Small business owners often tell me they are too small to be a target. In my experience, that belief is exactly what makes a small business attractive. Attackers do not pick you by name. They send the same message to thousands of inboxes and wait for someone to click.
I am Vice President of Operations at DirecTech Connect, a Nashville-area provider of business phone systems, managed IT, websites and digital marketing. I oversee our managed VoIP and telecommunications services, managed IT for small and medium-sized businesses, and client project delivery, so these are questions I deal with every week.
What phishing looks like. A phishing email pretends to be someone you trust, such as a vendor, a bank, a coworker or Microsoft itself, and asks you to do something quickly. It might say your account is locked, an invoice is overdue or a shared document is waiting for you.
Slow down at the urgent ones. Urgency is the main tool. A message that pushes you to act in the next hour, keep it secret or skip your normal process deserves a second look, even when it appears to come from your own boss.
Check the sender and the link. Look at the actual email address, not just the display name. Hover over a link before you click to see where it really goes. If anything feels off, open a new browser window and go to the site yourself instead of following the link.
Confirm money requests another way. If an email asks you to change bank details, pay a new invoice or send gift cards, call the person at a number you already have. A thirty-second call is cheap insurance.
Multi-factor authentication, or MFA, is the second habit. It means a password alone is not enough to get into an account. After you enter your password, you also approve a prompt on your phone or enter a code. If someone steals your password through a phishing email, MFA can still keep them out.
Turn MFA on first for email, since email can reset almost every other password. Then add it to your accounting software, your bank, your cloud storage and anything that holds customer information. An authenticator app on your phone is generally stronger than a text message code, and either is far better than nothing.
Last, make it safe to report. Tell your team that clicking a bad link is not a firing offense, but hiding it is a problem. The faster someone says “I think I clicked something,” the faster we can change passwords and limit the damage.
If you would like help turning on MFA across your team or setting up email protection, that is a normal part of the managed IT work we do at DirecTech Connect. Start with the two habits above, and you will be ahead of a lot of businesses.
Danielle Lemons is Vice President of Operations at DirecTech Connect, a Nashville provider of business phone systems, managed IT services, websites and digital marketing. More about Danielle.
