Email attacks can steal money without stealing a password. For UK SME owners and managers, protection means securing accounts, checking payment requests independently, and making suspicious messages easy to report. Start with access to your email administrator and clear authority to act.
Email attacks and the main threats
Email attacks use deceptive messages to steal money or information, gain access to accounts, or deliver harmful software. The main threats overlap:
- Phishing: Messages that persuade someone to disclose passwords, share sensitive information, or make payments. Targeted messages can use details about your business. Unexpected OneDrive or SharePoint sharing notifications are examples of phishing lures, rather than separate attack categories.
- Impersonation and business email compromise: Fake or hijacked accounts used to send fraudulent invoices, change supplier bank details, or demand urgent payments in a director’s name.
- Malicious attachments and links: Files or destinations that expose devices to harmful software. As the National Cyber Security Centre (NCSC) explains, a convincing invoice can threaten both your money and your device: the payment details may be fraudulent, or the file may contain a virus.
The GOV.UK Cyber Security Breaches Survey 2025/2026, published in April 2026, found that 38% of UK businesses with employees identified phishing. These were self-reported incidents, including unsuccessful attempts, not a count of businesses successfully compromised.
Business losses you can reduce
Email attacks can divert supplier payments, expose customer or employee information, lock staff out of mailboxes, and interrupt work. A compromised account can also send fraudulent messages to customers who recognise your address.
The practical aim is to reduce dangerous messages reaching staff, protect account access, and contain incidents quickly. No single control prevents every attack.
Email protection belongs within wider cyber security for SMEs, alongside device protection and recovery arrangements. An inbox filter cannot replace a payment check, and staff awareness cannot repair an unprotected account.
People and access to organise first
Email protection needs an account inventory and named people authorised to respond. Before changing settings, gather details of staff mailboxes, your email platform, devices, administrator access, and existing security settings. Establish whether your provider supports passkeys.
Name the technical and business decision-makers who can restrict accounts, approve operational disruption, contact the bank, and handle communications.
Keep trusted contact details for IT support, finance colleagues, suppliers, and the bank available independently of email. Staff need a way to check a payment request without relying on the telephone number inside the questionable message.
5 steps to reduce email risk
Email attack prevention needs account protection, email controls, and checks on risky requests. Use the inventory and responsibilities above to put these measures in place.
1. Strengthen staff account access
Enable passkeys wherever your email provider supports them, following NCSC account-security guidance. Otherwise, use strong, unique passwords with multi-factor authentication (MFA), which adds another sign-in check.
A password manager supports unique passwords. Updated devices and applications remain essential alongside account protection; passkeys and MFA do not replace those controls.
2. Configure email filtering and authentication
Ask your administrator to configure spam, phishing, and malware filtering, plus domain authentication. Domain authentication helps receiving email systems check messages sent using your business domain.
The NCSC’s phishing guidance recommends layered controls. Configuration should reflect your existing mail flow and business needs. Review genuine messages caught by filters so tighter protection does not block legitimate correspondence.
3. Recognise requests that need checking
Check requests involving unexpected attachments, unfamiliar links, misspelt addresses, unusual urgency, or demands for passwords and financial information. The NCSC identifies these as warning signs, not a test that proves other messages safe.
Professional presentation is no guarantee. As Take Five explains, criminals can use a supplier’s genuine email account. Short phishing awareness training helps staff recognise and report questionable requests.
4. Verify payments through another channel
Confirm changed supplier bank details using contact information already on file. A revised invoice arriving during Friday’s payment run deserves that check even when the sender is familiar.
Check unexpected urgent payment instructions with the supposed sender by telephone or in person, as Take Five advises. Replying to the same email does not provide independent verification.
5. Make internal reporting straightforward
Give staff a named reporting contact and permission to pause suspicious requests. Reports should explain whether someone clicked a link, downloaded a file, entered credentials, or approved an MFA prompt.
Those details help IT assess the exposure. Report before deleting the message so the team can investigate.
Checks that protection is working
Email protection checks should cover account settings, legitimate mail delivery, and staff actions. Ask your administrator to confirm that authentication and filtering cover the intended staff accounts and that genuine business messages still reach recipients.
Check that staff can name their reporting contact and explain how to verify a supplier’s bank-detail change independently.
Review training completion and simulation results alongside technical controls. Lower click rates alone do not establish security.
Investigate unrecognised login alerts or customers receiving messages your business did not authorise. Both are signs of possible account compromise identified by the NCSC.
What to do after suspicious activity
Suspicious email activity needs a response matched to what happened. Tell IT promptly, preserving the message, timing, alerts, and a clear account of actions taken. Keep a record of decisions as the incident develops.
Suspicious messages and accidental clicks
Without interaction, avoid the message’s links and attachments, report internally, and forward it to [email protected].
The NCSC’s response guidance distinguishes a click from further interaction. If you clicked but entered no information, downloaded no files, and installed no software, tell IT and monitor account notifications. Explain exactly what happened so IT can assess the business context.
Exposed passwords, devices or money
Use the response that matches the exposure:
- Password disclosed or mailbox takeover suspected: Change the password immediately, including on other accounts where it was reused. Your administrator must contain access, revoke active sessions, and investigate sign-ins, forwarding rules, and unauthorised access. A password reset alone does not complete recovery.
- Software installed: Contact IT and run a full antivirus scan, allowing it to address detected problems. Ask IT to direct containment. The NCSC warns that shutdown decisions need care because they can destroy evidence and affect business operations.
- Banking details disclosed or money sent: Contact the bank immediately using its official website or telephone number, and alert IT. Do not wait for a crime report or technical investigation before calling the bank.
Report fraud through Report Fraud in England, Wales, and Northern Ireland. Businesses facing a live cyber attack there should call 0300 123 2040 immediately; the live-attack service operates 24/7. In Scotland, report fraud or cyber crime to Police Scotland on 101.
Receiving a suspicious email alone is not a reason to shut down the business.
When must you notify the ICO?
An email-related personal data breach requires notification to the Information Commissioner’s Office (ICO) when a risk to individuals’ rights and freedoms is likely. Receiving a suspicious email alone does not establish a reportable breach.
Under ICO guidance, notify without undue delay and within 72 hours of becoming aware of a breach meeting that threshold. Do not wait for every investigative detail.
Notify affected individuals without undue delay where the likely risk is high. Record every personal data breach, including its effects, remedial action, and reasons for any decision not to notify.
Get practical help protecting email
Blowfish Technology combines email security configuration, MFA deployment, staff awareness training, and account-threat investigation. Contact our team to review your email protections, staff reporting route, and response responsibilities, so everyone knows who checks a suspicious request and who acts when an account is compromised.
The Blowfish Technology team. Managed IT, cloud services, software development and connectivity for North West businesses since 1999.