Practical security assurance for small businesses.

Phishing succeeds by creating urgency, curiosity, fear, or an unexpected reward.

Watch for

• Unexpected links, attachments, login prompts, or QR codes.
• Messages demanding secrecy or immediate action.
• Sender names that look familiar but use a different address.

What to do

Stop, inspect the sender and destination, and open known websites yourself instead of using the message link.

If something happens

Stop interacting with the message and report the message or click immediately. Follow your company's incident instructions and do not delete evidence.

One stolen password should not unlock every account an employee uses.

Build the habit

• Use a unique password or passphrase for every business account.
• Use a company-approved password manager when one is available.
• Turn on multi-factor authentication, preferably an authenticator app or security key.

Never do this

Never share passwords or approval codes. Deny unexpected sign-in prompts and report them right away.

Attackers may impersonate owners, managers, vendors, banks, or coworkers.

Verify separately

• Payment, payroll, banking, gift-card, or account-change requests.
• Requests for sensitive files, credentials, or personal information.
• Sudden changes to a vendor's contact or payment details.

Use a trusted channel

Call a known number, speak in person, or start a new message using saved contact information. Do not rely on the contact details inside the request.

Everyday handling choices protect customer, employee, and business information.

Simple protections

• Lock screens whenever devices are unattended.
• Install approved updates and use only approved apps and storage.
• Keep sensitive papers, screens, and conversations away from public view.

When away from work

Avoid unknown USB devices and public Wi-Fi for sensitive work unless the company provides a secure method.

Fast reporting is a security strength. Silence gives a small mistake time to grow.

Report immediately

• A suspicious message, unexpected login prompt, or missing device.
• A click, download, password entry, or information disclosure that may be unsafe.
• Unusual account activity or a security control that is not working.

For owners and managers

Make the reporting path obvious, thank employees for speaking up, and focus first on containing the problem—not assigning blame.

Short, repeated practice works better than a once-a-year lecture.

Keep it practical

• Use a five-minute security reminder in regular team meetings.
• Discuss one realistic example from the kind of work employees perform.
• Practice how to verify and where to report—not just how to spot danger.

Reinforce progress

Repeat the message after new threats, role changes, incidents, and onboarding. Recognize good questions and quick reporting.