Last Updated: October 29, 2026
Quick Summary
Small businesses can improve email security by turning on multi-factor authentication for every account, activating phishing protection filters, and training staff to spot suspicious messages. Verifying payment change requests by phone also blocks many common fraud attempts. Together these habits prevent most email-based attacks, which often look like routine requests from people you trust.
- Turn on multi-factor authentication for every mailbox, including shared and admin accounts.
- Set up SPF, DKIM and DMARC records so fake emails using your domain are blocked.
- Run a short email security awareness session every quarter with practical examples.
- Verify payment change requests by phone before they are actioned.
- Have a written plan ready to follow if a phishing email is clicked or a password is shared.
Table of Contents
- Why Email Security Matters for Small Businesses
- Email Security Checklist for Small Businesses
- Step 1: Turn On Multi-Factor Authentication
- Step 2: Set Up Business Email Phishing Protection
- Step 3: Run Email Security Awareness Training for Employees
- What to Do After a Phishing Email
- Getting Your Email Security Set Up With Ibertech Solutions
- Frequently Asked Questions
Why Email Security Matters for Small Businesses
Email is the front door to most small businesses. A single convincing message can hand a criminal access to bank details, customer records and whole systems. For a team of 10 or 15 people in Norfolk or Suffolk, that is a serious risk.
Small firms are attractive targets because they often lack a dedicated security team. Criminals know this. They send fake invoices, impersonate directors and ask staff to change payment details.
Many businesses find that a short, clear set of habits prevents most of these problems. The steps below show how to put those habits in place.
Watch out: the most damaging attacks rarely look like attacks. They look like routine requests from someone you trust.
Email Security Checklist for Small Businesses
Use this checklist as a starting point. Tick each item once it is in place.
- Multi-factor authentication is on for every email account
- Phishing protection filters are active on incoming mail
- Staff know how to spot and report suspicious messages
- Staff have completed email security awareness training
- Payment change requests are checked by phone before they are actioned
- Old accounts for leavers are disabled promptly
- There is a written plan for what to do after an incident
| Area | What to check | Who owns it |
|---|---|---|
| Account access | MFA enabled on all accounts | Office or IT lead |
| Incoming mail | Spam and phishing filters on | IT provider |
| People | Training completed and refreshed | Owner or manager |
| Payments | Bank changes verified by phone | Finance lead |
Step 1: Turn On Multi-Factor Authentication
Multi-factor authentication (MFA) asks for a second check, such as a code from an app, before someone can log in (Top tips for staying secure online | Turn on 2-step verification (2SV)). Even if a password is stolen, the account stays locked.
Most Microsoft 365 and Google Workspace accounts support MFA. Turning it on takes minutes per user.
- Enable MFA for every mailbox, including shared and admin accounts
- Use an authenticator app rather than text messages where possible
- Keep recovery methods up to date when staff change phones
Do not skip this step for directors. Senior accounts are the ones criminals most want to reach.
Step 2: Set Up Business Email Phishing Protection
Business email phishing protection filters suspicious messages before they reach an inbox. It checks links, attachments and the sender’s identity.
Many modern email platforms include basic filtering. For stronger protection, add a dedicated layer or ask your IT support provider to configure it.
- Turn on spoofing and impersonation checks for your domain
- Set up SPF, DKIM and DMARC records so fake emails using your domain are blocked (Email security and anti-spoofing)
- Review quarantined messages each week to catch false positives
Watch out: a filter is not a substitute for care. Some convincing phishing emails still get through.
Step 3: Run Email Security Awareness Training for Employees
Staff are your last line of defence. Short, regular training helps them spot warning signs.
A common approach is a 15-minute session every quarter, with a simple test email now and then. Keep the lessons practical.
- Show real examples of fake invoices and urgent payment requests
- Teach staff to hover over links before clicking
- Make it easy to report a suspicious email without blame
What to Do After a Phishing Email
Speed matters. If someone clicks a link or shares a password, act straight away.
- Change the affected password and turn on MFA if it is not already active
- Tell your IT provider or the person responsible for security
- Check the mailbox for forwarding rules that criminals may have added
- Warn colleagues about the message so they do not fall for it too
- Contact your bank if any payment details were shared
- Record what happened so you can improve your defences
Keep a written contact list for your IT support team so you are not searching for numbers in a crisis.
Getting Your Email Security Set Up With Ibertech Solutions
Setting up email security well takes time, and most small businesses have enough else to do. At Ibertech Solutions, we help businesses in Norfolk and Suffolk put MFA, phishing protection and staff guidance in place. If you want an expert to review your setup, get in touch with Ibertech Solutions and we will talk through what makes sense for your business.
Frequently Asked Questions
How can a small business improve email security?
Start with the basics: turn on multi-factor authentication for every email account, keep software and devices updated, and remove old accounts when staff leave. Set up spam and phishing filtering on your mail service, and restrict who can forward mail outside the business. Review these settings every few months, because a setting that was safe last year may not be today. If you do not have the time or in-house skills to do this, a managed IT provider such as Ibertech Solutions can review your setup and make the changes for you.
What is multi-factor authentication and should a small business use it?
Multi-factor authentication asks for a second check, such as a code from an app or a text message, in addition to a password. Even if a password is stolen, an attacker still cannot log in without that second check. Yes, a small business should use it on every email account, and especially on any account that can access finance, payroll or shared files. Most Microsoft 365 and Google Workspace plans include it, so it is usually a settings change rather than an extra purchase.
What should a business do if an employee clicks a suspicious email link?
Act quickly and do not wait to see whether anything happens. Ask the employee to disconnect the device from the network, change the password for that email account, and report the incident to whoever looks after your IT. Check the mailbox for forwarding rules or unfamiliar sign-ins, and tell anyone who may have been affected, such as customers or suppliers, if their details could be at risk. Keep a note of what happened so you can improve your defences afterwards.
How often should a small business review its email security settings?
Review your email security settings at least every three months, and straight away after any staff change, such as someone leaving or a new starter joining. Check which accounts have multi-factor authentication enabled, who has admin access, and whether any unexpected forwarding rules exist. A short, regular review catches gaps before an attacker does, and it takes far less time than recovering from a compromised mailbox.
