Phishing

Also called Business email compromise, Invoice fraud, Social engineering

Tricking someone into handing over access or money by pretending to be somebody they trust. The most common way small businesses lose money to crime.

What it means

Phishing is fraud by impersonation, usually by email. Business email compromise is the version aimed at organisations: an email appearing to come from a supplier, a director or a customer, asking for a payment or a change of bank details.

Invoice fraud — a genuine invoice with the bank details altered — is the most costly variant for small businesses.

Why it matters

It is by a wide margin the most common cyber incident affecting small organisations, and it does not require any technical vulnerability. It requires one person, busy, to act on a plausible message.

Losses are frequently not recoverable. Banks may reimburse under reimbursement rules for authorised push payment fraud, but the outcome is not guaranteed.

What it looks like in practice

The single most effective control is a rule: any change to bank details is verified by phoning the supplier on a number you already held, never one in the email.

Enable multi-factor authentication everywhere, especially on email. A compromised mailbox is how the attacker learns enough to be convincing.

Tell staff explicitly that they will never be asked by you to make an urgent payment by email without verification, and that questioning a request from a director is expected.

What to watch out for

Urgency and secrecy together. Those two in one message are the signature.

Look-alike domains, differing by one character.

Payment requests during a genuine transaction, when a large payment is expected — conveyancing and construction are heavily targeted for this reason.

Where to get proper advice

The National Cyber Security Centre's Small Business Guide and its free Cyber Action Plan. Report incidents to Report Fraud, formerly Action Fraud, and to your bank immediately — speed affects recovery.