Business Email Security: A Guide for Small Organisations

Business email security is mostly a question of switching on what you already pay for, then adding the controls no filter provides. Microsoft 365 and Google Workspace both scan inbound mail before a user sees it. Neither can tell a genuine request to change a supplier's bank details from a criminal one sent from that supplier's own mailbox.

This guide covers the whole email topic for an organisation of 10 to 250 people. It sets out the threats, what each licence includes, where mail authentication fits, and a checklist in priority order. Everything was read from vendor and regulator pages on 14 Nov 2026; nothing was configured or measured, as the methodology page explains. Every post in this topic is listed under email and phishing.

Four ways email is used against a business

The threats overlap, but each one is stopped by a different control.

• Phishing. A message that tricks someone into entering a password on a fake page, or opening something harmful. The UK NCSC's phishing guidance says plainly that "Some phishing attacks will always get through, so you should plan for incidents".
• Business email compromise. The FBI defines it as a scam aimed at people "regularly performing wire transfer payments", carried out by "compromising email accounts and other forms of communication". The classic case is an invoice or a request to change payment details.
• Account takeover. A criminal signs in to a real mailbox and uses it. Mail sent from a genuine account passes every authentication check, because it is genuine.
• Malicious attachments and links. Files or links that install malware or lead to credential pages. These are what sandboxing and link scanning are built for.

Filters do well against the first and last. The middle two depend more on sign-in security and business process than on scanning.

What the FBI's figures say about payment fraud

The FBI Internet Crime Complaint Center publishes a large annual count of reported business email compromise. Its 2025 Internet Crime Report ranks it second by losses, behind investment fraud.

For scale, the same report counts 1,008,597 complaints of all kinds in 2025 and $20.877 billion in losses. Phishing and spoofing produced far more complaints, 191,561, but far smaller reported losses. The report also notes that "businesses reported losses over $30 million to BEC scams involving AI" in 2025.

These are complaints made to a US agency. They undercount, and they say little about the UK or elsewhere. An earlier FBI public service announcement put the worldwide exposed loss at $55,499,915,582 between October 2013 and December 2023, drawn from filings with financial institutions.

What Microsoft 365 filters before you buy anything extra

Microsoft calls its base layer the built-in security features for all cloud mailboxes, long known as Exchange Online Protection. It is "included in all organizations with cloud mailboxes". Anti-malware, anti-spam and anti-spoofing policies are on by default, and Microsoft says "You can't turn them off".

A few defaults matter in practice. Mail carrying malware goes to quarantine, where by default only admins can see it. High confidence phishing is "always delivered to quarantine". Zero-hour auto purge removes delivered messages that are later found to be malware, spam or phishing.

The default policies can be overridden by stricter ones. Microsoft's preset security policies come in Standard and Strict versions. Microsoft says their settings "are based on our observations in the datacenters", and almost none can be changed. For a small team without a mail specialist, assigning everyone to Standard is the quickest sound baseline.

Defender for Office 365 Plan 1 and Plan 2

Microsoft describes the built-in layer as protection against "broad, volume-based, known email attacks". Its overview of Defender for Office 365 says Plan 1 adds protection against "zero-day malware, phishing, and business email compromise (BEC)". Plan 2 adds simulations, investigation and automation.

The licence mapping comes from Microsoft's service description. Among the business plans, it names only Business Premium as including Plan 1. Business Basic and Business Standard customers get the built-in tier unless they buy the add-on.

Impersonation protection is the Plan 1 feature most relevant to invoice fraud. It covers mail that impersonates named users and domains, including your own senior staff and your suppliers.

A licensing detail applies once you own any Plan 1 licences. Microsoft's Built-in protection preset turns on basic Safe Links and Safe Attachments for all users, even unlicensed ones. Microsoft still recommends "purchasing enough Defender for Office 365 licenses" to cover everyone.

What Google Workspace covers, edition by edition

Google's pre-delivery scanning page says Gmail normally shows a warning on likely phishing and may move it to spam. The stronger controls are settings an admin must review, and one of them depends on the edition.

The advanced phishing and malware protection page lists three groups of settings:

• Attachments: encrypted attachments and attachments with scripts from untrusted senders, and unusual attachment types.
• Links and external images: links behind shortened URLs, linked images, and a warning on clicks to untrusted domains.
• Spoofing and authentication: similar domain names, spoofed employee names, inbound mail spoofing your own domain, and any unauthenticated mail.

The default action for these is "Keep email in inbox and show warning". Moving such mail to spam or quarantine is a deliberate admin choice. The page does not say which editions offer these settings.

Security Sandbox is where the edition matters. Google scans attachments "in a virtual environment", covering executables, Office files and PDFs. It is listed for Frontline Plus, Business Standard, Business Plus, Enterprise Standard and Enterprise Plus, but not Business Starter. "The default setting for Security Sandbox is Off", and scanning can delay a message by up to three minutes.

The prices were read on 14 Nov 2026 from Google's pricing page, under its annual-commitment option. They exclude tax, and Business editions are capped at 300 users. Google also offers enhanced pre-delivery message scanning, which briefly holds suspicious mail for extra checks; its page names no editions.

SPF, DKIM and DMARC are one layer, not the whole defence

Mail authentication protects your domain from being forged. The NCSC says DMARC "stops phishers from spoofing your domain". The joint CISA, NSA, FBI and MS-ISAC phishing guide asks organisations to "Ensure DMARC is set to 'reject' for sent emails".

The records, the mailbox providers' rules and the path from p=none to p=reject are covered in SPF, DKIM and DMARC: what mailbox providers require. The point for this guide is what authentication cannot do.

It does nothing about a lookalike domain one letter away from yours. It does nothing when a real supplier's mailbox is taken over, because that mail is properly signed. CISA's small-business phishing page warns that "Messages may appear to come from known contacts whose accounts were compromised." Those gaps are why the next three layers exist.

Warning labels for external senders

A visible label on outside mail makes a message claiming to be from the finance director look wrong when it arrives from outside.

In Microsoft 365, the Set-ExternalInOutlook command turns on an "External" icon near the subject line. It appears in Outlook for Windows and Mac, Outlook on the web, and the mobile apps. Microsoft says it can take 24 to 48 hours to show. Up to 200 trusted senders or domains can be exempted.

If an older mail flow rule already adds "[EXTERNAL]" to subject lines, Microsoft advises turning it off first, so the warning is not duplicated.

Google's external recipient warnings are "on by default". They work in the other direction: a banner appears when a user writes or replies to someone outside the organisation. Google's page does not describe a label for incoming external mail. For that, the spoofing and unauthenticated-mail warnings listed above are the nearest equivalent.

A payment-change rule that does not depend on spotting the email

The strongest defence against invoice fraud is a written rule that works even when the email is perfect. The FBI advises: "Use secondary channels and/or two-factor authentication to verify requests for changes in account information." CISA suggests looking up the sender's number independently and using a known contact method.

A workable rule for a small finance team has four parts:

1. Call back. Any new or changed bank details are confirmed by phone, on a number already on file. Never use a number in the requesting email.
2. Second approver. A second person signs off any change to a supplier's payment details before the next payment run.
3. No urgency exemptions. Requests marked urgent or confidential follow the same rule. CISA lists urgent language as a red flag.
4. Check the address. The FBI specifically says to verify the sending address, "especially when using a mobile or handheld device", where it is often hidden.

If money has already gone, speed matters most. The FBI says to "Immediately, contact your financial institution and request a recall of the funds", and to file at ic3.gov "Regardless of the amount lost". Its Recovery Asset Team froze $679,013,183 in 2025, a 58% success rate across 3,900 incidents.

Make reporting a single click

Users can only report what is easy to report. The CISA joint guide encourages organisations to "use reporting features that are built into Microsoft Outlook and other cloud email platforms".

Microsoft's user reported settings control where the built-in Report button sends mail: to Microsoft, to a reporting mailbox, or both. By default the reporting mailbox is the global admin's own. Microsoft says to mark a dedicated reporting mailbox as a SecOps mailbox, or a reported test message may itself trigger training.

Gmail users can report messages as spam, not spam or phishing. The admin User report that summarises those reports is listed only for Frontline Plus, Enterprise Plus, Education Standard and Plus, and Enterprise Essentials Plus. Smaller Workspace customers need another way to hear about reported messages, such as a shared address.

UK organisations can also forward suspicious mail to the NCSC. Its reporting service says "Forward us as many suspicious emails as you like", and records 454.8k scam URLs removed as of July 2026. The NCSC does not reply with the outcome.

What awareness training can and cannot do

Training is worth doing, and both national agencies say so. CISA's small-business page says "once-a-year training isn't enough". The joint guide asks small and medium organisations to have staff review phishing material at least annually, ending with a check that it was retained.

The NCSC is blunt about the limit: "No training package, including phishing simulations, can teach users to spot every phishing attempt." It also warns that "Users who fear reprisals will not report mistakes promptly, if at all", and that "blaming users for clicking on links doesn't work".

The practical reading is to train people to report, not to be perfect. A fast report from someone who clicked is worth more than silence from someone afraid of being named. In Microsoft 365, Attack simulation training is a Plan 2 feature, so a Business Premium tenant would need another source for simulated phishing.

When a mailbox has been taken over

Account takeover is where email security meets identity. The best prevention is strong sign-in protection, covered in our guide to multi-factor authentication for small businesses. The joint CISA guide calls a strong MFA "the best way that small businesses can protect their internet facing business accounts from phishing related threats".

Microsoft's compromised account guidance lists the warning signs. They include inbox rules that forward mail to unknown addresses, rules that move messages to Notes, Junk Email or RSS Subscriptions, and odd items in Sent Items. Newly added external forwarding and unexplained lockouts are also on the list.

Its recovery steps run in this order: disable the account, revoke sessions, and review the registered MFA methods. Then review consented apps, admin roles and mail forwarders. Microsoft adds: "Don't send the new password to the user through email, because the attacker could have access to the mailbox at this point."

Automatic forwarding deserves its own setting. Microsoft's forwarding control defaults to "Automatic - System-controlled", which behaves differently in older tenants. Microsoft advises choosing On or Off explicitly instead. Off is the safer choice unless someone has a documented need. Fold these steps into your incident response plan.

A prioritised business email security checklist

The order below puts free, high-value steps first. It assumes one administrator, possibly from an outside IT provider.

1. Turn on MFA for every mailbox, and phishing-resistant MFA for admins, as the joint CISA guide recommends.
2. Write the payment-change rule and give it to everyone who can pay or change a supplier record.
3. Publish SPF, DKIM and DMARC, then work towards p=reject as set out in the sender requirements guide.
4. Set automatic external forwarding to Off in Microsoft 365, with named exceptions only.
5. Apply the Standard preset policy to all Microsoft 365 users, or review each Gmail advanced phishing setting and its action.
6. Turn on external labels in Outlook, and keep Gmail's external recipient warnings on.
7. Set up reporting: the Outlook Report button routed to a monitored mailbox, or a shared address for Gmail users.
8. Close the attachment gap: Plan 1 or Business Premium on Microsoft 365, and Security Sandbox on Business Standard or above on Google Workspace.
9. Train at least annually, and reinforce often, with a no-blame message about reporting.
10. Keep a copy of mail you cannot afford to lose. Recovery after a takeover or ransomware is covered in our small business backup strategy.

Email is one front among several. A malicious attachment that gets through still has to run on a laptop, which is where endpoint security takes over. For a formal baseline that ties these controls together, see security frameworks for small businesses.