Start here
Keep my shop trading
Updated 11 October 2026. Evergreen: this page changes when the advice does, not every week.
Small businesses get hit for the same reasons as people, plus one: your email address is public, your suppliers and customers trust it, and criminals know that. Three things, in order, and most attacks bounce off.
Do one thing: Turn on multi-factor authentication for every staff login, starting with email and the bank.
1. Multi-factor authentication, everywhere
If you use Microsoft 365 or Google Workspace it is a switch in the admin settings. Do email and the bank today; every cloud service you use this week. Without it you will also fail Cyber Essentials.
2. Stop people sending email as you
Your domain can carry a public setting that tells other mail servers to reject fakes. Most small businesses have never set it, so a scammer can email your customers and suppliers as you. It is called DMARC, it takes an afternoon, and it is the single biggest thing you can do for the people who trust your email.
Check where your domain stands with the free DMARC checker (a Blankitt tool; see how we make money). It reads your public DNS and tells you what to change.
3. Get Cyber Essentials
The UK government's baseline certificate: five controls, a questionnaire, a few hundred pounds. Increasingly your bigger customers and your insurer will ask for it, and the five controls are the right five. Start now; it takes longer than you think to tidy the estate first.
The two scams that hit shops most
Invoice fraud. An email, apparently from a supplier, says the bank details have changed. They have not. Agree with every supplier that bank details only change by phone call to a number you already hold, and tell staff the rule.
Your IT supplier. If someone else manages your systems, their security is your security. Ask them how they protect your access, and what happens if they are breached. The retail lesson of 2025 was that the way in was through a supplier.
Before you need it
The NCSC small business guide has a one-page incident plan. Print it, put it with the first-aid kit, and make sure the bank's fraud number is on it.
Questions people ask
What is the first thing a small business should do about cyber security?
Turn on multi-factor authentication for every staff login, starting with email and the bank. In Microsoft 365 or Google Workspace it is a switch in the admin settings. Without it you will also fail Cyber Essentials.
How do I stop scammers sending email that looks like it comes from my business?
Set DMARC on your domain, a public DNS setting that tells other mail servers to reject fakes. Most small businesses have never set it. A free DMARC checker will read your DNS and tell you what to change; it takes an afternoon.
What is invoice fraud and how do I stop it?
An email, apparently from a supplier, says their bank details have changed. They have not. Agree with every supplier that bank details only change by a phone call to a number you already hold, and make sure every member of staff knows the rule.
Each week's news for this audience is in the issues and the archive. The other guides: protect my money and accounts and keep the kids and the household safe.