A 5-Step Email and Phishing Security Checklist for Small Businesses With No IT Department

Why this matters right now

This week on X, a few people described fake quote-request emails, phishing kits that appear to get past basic two-factor codes, and email takeovers that ended in ransomware or payment fraud. Those are individual posts, not research, so I can't tell you how widespread any one tactic is.

The bigger picture comes from the FBI. In its 2025 Internet Crime Report, the Internet Crime Complaint Center counted 24,768 business email compromise complaints, with reported losses of just over three billion dollars. That made business email compromise the second-largest category by reported losses, after investment fraud. Those numbers only cover what people reported, so the real total is unknown.

Step 1: Use phishing-resistant sign-in, and two-factor everywhere else

CISA's page on how to require multifactor authentication says any two-factor login is better than none, but the methods aren't equal. It ranks a physical security key as the strongest, followed by an authenticator app with number matching, then app codes, with text or email codes as the weakest option. CISA's small-business guidance explains why: the only widely available phishing-resistant method is FIDO authentication, which blocks the login when you're tricked into using a fake site. Passkeys are built on that same standard and work with the phone or laptop you already own.

Start with the accounts that matter most: email admins, your bank, your domain registrar and payroll.

Turn on passkeys or security keys where the service supports them.

Everywhere else, use an authenticator app rather than text codes.

CISA also says to enforce two-factor with settings, not trust. New hires and people who just switched phones are often the gaps.

Step 2: Keep a tested backup that ransomware can't reach

CISA's #StopRansomware Guide recommends offline, encrypted backups of critical data, because many ransomware variants try to find and delete or encrypt any backups they can reach. The FBI's 2025 report adds that backup data should be immutable, meaning it can't be altered or deleted.

The part most people skip is testing. CISA's small-business page notes that many ransomware victims had no backups or incomplete ones, and that restoring took longer than expected. Once a quarter, pick a few files and a full mailbox and actually restore them. Write down how long it took.

Step 3: Call a known number before changing payment details

Business email compromise usually ends with a convincing message asking you to pay a bill to new bank details, or to update an employee's direct deposit. The fix is a habit, not software:

Any request to change bank details gets a phone call to a number you already had on file, not the number in the email.

Urgency is a warning sign, not a reason to skip the call.

For larger payment requests, have a second person approve.

If money does go out, the FBI's report says time matters: contact your bank immediately to request a recall of the funds, then file a complaint with the IC3, including the full transaction details.

Step 4: Check forwarding rules and recent sign-ins

When attackers get into a mailbox, they often stay quiet. They set up a rule that forwards copies of your email to them, or hides replies from a customer, and wait for a payment conversation.

Microsoft 365: Microsoft's guide to responding to a compromised email account lists warning signs that include inbox rules that forward mail to unknown addresses, rules that move messages to unusual folders, and recently added external forwarding. It also points admins to the Microsoft Entra sign-in logs to check IP addresses, locations, times and failures.

Google Workspace: Google's admin checklist to identify and secure compromised accounts says to use User log events in the Admin console to review web sign-ins for up to six months, with suspicious ones flagged, and to verify that no malicious settings such as forwarding were created. The User log events page also covers changes to recovery details and two-step verification.

Put a monthly reminder on the calendar to check both. It takes about ten minutes once you know where to look.

Step 5: Have a simple plan for when someone clicks

Someone will eventually click something. What matters is that they tell you quickly and don't feel punished for it. A one-page plan can cover:

Tell one named person right away. Say who it is and how to reach them after hours.

Secure the account. Change the login, sign out all sessions, and confirm two-factor is still on. Microsoft and Google both describe revoking sessions and resetting access in the guides above.

Check for rules and forwarding added since the click, as in Step 4.

Call the bank if any payment details or transfers may be involved.

Warn customers and vendors if your mailbox sent anything suspicious.

Report it to the FBI's IC3, especially if money moved.

What we don't know

I can't tell you how often these AI-built phishing kits succeed, or how many small businesses are hit without reporting it. The FBI's figures are complaints, not a full count. No checklist makes you immune. These five steps close the doors attackers use most and limit the damage when something gets through.

How Local Business Search can help

We set up small-business IT without the jargon: two-factor login and passkeys on the accounts that matter, backups that are tested, and email security for Microsoft 365 or Google Workspace, including forwarding and sign-in checks. Done-for-you how-to videos are coming soon too.

If you'd like help putting this checklist in place, contact Local Business Search and we'll walk through it with you.