Phishing remains the most common way businesses are breached, and the reason is uncomfortable: it does not attack your systems, it attacks your staff. No firewall stops an employee who believes they are helping the finance director.
What has changed recently is quality. The clumsy messages with obvious spelling mistakes still circulate, but the ones that succeed now are well written, correctly branded, and often reference real projects and real colleagues. This article covers what current attacks look like, the defenses that actually work, and what to do in the first hour after someone clicks.
What attacks look like now
Business email compromise
The most expensive category by a wide margin. An attacker gains access to a real mailbox, reads the correspondence for a while, then intervenes in an existing conversation at exactly the right moment with new bank details for an invoice already under discussion.
Nothing about the message looks wrong. It arrives from the correct address, in the right thread, referencing a genuine invoice. Traditional spam filtering does not catch it because it is a legitimate email from a legitimate account.
Invoice fraud
A supplier you actually use writes to say their bank details have changed. Often the supplier’s own mailbox has been compromised, so the message is authentic. Payment goes to the attacker and is typically unrecoverable.
Credential harvesting
A message about a shared document, a mailbox nearing capacity, or an expiring password leads to a login page that is a pixel-perfect copy of Microsoft or Google. Modern versions relay your code to the real site in real time, which is why basic two-factor authentication no longer stops them all.
AI-assisted targeting
Attackers now use public information from your website and social profiles to write messages that reference real people, real projects, and correct terminology, in fluent Dutch or English. The old advice about watching for bad grammar is obsolete.
The defenses that actually matter
Phishing-resistant authentication
The single highest-value control available. SMS codes and authenticator apps can be relayed by a determined attacker. Hardware security keys and passkeys cannot, because they are bound to the genuine domain. Start with the accounts that matter most: email administrators, finance, and anyone who can move money.
Domain authentication
SPF, DKIM, and DMARC make it substantially harder for anyone to send email that appears to come from your domain. Set DMARC to reject once you have verified your legitimate senders. This protects your customers and suppliers from being attacked in your name, which is both a security and a reputational matter.
A payment verification rule that cannot be overridden
This one control prevents most of the financial loss. Any change to bank details, and any payment above a threshold you set, must be confirmed by telephone on a number you already hold, never a number supplied in the message. Never by email reply.
The rule must apply to everyone, including the managing director. Attackers specifically impersonate senior people because staff hesitate to question them. If the rule has exceptions, the exception is the attack.
Training that resembles reality
Annual slide decks change little. What works is short, frequent, and specific: real examples from your own industry, simulated phishing with coaching rather than punishment, and a culture in which reporting a mistake quickly is treated as good behavior.
That last point is decisive. In organizations where clicking a bad link means humiliation, people stay quiet, and the hours during which the breach could have been contained are lost.
The first hour after a click
Have this written down before you need it.
- Reset the password for the affected account and revoke all active sessions. A password change alone does not evict an attacker with a live session.
- Check for mailbox rules. Attackers almost always create a forwarding or auto-delete rule to hide their activity. This is the step most often missed.
- Review sent items and recent logins for unfamiliar locations or devices.
- Warn anyone who may have received messages from the compromised account, especially about payments.
- Contact your bank immediately if money moved. Speed determines whether recovery is possible at all.
- Assess whether personal data was exposed. Under the GDPR, a reportable breach must reach the Autoriteit Persoonsgegevens within 72 hours.
Where your website fits in
Two connections are worth noting.
First, your website is reconnaissance material. Detailed staff pages listing names, roles, and direct email addresses make targeted attacks considerably easier. This is a genuine trade-off against the trust that transparency builds, and it deserves a deliberate decision rather than a default.
Second, a compromised website becomes a phishing platform in your own name. Attackers place a login page on a legitimate domain precisely because it defeats suspicion. Keeping your site patched, limiting administrator accounts, and enforcing strong authentication on the CMS protects your customers as much as you.
Frequently asked questions
Is a small business really a target?
Yes, and disproportionately so. Most phishing is opportunistic and automated rather than targeted at a specific victim. Smaller organizations are attractive precisely because they usually have weaker controls and rarely have a dedicated security function.
Does two-factor authentication solve this?
It solves a great deal and you should absolutely enable it everywhere. But codes from SMS or an app can be relayed by a real-time proxy. Where the account matters, move to passkeys or hardware keys.
How much should we spend on this?
Less than people expect. Domain authentication is configuration rather than purchase. Hardware keys cost a modest amount per person. A written payment verification rule is free. These three controls prevent the large majority of realistic losses, and none of them requires a security budget.
Should we run simulated phishing tests?
Yes, provided the objective is measurement and coaching. If the results are used to embarrass individuals, you will train your staff to hide incidents, which leaves you materially worse off than before.
Start here
Three things this week: write the payment verification rule and circulate it, check your DMARC record, and enable the strongest available authentication on email and finance accounts. That is a single afternoon against the most probable losses.
Security is built into every site we deliver rather than added afterwards, and we publish a responsible disclosure policy so that anyone who finds a weakness in our systems has a clear way to tell us. If you are unsure where your own site stands, ask us to take a look.
