Why small businesses are targets
Attackers do not pick companies, they pick people and habits. Here is how they think, and the two habits that stop most of them.
“We’re too small to be a target”
That sentence is the reason small businesses are targeted. Criminals do not study your company. They send a million messages, place thousands of robocalls, and wait to see who answers. A business with fifteen employees, one person running payments and no IT department is easier money than a bank with a security team.
What they want is not secret. It is one of four things:
| They want | How they get it | What it costs you |
|---|---|---|
| Money | A convincing request to pay, change bank details or buy gift cards | Thousands of dollars that rarely come back |
| Your login | A fake sign-in page, a text with a code, an MFA prompt you approve by mistake | Your email becomes their tool to scam your customers and coworkers |
| Your files | Ransomware that locks every file on the network | Days of downtime and a ransom demand |
| Your reputation | Sending scams from your real address to your real customers | Customers who stop trusting your emails |
The same four targets as cards, with how each one is reached.
How the attack actually feels
Almost every incident starts the same way: an ordinary moment and a small decision made quickly.
- A text arrives while you are serving a customer: “Your package could not be delivered, confirm here.”
- A call comes in during the lunch rush: “This is your card processor, we see fraud on your terminal, I need you to read me the code I just sent.”
- The owner’s voice on a voicemail at 4:55 pm: “I need you to grab gift cards for a client, call me back on this number.”
- A sign-in approval pops up on your phone at 11 pm. You tap Approve to make it go away.
None of these needs technical skill to beat. They need thirty seconds of pause and a habit of verifying through a channel you already have.
The two habits that carry this whole course
- Pause and verify through a channel you already had. Not the number in the text. Not the link in the email. Not the callback number the caller gives you. The number in your contacts, the website you typed yourself, the coworker at the next desk.
- Report early, even when you are not sure. A report that turns out to be nothing costs five seconds. A click that nobody hears about for three days costs a weekend of cleanup, or the business.
Every lesson that follows is a variation on these two habits applied to a different situation.
CISA’s four core steps for this year’s awareness month are the same habits this course teaches, in under a minute.
What this course covers
| Lesson | Threat | Skill |
|---|---|---|
| 2 | Phishing, including AI-written messages, cloned voices and deepfake video | Verify the request, not the voice |
| 3 | Weak and reused passwords | Let a password manager do the remembering |
| 4 | Stolen passwords and MFA fatigue | Use passkeys and MFA; deny prompts you did not start |
| 5 | Lost, unlocked or infected devices | Updates, locks, safe Wi-Fi, no mystery USB |
| 6 | Ransomware | Spot it early, disconnect, call |
| 7 | Phone and text scams | Hang up, call back on a known number |
| 8 | Any incident | Report in the right order |
| 9 | The voicemail lab | Put it all together |
Nobody gets blamed for reporting
Companies that punish clicks end up with employees who hide them. This course, and any good workplace policy, works the other way around: the person who reports a mistake quickly is the person who saved the day. Keep that in mind as you go through the scenarios.
Try it now
Write down two things in your phone’s notes app: the name and phone number of the person you would call if something felt wrong at work, and the phone number you would use to confirm a request from your boss. You now have an incident plan.
Remember: attackers target habits, not companies. Pause, verify through a channel you already had, and report early. Everything else in this course builds on those three moves.
Checking your progress…