Phishing emails are the most common starting point for cyberattacks against small and midsize businesses—and most of them don’t look obviously suspicious. If you want to know how to protect your business from phishing emails, the answer starts with understanding what makes them work, and then building a few practical habits around that knowledge.

Key Takeaways

  • Most phishing attacks succeed because they impersonate trusted senders, not because they look obviously fake.
  • Multi-factor authentication (MFA) limits damage even when a password gets stolen through a phishing link.
  • Email filtering tools can catch many phishing attempts before they reach your staff—but not all of them.
  • Employee awareness training is not a one-time event; it needs to happen regularly to stay effective.
  • Having a clear process for reporting suspicious emails reduces the time between exposure and response.

Why Phishing Emails Still Work on Smart People

Phishing works because it exploits normal behavior, not technical ignorance. A well-crafted phishing email looks like a message from your bank, your Microsoft 365 account, a vendor, or even your own CEO. The sender name appears legitimate. The logo looks right. The urgency feels real.

A common scenario: an office manager receives an email that appears to come from their company’s IT provider, asking them to verify their login credentials due to a security alert. The link goes to a convincing fake login page. They enter their username and password. That’s all it takes.

The attacker now has valid credentials. If MFA isn’t enabled on that account, they can access email, files, and sometimes financial systems—often without triggering any alarms for days.

The Settings That Block Most Phishing Before It Arrives

Email filtering is your first line of defense. Most businesses using Microsoft 365 have access to built-in security tools that, when configured correctly, catch a significant percentage of phishing attempts before they land in anyone’s inbox.

A few specific settings worth reviewing:

  • Anti-phishing policies in Microsoft Defender for Office 365 can flag messages that impersonate your domain or known contacts.
  • Safe Links rewrites URLs in emails and checks them at the time of click, not just at delivery—useful because phishing links sometimes activate after initial scans.
  • Safe Attachments sandboxes files before they reach the recipient, which matters for malicious documents that try to install malware.
  • DMARC, DKIM, and SPF records on your domain help prevent attackers from spoofing your company’s email address when targeting your own staff or clients.

None of these are complex to understand, but they do require someone to configure and maintain them. A common mistake is assuming that because you’re paying for Microsoft 365, these protections are automatically on. Many of them aren’t enabled by default.

What MFA Actually Does in a Phishing Scenario

Multi-factor authentication doesn’t prevent someone from being tricked into giving up their password. What it does is make a stolen password much less useful.

If an employee enters their credentials on a fake login page, the attacker gets the username and password—but they still can’t log in without the second factor, which is typically a code sent to the employee’s phone or generated by an authenticator app. That’s a meaningful barrier.

Enabling MFA on every account is one of the highest-return steps any business can take. It applies to Microsoft 365, email, accounting software, remote access tools, and anything else staff log into. The inconvenience is minor. The protection is significant.

One blind spot worth noting: some phishing attacks use a technique called adversary-in-the-middle (AiTM), where the attacker intercepts the session in real time and captures the MFA token as well. This is more sophisticated and less common, but it’s a reason why MFA alone isn’t a complete solution—it’s one layer of several.

Training Employees: Frequency and What to Cover

One annual training session is not enough. Phishing tactics change, and so do the specific lures attackers use—tax season, emergency alerts, software renewal notices, DocuSign requests. Staff need regular exposure to current examples to stay alert.

A practical approach for most small businesses:

  • Quarterly reminders covering recent phishing trends, not generic slides from three years ago.
  • Simulated phishing tests that send realistic fake phishing emails to staff and track who clicks. This isn’t about catching people—it identifies who needs more support and where your gaps are.
  • A clear reporting process: employees should know exactly what to do when they receive a suspicious email. If there’s no obvious channel, most people either ignore it or delete it—neither of which helps.

The goal isn’t to make everyone a cybersecurity expert. It’s to create enough awareness that staff pause before clicking, and feel comfortable flagging something that seems off.

A Common Mistake: Treating Phishing as Only an IT Problem

Many business owners hand phishing awareness entirely to their IT team or provider and consider it handled. The problem is that phishing targets people, not systems. No email filter catches everything, and no technical control prevents someone from willingly entering their credentials on a fake site.

The most overlooked exposure points tend to be:

  • New employees who haven’t been trained yet and are still learning what’s normal.
  • Executives and owners who are targeted specifically because they have broader system access and their approvals carry more weight—this is called spear phishing or business email compromise.
  • Vendors and contractors who communicate with your team regularly and whose email accounts, if compromised, become a trusted channel for attacks.

When a phishing email arrives from a vendor’s real account—because that vendor got compromised—your filters likely won’t catch it, and your staff has no reason to be suspicious. That’s a scenario that requires process controls, not just technical ones: for example, requiring a phone confirmation before any wire transfer or payment change request, regardless of how legitimate the email looks.

What to Do When Someone Clicks a Phishing Link

The response matters as much as the prevention. A delayed or poorly handled response extends the damage.

If someone at your company clicks a phishing link or enters credentials on a suspicious page, the immediate steps are:

1. Change the compromised password right away and revoke any active sessions. 2. Notify IT or your managed service provider immediately—not after the weekend, not after finishing a project. 3. Don’t delete the email. Preserving the original message helps with investigation. 4. Check for forwarding rules in the compromised email account. Attackers often set up silent forwarding to monitor ongoing communications after gaining access. 5. Notify any affected parties if there’s reason to believe external contacts were exposed.

Time is the critical variable. The faster you act, the narrower the window the attacker has to move laterally through your systems or initiate fraudulent transactions.

—

Frequently Asked Questions

Q: How can I tell if an email is a phishing attempt? A: Look for mismatched sender addresses (the display name looks right but the actual email domain doesn’t match), unexpected urgency, requests to click a link or enter credentials, and anything that arrived unexpectedly but demands immediate action. When in doubt, contact the sender through a separate channel—not by replying to the email.

Q: Does Microsoft 365 automatically protect against phishing? A: Microsoft 365 includes anti-phishing tools, but many of them are not fully enabled by default. Settings like Safe Links, Safe Attachments, and anti-impersonation policies need to be configured. If you haven’t had someone review your Microsoft 365 security settings recently, it’s worth doing.

Q: Is MFA enough to protect against phishing? A: MFA is one of the most effective controls available, but it’s not a complete solution on its own. Some advanced phishing techniques can intercept MFA tokens in real time. MFA works best as part of a layered approach that also includes email filtering, employee training, and a clear incident response process.

Q: How often should we train employees on phishing? A: More often than most businesses currently do. Quarterly touchpoints with current examples, combined with periodic simulated phishing tests, are more effective than a single annual training. The goal is sustained awareness, not a checkbox.

—

What This Means for Your Business

Phishing doesn’t require a sophisticated attack to succeed—it just needs one employee to click at the wrong moment. The businesses that hold up well aren’t necessarily the most technical; they’re the ones with consistent habits, the right settings in place, and a team that knows what to do when something looks wrong.

If you’re not sure whether your email security settings are configured correctly, or if your staff hasn’t had a real phishing awareness session in over a year, those are reasonable places to start.

SwiftTech Solutions works with small and midsize businesses across Southern California to put practical security controls in place—without overcomplicating it. If you’d like a second set of eyes on your current setup, reach out to our team for cybersecurity and IT support guidance and we’ll take a look at where you stand.