The Low-Hanging Fruit: A Practical Security Guide for Every Employee
Most successful attacks on small and mid-size businesses don't break through the firewall — they walk through the front door when someone clicks a link, approves a login prompt, or wires money to a "vendor." The good news: the habits that stop those attacks are simple, free, and learnable in one read. This guide is written to be shared with your entire team.
Attackers Don't Hack In. They Log In.
Many successful attacks still begin with a human interaction — a phishing message, credential prompt, payment request, or social-engineering conversation. That's not because employees are careless; it's because tricking a person is often cheaper than defeating technology, and attackers can send convincing messages at enormous scale while waiting for one busy person on one busy afternoon.
Two implications follow. First, "I'm too small to be a target" is backwards — small businesses are targeted because they combine real money with fewer defenses. Attackers don't pick you; their software does, indiscriminately. Second, the goal isn't turning your staff into security experts. It's installing a handful of reflexes — pause on urgency, verify money moves by phone, never approve a login you didn't start — that break the attack chain at its cheapest point.
Spotting Malicious Links and Phishing Emails
Phishing works by manufacturing a feeling — urgency, fear, curiosity, authority — strong enough to override the two-second pause that would expose it. So the defense starts with the feeling, not the technology: the more an email pressures you to act right now, the more it deserves a slow look.
Manufactured Urgency
"Your account will be suspended in 24 hours." "Payment failed — update immediately." Legitimate organizations rarely operate at gunpoint. Urgency is the tell, not the reason to comply.
The Sender Doesn't Match
The display name says a company you know; the actual address behind it is a jumble or a public domain. On phones, tap the sender name to reveal the real address — display names are freely fakeable.
Unexpected Context
An invoice from a vendor you don't use, a shipping notice for nothing you ordered, a shared document from someone who never shares documents. Unexpected is the flag — even when the email itself looks flawless.
Generic + Perfect Is Still Suspect
The old advice — look for typos — is obsolete. Modern phishing is polished and personalized. Judge emails by what they ask you to do, never by how professional they look.
The Hover Habit — Reading a Link Before You Click It
On a computer, hover the mouse over any link without clicking — the true destination appears in the bottom corner of the window. On a phone, press and hold the link to preview it. Then read the domain the right way: the part that matters is the last chunk immediately before the first single slash.
https://microsoft.com/security/login ← really Microsoft https://microsoft.com.Attackers stack the real brand's name in front of their own domain, betting you'll read left-to-right and stop early. Read the domain right-to-left from the first slash and the trick collapses. When in doubt, don't click the link at all — type the site's address yourself or use your bookmark, and log in there. If the alert was real, it'll be waiting in your account.
QR-Code Phishing: The Link You Can't Preview
QR-code phishing works because the user leaves the protected desktop environment, scans the code with a phone, and lands on a login page that may look completely legitimate. Treat any unexpected QR code tied to a login, invoice, payroll notice, shipping alert, or account warning as a link that deserves independent verification.
Don't Scan Because the Brand Looks Familiar
A Microsoft, payroll, bank, shipping, or vendor logo does not prove the destination is legitimate.
Open the Service Directly Instead
If the message says your account needs attention, use your normal app, bookmark, or typed address rather than the QR code.
Never Enter Credentials Without Verifying
If a QR code leads to a sign-in page, confirm the request independently before entering a password or approving MFA.
Invoice, Wire, and Gift Card Fraud
The costliest attacks on SMBs often involve no malware at all — just a convincing email asking someone in finance or leadership's orbit to move money. Three classic shapes:
"Our Banking Details Changed"
A known vendor — or an attacker inside the vendor's compromised email — sends new payment instructions before an expected invoice. Everything about the thread looks legitimate because the thread is legitimate; only the account number is the lie.
The Executive Request
"It's [the owner]. I'm in a meeting — need you to handle a payment quietly and quickly." Authority plus urgency plus secrecy is the exact fingerprint. Real executives can survive a confirmation call.
The Gift Card Errand
Any request to buy gift cards and send the codes — for clients, for a party, for anything — is fraud. Full stop. There is no legitimate business version of this errand.
The Rule That Beats All Three
Verify out-of-band. Any request to send money, change payment details, or share sensitive data gets confirmed by calling a number you already have on file — never a number or link from the email itself, which the attacker also wrote.
Passwords, MFA, and the Login Prompt You Didn't Ask For
Reused passwords are the quietest risk in any company: one shopping site gets breached, and the same email-plus-password combination gets tried against your business email automatically. Three habits close the door:
-
Use a Password Manager — and Stop Memorizing
A password manager generates and remembers a different strong password for every account, so one breached site never unlocks another. You memorize exactly one master password. Browsers' built-in managers are acceptable; a dedicated manager is better for a business. Either beats the spreadsheet, the sticky note, and the one-password-everywhere habit by miles.
-
Turn On MFA Everywhere That Matters
Multi-factor authentication makes a stolen password harder to use by itself. Priority order: email first (whoever controls email can often reset everything else), then banking, payroll, file storage, and other critical systems. When available, choose phishing-resistant methods such as passkeys or FIDO2 security keys; otherwise use an authenticator app with number matching or time-based codes. SMS is still better than password-only access when stronger options are unavailable.
Passkeys / FIDO2 / Security Keys
Phishing-resistant authentication designed to prevent credentials from being replayed on a fake login page.
Authenticator App
Use number matching, time-based codes, or another approved app-based method when passkeys are not available.
SMS MFA
Useful when stronger methods are unavailable, but more vulnerable than phishing-resistant or app-based methods.
Password Only
Important business systems should not rely on a password alone when an additional factor is available.
-
Never Approve a Prompt You Didn't Cause
Attackers may trigger repeated MFA prompts, hoping you'll tap "Approve" out of annoyance or assume it's a glitch — the "MFA fatigue" attack. The rule is simple: never approve a prompt you didn't just cause. An unexpected prompt can indicate a stolen password or another identity attack. Deny it, report it, and follow your company's compromised-account procedure immediately.
You Clicked. Now What? (The First 10 Minutes)
Someone in your company will eventually click something bad — attackers only need to win once, and they send thousands of chances. What separates a near-miss from a disaster is almost always speed of reporting, and the enemy of speed is embarrassment.
-
Stop and Disconnect
Don't enter anything further, don't click "OK" on new popups. If you opened an attachment or a program started installing, disconnect the computer from the network — turn off Wi-Fi or unplug the cable. Don't power the machine off unless told to; whoever investigates may need it running.
-
If You Typed a Password, Change It — From Another Device
Change that password immediately, and anywhere else the same password is used (this is the moment password reuse becomes an emergency). Use a different, clean device to do it. If the account has MFA, review recent sign-ins and sign out all sessions if the option exists.
-
Report It — Fast and Without Shame
Tell your manager and whoever handles your IT right now, with specifics: sender, subject, what you clicked, what you entered, and whether a file opened or installed. Do not delete the phishing email. Preserve it and take a screenshot if helpful. If credentials were entered, IT should review recent sign-ins and active sessions and invalidate them where appropriate. If money moved, call your bank immediately. If a company email account may be compromised, do not rely on that same account as the only channel for coordinating the response.
The 10-Rule Team Checklist
The whole guide, compressed to what fits on a wall:
- 01Urgency is the red flag. The harder an email pushes, the slower you go.
- 02Hover before you click (press-and-hold on phones), and read the domain right-to-left from the first slash.
- 03When in doubt, don't click — go direct. Type the site's address yourself and log in there.
- 04Unexpected attachments and QR codes get verified with the sender through a channel you already trust.
- 05Money moves get a phone call — to a number already on file, never one from the email. No exceptions, including the boss.
- 06Gift card requests are always fraud. Always.
- 07Different password for every account, kept in a password manager.
- 08MFA on everything important — email first.
- 09Never approve a login prompt you didn't cause. Deny it, change the password, report it.
- 10If you clicked: disconnect, change the password from another device, and report immediately. Fast beats perfect, and nobody gets blamed for reporting.
What This Guide Covers — and What It Can't
Everything above hardens the human layer, which is where most attacks start — and it costs nothing but a team meeting. What it can't replace is the technical layer behind it: email filtering that stops most phishing before anyone sees it, patching that closes known holes, endpoint protection that catches what slips through, tested backups that turn ransomware from a catastrophe into a bad afternoon, and secured network devices — including, yes, the copiers and printers that quietly sit on your network with hard drives and firmware of their own. The human layer buys you fewer incidents; the technical layer decides how much the remaining ones cost.
Security, Backup, and Technology Resources
Use these resources to strengthen the technical controls that support the employee habits covered in this guide.
Copier & Printer Data Security
Review stored data, credentials, firmware, hard drives, network exposure, and secure retirement considerations.
Review Device Security →Managed IT Services
Explore email security, endpoint protection, patching, backups, monitoring, and broader business IT support.
Explore Managed IT →Managed Print Services
Review printer fleet monitoring, support, supplies, reporting, and device-management practices.
Explore Managed Print →ABT Concierge
Get recurring remote support for printer drivers, scan settings, address books, device configuration, and everyday workflow issues.
Explore Concierge →Cover the Layer Your Team Can't
ABT's Managed IT Services handle the technical side — email security, patching, endpoint protection, backups, and network monitoring — with the same flat-rate, no-surprise-invoice approach as our print agreements. Share this guide with your team today; talk to us about everything it can't fix.