Phishing remains the most common route into UK small businesses, and the messages reaching inboxes are becoming harder to tell apart from legitimate correspondence. The Cyber security breaches survey 2025/2026 published by GOV.UK found that phishing was the most prevalent type of breach or attack, experienced by 38% of businesses. For a London SME with a small internal team, one convincing message can lead to payment fraud, account takeover or ransomware. This guide sets out practical phishing protection for London SMEs, covering which controls carry the most weight and where staff training fits.
Table of Contents
- Quick Takeaways
- How Phishing Has Changed for London SMEs
- Spear Phishing and Invoice Fraud
- Email Security Controls That Reduce Exposure
- Approaches Compared
- Staff Training and Incident Response
- Frequently Asked Questions
- References
Quick Takeaways
| Key Insight | Explanation |
|---|---|
| Phishing is the leading threat to UK businesses | The GOV.UK survey reports phishing was experienced by 38% of businesses, more than any other type of breach or attack. |
| Message quality is no longer a reliable signal | The 2026 Phishing Trends Report describes a fourteen-fold surge in AI-generated phishing toward the end of 2025. |
| Targeted messages exploit roles, not lists | Attackers research job titles, suppliers and live projects before sending a request that appears routine. |
| Domain authentication blocks spoofing | Publish SPF, DKIM and DMARC records for every sending domain, then move DMARC to an enforcement policy once legitimate senders are aligned. |
| Payment changes require a verbal check | Confirm any change to supplier bank details by telephone, using a number already held on file. |
| Training only works with a reporting route | Staff need one published way to report suspicious messages and a documented response that starts within minutes. |
How Phishing Has Changed for London SMEs
Research from BT, conducted with Be the Business and reported in June 2025, found that 85% of UK businesses had been targeted by email scams. The same research cited a government survey putting the average cost for micro and small businesses to recover from a serious breach at £7,960. Recovery costs also extend beyond that figure, including lost working hours, supplier disruption and the time needed to restore client confidence.
What the latest data shows
The 2026 Phishing Trends Report, which analyses real and simulated attacks across millions of users, found that AI-generated messages accounted for under 5% of attacks across the first eleven months of 2025. The report describes a fourteen-fold surge in AI-generated phishing toward the end of the year. For business owners, the practical implication is that the polish of a phishing message no longer indicates whether it is genuine.
Why London businesses face higher exposure
London SMEs often combine a high volume of client, supplier and recruitment email with a small or part-time IT function. Many rely on cloud productivity suites, shared mailboxes and external accounting platforms, each of which adds an entry point. Attackers tend to exploit the gap between these systems and the people responsible for managing them.
The same BT research estimated that around two million UK SMEs, approximately 39% of the total, had not provided cyber security training to their staff. Where no one is responsible for reviewing email security settings, misconfigurations can persist for long periods without detection.
Spear Phishing and Invoice Fraud
Spear phishing refers to messages written for a specific individual or role, often using names, job titles, live projects and supplier relationships gathered from public sources. For a small business, the most damaging version usually imitates a director, supplier or landlord and requests an urgent payment. These messages rarely contain the spelling errors that once made phishing easy to spot.
How a targeted message is built
Attackers often begin with a company website, professional networking profiles or public announcements. They then send a message that refers to a real contract, a recent meeting or a named colleague. The objective is to create urgency and make the request appear routine, so that the recipient acts before checking.
Payment redirection and invoice fraud
A common mistake is to treat payment instructions as a finance-only concern. In practice, the most effective counter is a written procedure. Any change to supplier bank details must be confirmed by telephone using a number already held on file, never by replying to the email that requested the change.
Pro tip: Ask key suppliers to nominate a named contact for bank detail changes, and record that contact in your accounting system before a dispute arises.
Email Security Controls That Reduce Exposure
No single control stops every phishing message, so email security works best as a set of layers. The first layer verifies that messages claiming to come from your domain are authorised to do so. The second filters and inspects content. The third ensures that unusual activity is detected and investigated.
Email authentication with SPF, DKIM and DMARC
SPF, DKIM and DMARC are standard email authentication methods that help receiving servers confirm whether a message genuinely originates from the domain it claims. Publishing these records reduces the risk of criminals spoofing your own domain. DMARC is most useful when it moves from a monitoring stage to an enforcement policy, after legitimate senders such as invoicing and marketing tools have been identified and aligned.
Filtering, quarantine and link protection
Modern filtering examines attachments, web links and sender reputation before delivery. Links that redirect through several domains, or that lead to recently registered websites, deserve particular attention. Quarantined messages should be reviewed by someone with the authority to release them, and each decision should be logged.
Phishing protection is a layered process. No single filter, policy or training session stops every attempt, so each layer should be designed to catch what the previous one misses.
Pro tip: Review your domain’s authentication records after any change of email provider or domain, as a misconfiguration can leave the domain open to spoofing.
Approaches Compared
Three approaches are common among London SMEs. They are not mutually exclusive, but each addresses a different part of the risk. The table below sets out where each one provides cover and where it falls short.
| Approach | Strengths | Limitations |
|---|---|---|
| Default mailbox filtering only | Blocks known bulk spam and malware, and is included with most business email plans. | Less effective against low-volume, carefully written messages that do not match known patterns. |
| Managed email security with monitoring | Adds policy tuning, link and attachment inspection, and alert review by engineers. | Requires a defined service level and regular policy reviews to remain effective. |
| Staff awareness training alone | Builds recognition habits and encourages prompt reporting. | Does not prevent messages from arriving, and its effect declines without repetition. |
In practice, the strongest position combines managed email security with a documented review process and targeted training. Relying on default filtering alone leaves gaps that targeted messages can exploit. Businesses without an internal security function can use an outsourced IT department, such as the service provided by iTO.London, to manage these layers within an agreed service level.
Staff Training and Incident Response
Training improves recognition, but its value depends on how it is delivered and what staff are asked to do afterwards. Short, role-specific sessions that use examples from the business’s own inbox tend to be more useful than annual generic courses. The aim is to make reporting quick and routine, so that a suspicious message reaches someone who can act promptly.
Role-based training for finance and leadership
Finance teams, office managers and directors face different lures. Invoice requests, payroll changes and urgent instructions attributed to senior staff should form the basis of their sessions. Simulated phishing exercises can test these scenarios safely, provided the results are used for coaching rather than blame.
A reporting route that works in practice
Staff need one published way to report suspicious messages, whether through a reporting button, a dedicated mailbox or a helpdesk number. Each report should trigger a documented response, such as checking related mailboxes, resetting credentials where needed and removing the message from other inboxes. Out-of-hours escalation also matters, as attacks are often timed to periods of low staffing.
Pro tip: Test the reporting route at least twice a year by sending a harmless internal test message and measuring how long it takes for the report to reach an engineer.
Frequently Asked Questions
What does phishing protection for a London SME involve?
It involves a set of layered controls, including email authentication, filtering and link inspection, monitoring of unusual account activity, documented payment procedures and regular staff training. Each layer covers a different failure point, so the combination matters more than any single tool.
How is spear phishing different from standard phishing?
Standard phishing is usually sent in bulk and relies on a general pretext. Spear phishing is written for a specific person or role and uses details about the business, its suppliers or its staff to appear credible.
Do SPF, DKIM and DMARC stop all phishing emails?
No. These standards help prevent criminals from sending messages that appear to come from your own domain, but they do not stop messages from look-alike domains or compromised third-party accounts. They should be combined with filtering and staff procedures.
How often should staff receive phishing training?
Training should be ongoing rather than annual. Short, role-specific sessions combined with periodic simulated exercises tend to keep recognition skills current, particularly as message quality changes.
What should an employee do after clicking a suspicious link?
The employee should report the incident immediately, without waiting to see whether anything happens. Prompt reporting allows the IT team to reset credentials, review account activity and check whether the message reached other colleagues.
We would welcome your experience of phishing attempts in your business and the changes your team has made in response.
We would love your feedback and any insights you would share with others. What perspective would you add?