3,” or “IMAP4,” and map them to the devices generating them.

Phase 2 (Weeks 4-6): Migrate non-compliant devices. Check if a firmware update enables OAuth 2.0 for printers and scanners. For devices that don’t support it, configure SMTP Direct Send — outbound mail sent directly to the Exchange Online endpoint on port 25 without authentication — and add the device’s static IP to the SPF record.

Phase 3 (Week 7): Enforce the global ban. Once legitimate devices are migrated, disable POP3 and IMAP per mailbox, then apply a tenant-wide block on SMTP AUTH. From here, any legacy connection attempt is rejected at the protocol layer, before credentials are validated.

Step 5: Catch What Still Gets Through — Automatically

Even with all four previous steps in place, some phishing emails will still reach inboxes. No filtering system is perfect, and attackers are constantly refining their techniques. The goal of this final layer isn’t perfection — it’s speed. Catching and eliminating threats within seconds of detection matters far more than trying to prevent every single message from arriving.

Why Traditional Email Filters Miss Modern Threats

Most businesses rely on a Secure Email Gateway (SEG) — a filtering system that sits in front of the mail server and scans incoming messages before they’re delivered. This approach has two significant blind spots that matter more now than they used to.

First, SEGs are positioned to scan inbound email from outside the organization. They’re largely blind to internal emails — messages sent between employees, or from a compromised internal account spreading malware laterally. Account takeover attacks thrive in exactly this gap. Second, modern phishing payloads are increasingly image-based. A QR code embedded in a PNG file, a URL hidden inside a PDF, a split image designed to confuse automated scanners — these techniques specifically target the text-and-URL analysis methods that traditional gateways rely on.

How API-Based Email Security Scans Every Message, Including Internal Ones

API-based Integrated Cloud Email Security (ICES) solutions — such as Avanan, Sublime Security, or Ironscales — take a fundamentally different approach. Instead of sitting in front of the mail server, they connect directly to Microsoft 365 or Google Workspace through the platform’s native APIs. No MX record changes required, no DNS reconfiguration needed.

Because the connection is at the API level, the platform can scan every mail stream: inbound messages from outside, outbound messages leaving the organization, and internal messages passing between employees. It also enables multi-modal AI scanning — analyzing not just text and links, but image contents, QR codes, and document attachments in context. For small businesses, the cost is accessible.

The Automated Reporting Loop That Enables Rapid Remediation

Speed is what separates a manageable phishing incident from a full account compromise. Research from the Verizon Data Breach Investigations Report puts the median time from email delivery to a user clicking a link at 21 seconds. The median time for that same user to enter data after clicking is 28 seconds. That gap is where breaches happen.

The solution is to close that window through automation rather than faster human reaction times. When an ICES platform is paired with a one-click reporting button in employees’ email clients, the remediation process becomes nearly instant:

  1. An employee reports a suspicious email by clicking the report button.
  2. The ICES platform automatically scans the reported message and extracts its indicators of compromise.
  3. The platform performs a tenant-wide search-and-purge — identifying and deleting every copy of that email from every inbox across the organization, within seconds.

This automated loop means that even when a scam gets past the filters, a single report from one employee protects everyone else. Deploy in phases: start with API integration in monitor-only mode for 7-10 days to establish a baseline of normal communication patterns, then roll out one-click reporting buttons to all email clients, and finally activate automated search-and-purge playbooks once the system has calibrated to the organization’s mail environment.

Five Systemic Fixes Beat a Thousand ‘Be Careful’ Reminders

Phishing protection for small businesses doesn’t require an IT department, a six-figure security budget, or a 200-page compliance framework. It requires fixing the right five things — and understanding why each one matters.

Phishing-resistant login methods eliminate the class of attacks that standard MFA can’t stop. Email authentication protocols shut down impersonation attempts before they reach anyone’s inbox. Restricting third-party app permissions closes a persistent-access backdoor that bypasses passwords entirely. Disabling legacy email protocols removes the quiet back door that renders MFA irrelevant. And API-based email scanning catches what still gets through — then cleans it up automatically before it spreads.

None of these steps requires advanced technical knowledge. Each one can be put in place in phases, on a small business timeline, with tools already available through Microsoft 365 or Google Workspace. The protection they provide is measurable: 99%+ reduction in automated identity attacks, 67% fewer account compromises, and remediation windows measured in seconds instead of hours. The businesses that get compromised aren’t usually the ones that got outsmarted — they’re the ones that kept relying on advice built for a threat environment that no longer exists.

For small business owners ready to take those steps without getting lost in technical complexity, TechEd Shield provides straightforward, actionable cybersecurity guidance built specifically for businesses that don’t have an IT team.

TechEd Shield

Building 148741
PO Box 7169
Poole
England
BH15 9EL
United Kingdom

About The Author
NewsNetwork