Phishing protection for businesses: Measures, technology & checklist

Phishing protection consists of two components that only work together: technical layers of protection that intercept malicious messages and organizational rules that prevent a single click from causing harm.

This is particularly relevant for small and medium-sized enterprises (SMEs) because attackers no longer rely on poorly translated mass emails. They research roles, suppliers, and payment processes and formulate messages to fit seamlessly into everyday work routines. A fake invoice with altered bank details contains neither malware nor spelling errors - yet it can still cause significant damage.

This article shows you how to specifically identify phishing emails, which technical measures can be implemented quickly, how to secure reporting channels and payment authorizations, and what to do in the first few minutes of a suspected attack.

Table of contents

• What phishing protection in a company includes
  
• How to recognize a phishing email
• Which phishing attacks most frequently affect SMEs
• Technical measures against phishing
• Organizational measures: rules, reporting channels, awareness
• First suspicion: the right steps in the first 15 minutes
• Checklist for phishing protection
• Conclusion
• FAQ on phishing protection

What phishing protection in a company includes

Phishing protection encompasses all technical controls and organizational processes that detect, block, and mitigate the impact of fraudulent messages. The goal is to prevent account takeovers, payment fraud, and malware without disrupting daily communication.

Effective protection operates in layers. Each layer reduces the likelihood that a phishing email will even arrive, be opened, steal login credentials, or trigger a payment. If one layer fails, the next one takes over.

Four objectives can be distinguished:

• Reduce delivery: Filters, sender authentication, and policies keep the majority of messages out.
• Reduce interaction: Verified links, attachment analysis, and restricted macros prevent dangerous clicks.
• Prevent account takeovers: Multi-factor authentication and access rules invalidate stolen passwords.
• Limit impact: Endpoint protection, minimal permissions, and a well-established reporting process keep damage to a minimum.

A spam filter alone is insufficient. Modern attacks are technically inconspicuous: personally worded, without attachments, with links to legitimate cloud services, or originating from a genuine but compromised partner account. That's precisely why humans must be the last line of defense – and for that, they need clear identifying characteristics.

How to recognize a phishing email

Most phishing emails can be identified by recurring patterns. The decisive factor is not a single characteristic, but rather the accumulation of several signals.

The three most important testing steps

1. Check the actual sender address. The display name is freely chosen and proves nothing. Expand the full address and check the domain character by character.
   
2. Check the link destination without clicking. Hover your mouse over the link and read the displayed destination address. On a smartphone, a long press is sufficient. Pay attention to the string of characters immediately before the first slash – this is where the actual domain is located.
   
3. For money and access data, verify via a second channel. Call a number you know, not the one provided in the email. This one rule prevents the majority of successful payment fraud cases.

Important for practical application: Even an email from a genuine colleague or supplier can be phishing if their account has been compromised. In this case, the sender, signature, and even the previous message history will match. Only the break in the process remains as a signal – for example, a suddenly changed account number in an ongoing conversation.

The Austrian government website onlinesicherheit.gv.at summarizes preventative measures and current fraud schemes and is a good reference for internal training.

Which phishing attacks most frequently affect SMEs

Three patterns dominate in the SME sector. They differ technically, but pursue the same goal: money, access data, or control over systems.

Invoice and payment fraud

Attackers forge invoices or payment reminders from known suppliers and change the bank details. The timing is often deliberately chosen: shortly before the end of the month or during vacation periods when substitutes are less likely to check details thoroughly.

The most effective protection: Call back whenever bank details are changed, using the number stored in the system, plus the four-eyes principle for transactions exceeding a certain amount. This is an organizational rule, not a technical one – and precisely for that reason, it is often overlooked.

Microsoft-365 login phishing

Deceptively realistic login pages intercept credentials, usually preceded by warnings about an expiring password, a new voice message, or a shared document.

The best protection is multi-factor authentication (MFA), which involves logging in with a second factor in addition to a password. The article on multi-factor authentication describes in detail how to implement MFA in a company.

CEO fraud and business email compromise

BEC stands for Business Email Compromise, which refers to the takeover or impersonation of business email accounts. Attackers impersonate management or business partners and pressure recipients into making quick payments through unofficial channels.

These attacks typically involve neither links nor attachments. Therefore, technical filters have little vulnerability – BEC is mitigated through processes, not software.

For small and medium-sized enterprises (SMEs) that cannot build and maintain these layers of protection themselves, structured IT support is the most pragmatic solution. FIGULI CONSULTING sets up email security, identity protection, and reporting processes to ensure they are effective in daily operations and not circumvented after just a few weeks.

Improve your phishing protection with FIGULI

Technical measures against phishing

Technical measures are intended to intercept as many dangerous messages as possible before they reach anyone – and to limit the damage if one does get through.

Email filter and attachment checking

A modern email gateway checks incoming messages based on several signals: the sender's reputation, anomalies in headers and content, known malware, and patterns for forged senders.

Two features are particularly effective:

• Link check at the time of click: The target address is only checked when clicked, not just during delivery. This intercepts links that only become malicious later – a common tactic for circumventing filters.
• Attachment analysis in an isolated environment: Suspicious files are executed and monitored in a secure test environment before delivery. This is especially helpful against new, previously unknown malware.

FIGULI CONSULTING uses Hornetsecurity, among other email security solutions, for this purpose.

A well-defined approach to quarantine is crucial: Who is authorized to unblock messages, and according to what criteria? If employees can unblock messages arbitrarily, this creates precisely the loophole that the filter is designed to close.

Sender authentication: SPF, DKIM and DMARC

Three technical procedures within the Domain Name System (DNS) make it more difficult for attackers to send emails on behalf of your domain:

• SPF (Sender Policy Framework) specifies which mail servers are authorized to send emails for your domain.
• DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing messages.
• DMARC combines both and defines how recipients should handle failed checks.

Implementation is phased: first in observation mode to capture all legitimate sending sources, then with progressively stricter measures. Those who immediately opt in to block emails will, in our experience, block their own newsletters or system emails. A detailed description of the three procedures can be found in the article on email security.

Secure identities

Many attacks target the user account itself, not the message.

Therefore, the following are crucial:

• Multi-factor authentication for all accounts, not just administrators
• Disabling outdated login methods that don't support modern security checks
• Separate administrator accounts for administrative tasks
• Alert notifications for unusual logins, such as those from unexpected countries
• Regularly checking mailbox rules for secretly configured forwarding rules

This last point is often underestimated. After taking over an account, attackers typically set up a rule that silently forwards or deletes incoming replies. This rule survives a simple password change.

Protect end devices

If an attack succeeds, the endpoint determines the extent of the damage. Modern solutions detect suspicious behavior—unusual scripts, unauthorized access to login credentials, conspicuous network connections—and can automatically isolate a device from the network.

The article on endpoint security explains why traditional antivirus software is no longer sufficient.

Organizational measures: rules, reporting channels, awareness

Technology cannot prevent fraud. A payment order that is plausibly worded and originates from a genuine account will pass any filter. It must be intercepted through organizational means.

Securing payment and approval processes

The most effective rules are simple and without exception:

• Changes to bank details are always confirmed by phone using the registered number, never via contact information from an email.
• For transactions exceeding a certain amount, the four-eyes principle applies.
• Deviations from the standard process are always a warning sign, regardless of who requests them.
• Urgency does not override any rule.

This last point requires backing from upper management. As long as management itself demands exceptions, no oversight is effective.

Set up a reporting channel

A reporting process must be faster than hesitation. This requires a clearly designated contact point, a simple reporting option directly from the email program, and a response to the reporting person.

Crucially, the culture surrounding mistakes is key: Anyone who fears accusations after clicking a button will report later or not at all – and these crucial hours determine the extent of the damage. A false report costs five minutes, a concealed account takeover costs days.

Establish awareness

Training sessions are effective when they are short, regular, and based on real-world scenarios. Several short sessions per year are more effective than one long annual event.

Onboarding is particularly important: New employees are not yet familiar with standard procedures and are a prime target for training. During the first few weeks, multi-factor authentication (MFA) should be set up, the reporting process explained, and payment authorization procedures discussed.

The article on phishing simulation demonstrates how to measure and specifically improve learning progress.

First suspicion: the right steps in the first 15 minutes

In case of suspected phishing, containment takes precedence over analysis. The order is crucial.

1. Do not click, open, or forward any messages. Leave the message unchanged in your inbox as evidence.
2. Immediately inform the responsible department – ​​even if you are unsure whether it is actually phishing.
3. If you have clicked and entered login credentials: change your password, and terminate all active sessions. Simply changing your password is insufficient as long as existing logins remain valid. Account lock by an administrator.
4. Check your mailbox rules for newly created forwarding rules, deletion rules, and linked applications.
5. Search for and delete similar messages, as phishing attacks rarely target only one person.
6. Document the incident: time, affected accounts, and actions taken.
   

If personal data is affected, reporting obligations under the General Data Protection Regulation (GDPR) may apply. The Austrian Data Protection Authority describes the obligations of data controllers. Document every incident, even if no report is required.

Checklist for phishing protection

• Multi-factor authentication active for all accounts
• Outdated login methods deactivated
• Separate administrator accounts set up
• Email filter with link and attachment checking in use
• Quarantine with clearly defined approvals
• SPF, DKIM, and DMARC set up and monitored
• Alerts for risky logins and new mailbox rules
• Endpoint protection active, updates mandatory
• Mandatory callback when bank details change
• Four-eyes principle above a defined amount
• Reporting channels known and easily accessible
• Awareness sessions several times a year, phishing prevention integrated into onboarding
• Procedure for suspected cases documented and discussed at least once
  

Conclusion

Phishing protection isn't software you buy; it's a combination of filters, identity protection, endpoint security, and clear rules. Technology reduces the number of messages that even get through. Processes prevent damage from those that do.

The most effective single measure is quite simple: calling a known number to verify the message before any money is transferred or login credentials are entered. It costs nothing and thwarts precisely those attacks that no filter can protect against.

Equally important is a reporting culture that avoids assigning blame. Companies that report a single accidental click immediately usually limit the damage to just a few hours of work.

FIGULI CONSULTING helps Austrian SMEs implement phishing protection as part of a comprehensive IT security strategy: with email security, Microsoft 365 hardening, identity protection, endpoint security, and practical reporting and approval processes.

Discuss IT security and phishing protection with FIGULI

FAQ on phishing protection