Why Small Businesses Are the Biggest Target for Phishing

There is a comfortable myth among small businesses that the criminals targeting bigger companies will not bother with us. The data has been telling a quieter, less comfortable story for years: small operators are the easiest mark on the internet, and the people aiming for them know it.

In Australia, the Australian Cyber Security Centre (ACSC) reported that small and medium-sized businesses absorbed roughly 43% of all cybercrime losses in the most recent reporting year, despite making up a fraction of the total economy by revenue [1]. The Australian Signals Directorate has been making the same point for half a decade. The pattern is not random.

Why small operators are the easier target

Phishing is a numbers game. The economics of running a phishing campaign reward the path of least resistance, and small operators offer that path on three fronts.

1. 01Smaller teams. Five staff means five inboxes to defend, but also that one bad click is closer to the people who can sign payments.
2. 02Less mature tooling. Larger firms run mail filters, EDR, and dedicated security teams. The corner accountant runs Microsoft 365 with default settings.
3. 03Trust-rich environments. A 200-person firm has approval workflows; a four-person studio has the founder texting the bookkeeper. Phishing impersonation cuts straight through the latter.

None of these are character flaws. They are perfectly reasonable trade-offs that come with running a small operation. They are also why the criminals show up.

“The most effective small-business phishing rarely involves clever malware. It involves a request that looks just plausible enough to be acted on without checking.”

What the actual attacks look like

In our work with Western Australian small businesses we see four shapes repeatedly. The first is invoice impersonation: an email arrives from a regular supplier with new bank details, the bookkeeper updates the record, and the next ten payments go to a stranger. The second is the "CEO" text-message scam, where the founder is impersonated over SMS asking the most recently hired person to buy gift cards "for a client". The third is Microsoft 365 credential harvesting via a fake Adobe or DocuSign portal. The fourth is straightforward ransomware delivered through an attachment.

All four start the same way: a person under time pressure clicks something they would have caught on a calmer day. The technical sophistication is irrelevant. What matters is the social setup.

The cheap interventions actually work

The good news is that the playbook for defending a small business is short, and the cheap items at the top of it have an outsized payoff. The expensive items at the bottom mostly do not apply to you.

• §Turn on multi-factor authentication for email and accounting software. This single step blocks the vast majority of credential-theft phishing outright.
• §Establish a "we always ring to confirm a bank-account change" rule, written down, agreed to by everyone in the team.
• §Train your team to recognise the four shapes above, with realistic-but-safe examples — not a 90-minute compliance video at induction.
• §Subscribe to a low-effort phishing simulation programme so the muscle memory is fresh, not annual.

The harder thing — and the simpler thing

The harder thing is changing the culture of urgency in your team. The simpler thing is putting one rule in place: when something feels rushed, check it on a different channel before you act. A two-minute phone call to a known number breaks the back of nearly every phishing campaign.

You do not need expensive, heavy-duty tooling. You do not need a SOC. You need a team that knows what to look for, MFA on the accounts that matter, and a culture that lets people pause without being told off for it.

If you would like a hand setting any of this up, the studio runs phishing-recognition training designed for small Australian teams. We are not a SOC and we are not selling fear — we will show you the four shapes, set up MFA properly, and run a friendly simulation with your staff. Drop us a line.