Most "cyberattacks" we untangle in Polish SMEs start the same way: one person, on a Friday afternoon, clicked an email. They weren't stupid, they weren't careless — they were tired and had ten tabs open. The email looked like an invoice from a regular supplier, like a bank notice or a quick-favour ask from the CEO. That was enough.
Phishing is no longer Russian teenagers with broken grammar. Today it's a coordinated industry that earns more on SMEs than on corporations, because SMEs have no security team, no SOC, no second pair of eyes on every transfer. There's just one bookkeeper handling sixty invoices a day and trusting that "the spam filter probably catches stuff".
This post is about what actually works — and what only looks good on an audit checklist — when defending against phishing and its most expensive variant: BEC (Business Email Compromise).
Phishing doesn't look like a Nigerian prince anymore
Over the last year, in Polish SMEs we mostly see four scenarios. Each one is mundane, and each one works because it fits the rhythm of the workday.
- Fake invoice from a "regular" supplier. The email looks like every other one. Company name matches, tax ID matches, the amount is plausible. The only thing changed is the bank account number in the PDF. The attacker doesn't guess — first they took over the supplier's mailbox, read the correspondence for weeks, then dropped the email at the perfect moment.
- The "CEO" asking for an urgent transfer. The email comes from an address that looks like the CEO (
ceo@companyABC.cominstead ofceo@company-abc.com— the human eye won't catch it). Body: "I'm in a meeting, can't talk, please make this urgent transfer to account X, I'll confirm later." It works because it leans on hierarchy and urgency. - "Microsoft 365: your password expires in 24 hours". A classic. The employee clicks, lands on a near-perfect copy of the login page, types in their credentials. The attacker now has access to the mailbox, calendar, contacts and — worst of all — historical correspondence to build the next attack.
- "Documents for review" attachment. A ZIP or a macro-laced file. Opened on a machine with access to the network share — and six hours later half the company is encrypted by ransomware.
All four scenarios have one thing in common: they don't try to break through technical defences. They try to walk in through an employee who has too much work and too few reasons to pause for a second.
89,000 PLN, one email and three weeks of silence
At one of our clients — a 28-person manufacturer machining steel components — the bookkeeper paid 89,000 PLN to an account that "appeared" in an email from a regular supplier. The email looked like every other one: same signature, same footer, plausible invoice number, plausible amount. Only the last four digits of the bank account number were different. The attacker had earlier taken over the supplier's mailbox (regular phishing, no MFA), spent three weeks sitting in it reading correspondence, and dropped the email exactly on the day the invoice was expected.
The money wasn't recovered. The Czech destination bank pushed the funds onward within four hours. The company lost 89 thousand zloty plus a week of management time spent talking to police, lawyers and insurance. The supplier had some bitter questions too.
After the incident we rolled out a few simple things with them: MFA on every mailbox, a written policy "every change of bank account number is confirmed by phone with the number from our CRM, never the number from the email", external-email tagging in headers, and a brief monthly phishing simulation followed by a 5-minute informal debrief. Over the following two years the company caught three more BEC attempts — two stopped by a phone call to the supplier, one by an employee who noticed the email was "off". No losses.
This isn't a story about technology. It's a story about habits. The supplier did have a spam filter in both cases, and the email got through anyway — because it came from a real, hijacked mailbox.
What doesn't work — even if it looks good
The cyber industry sells SMEs a lot of things that look good on a quote and don't work in practice. The most common mistakes we see:
- Annual mandatory e-learning. The employee clicks "next, next, next, test" and forgets everything in two days. That's not training — that's a GDPR audit checkbox.
- Posters and fear campaigns. "Watch out for fraudsters!" in the corridor teaches nobody anything. Fear produces paralysis, not vigilance.
- "When in doubt, ask IT" policy. Sounds reasonable, but in an SME "IT" is one person on a half-time contract who isn't picking up because they're fixing the printer. The employee will click on their own, because they have to keep working.
- "Our antivirus will catch it." Antivirus catches attachments with known signatures. BEC is plain text and a swapped account number — no antivirus will see that.
- "We have SPF/DKIM, so they can't spoof us." SPF/DKIM/DMARC protect against spoofing of your domain. They don't protect against email from a real but compromised supplier mailbox. And that's exactly how BEC works.
Each of these has its place — but none of them replaces the habit that stops the bookkeeper's hand for a second before they hit "send" on a transfer.
What actually works — in 4 hours of work
Most SMEs can put a basic defence against phishing and BEC in place in one working day. You don't need a quarter-long project, you don't need a 50-thousand-euro SOC. You need five things:
- MFA on every mailbox. No exceptions, including the management board. This single change eliminates 90% of account takeovers. In Microsoft 365 and Google Workspace it's an hour to enable. If "someone in the company can't use MFA", that means they haven't been trained — not that MFA is bad.
- External-email tagging. Every email coming in from outside the organisation gets a yellow banner in the header: "Caution: this email came from outside your organisation." A tiny change that materially reduces the success rate of attacks impersonating the CEO or the IT department. In M365 it's a single transport rule.
- Written policy for changing bank accounts. A single A4 sheet on the wall in accounting: "Every change of a counterparty's bank account number is confirmed by phone using the number from our CRM/ERP, never the number from the email or invoice. No phone call = no transfer. No exceptions, including the CEO." One piece of paper that saves 20–50 thousand euro a year in a typical SME.
- A brief monthly test. Once a month we send the team a simulated phishing email — an invoice, a "CEO" request, a bank notice. We measure who clicked. Not to punish anyone, but to spend five minutes talking through how you could have spotted it. After six months of these "live drills" we typically see click-rate drop from 20–25% down to 3–5%.
- A "weird email" channel. A shared place (Teams, Slack, a group mailbox) where anyone can drop an email and ask "is this real?". Someone from IT or management replies within 30 minutes. It's a filter and a teaching tool at the same time.
These five things together cost the company nothing but time. They cost one working day, and then 30 minutes a month.
Small habits that save real money
Beyond technology, three habits save companies more often than any system does:
- Every transfer above an agreed amount triggers a phone call. Set the threshold yourself (1k, 5k, 20k euro). A call to the person who initiated it, on the number you have on file — not the number from the email. Thirty seconds of conversation stops 100% of classic BEC.
- Hover before clicking. Hover the mouse over a link before clicking it. Check whether the domain it leads to is the one you expect. One movement, teachable to a team in ten minutes.
- A "weird feeling" is a reason to stop. If an email triggers urgency, pressure, fear or discomfort, those are exactly the emotions the attacker is leaning on. Habit: stop, call, verify. You will never regret pausing for a minute.
Banal, all of it — but it works only if the team hears it monthly, not once a year at a GDPR session.
Where to start
If you run a 10–50-person SME and you're reading this thinking "we don't really have any of this", don't panic. Do it in this order:
- Check that MFA is on for every company mailbox, including management and shared accounts (
office@,accounts@). If it isn't, that's the most urgent thing this week. - Write the bank-account-change policy on one sheet of paper and put it up in accounting. Tomorrow.
- Within a month, run a simple phishing simulation — there are free tools (Microsoft's Attack Simulator built into M365 Business Premium) and cheap services at 5–20 euro per user per month.
- After the first simulation, do a 5-minute informal team chat: "let me show you how to spot that this was fake." No naming and shaming. Drill, not execution.
- After three months, measure whether click-rate is dropping. If it isn't, something is wrong with execution, not with the concept.
Phishing isn't going away. But a company where the team knows what to expect, and has clear procedures for moments of doubt, loses far less to it than one that hopes "the filter will catch it". The first, second and third stopped fraud pay back the investment quietly — money you didn't lose never shows up on an invoice.
If you want to put this together for your company but aren't sure where to start, we help SMEs untangle this kind of work regularly. The first conversation is free and takes thirty minutes.
The weakest link isn't the firewall. It's a tired bookkeeper on a Friday afternoon — and only a habit will protect them.