Common Email Threats Facing Small Businesses
Phishing, spoofing, business email compromise, malicious files, and account takeover create different risks. Learn how to recognize the threat and match it to the right control.
The most common email threats do not all behave the same way. Phishing tries to trigger a click or sign-in. Business email compromise tries to trigger a trusted business action. Spoofing falsifies identity. Account takeover uses a real mailbox. Malicious attachments try to execute code on a device.
A useful defence starts by identifying the action the attacker wants and placing a control before, during, and after that action.
Phishing and credential theft
Phishing messages imitate a familiar service, person, or process. The message may direct the recipient to a fake Microsoft 365 sign-in page, ask them to scan a QR code, or open a shared document.
A filter can stop many known campaigns. Identity controls still matter when a message gets through. Strong MFA, Conditional Access, session controls, and sign-in monitoring reduce the value of a stolen password and improve the chance of detecting misuse.
Business email compromise
Business email compromise, or BEC, uses social engineering to obtain money, information, or access. The attacker may impersonate an executive, compromise a supplier, or take over a real account. The request may contain no malware and no malicious URL.
The strongest control is often procedural. Payment changes, urgent transfers, payroll updates, and sensitive data requests should be verified using a known phone number or another approved channel. Cloudflare's BEC overview explains why authentic-looking business context makes these attacks difficult to detect with content rules alone.
Spoofing and lookalike domains
Spoofing makes a message appear to come from a trusted domain. SPF, DKIM, and DMARC help receiving systems verify authorized senders and apply policy when authentication fails. They protect domains, but they do not stop every lookalike domain or compromised legitimate account.
That is why domain authentication should be paired with impersonation protection, external-sender cues, and user verification procedures.
Malicious links, files, and QR codes
Links can redirect through several services before reaching a credential-harvesting page or payload. Attachments can contain scripts, macros, archives, or links. QR codes move the destination to a phone, where corporate browser and device controls may not apply.
Use message inspection, time-of-click protection, file analysis, endpoint protection, and controlled mobile access. Microsoft reported continued use of QR-code phishing and CAPTCHA-based evasion in its Q1 2026 threat review.
Account takeover and mailbox abuse
Once an attacker controls a mailbox, they can create forwarding rules, delete warnings, study conversations, and send believable requests from a real account. The response must extend beyond resetting the password.
Review sign-in activity, authentication methods, inbox rules, forwarding, OAuth grants, active sessions, sent items, and related endpoints. Preserve evidence before making changes when the incident may require legal, insurance, or regulatory review.
Vendor and conversation compromise
A trusted supplier can be the entry point. Attackers may observe an invoice cycle, then change payment instructions inside a legitimate thread. Email authentication may pass because the supplier's account is genuinely compromised.
Maintain a separate verification process for bank-detail and account changes. Treat a familiar thread as context, not proof.
Match the threat to the control
| Threat | Primary objective | Important controls |
|---|---|---|
| Phishing | Capture credentials or trigger a click | Filtering, MFA, user reporting, sign-in monitoring |
| BEC | Trigger payment or data disclosure | Verification workflow, account protection, anomaly detection |
| Spoofing | Impersonate a trusted domain | SPF, DKIM, DMARC, impersonation policies |
| Malicious attachment | Execute code | File analysis, endpoint protection, patching |
| Account takeover | Abuse a real identity | Strong MFA, Conditional Access, logging, response playbook |
| Vendor compromise | Exploit a trusted relationship | Out-of-band verification, supplier controls, monitoring |
See why email remains a common attack path for the full attack sequence and Quantm's guide to email protection for the layered program. Quantm's M365 Posture Review examines email and identity controls together.