“We’re too small to be a target” — what actually happens when criminals send email in your name

The most expensive sentence in small-business security is “nobody would bother attacking us.” The EU’s cybersecurity agency ENISA studied exactly this in its report Cybersecurity for SMEs, and its conclusion is blunt: criminals attack companies of every size, and they often prefer smaller firms — precisely because smaller firms assume they’re not targets and defend themselves accordingly. There’s a second reason, too: small companies supply larger ones, which makes a small firm’s email account a stepping stone into its customers’ organisations.

In ENISA’s 2021 SME report, based on a survey of 249 companies conducted in July–September 2020, more than 80% expected a serious incident to harm their business within a week; 57% believed it could put them out of business. These are respondents’ assessments, not measured outcomes or a current probability for your business.

A real case, and what it cost

One incident documented in the ENISA report deserves to be read by every business owner. A marketing agency with fewer than 25 employees moved its email to the cloud. One employee fell for a phishing message and entered their login details on a fake page. The criminals took over the mailbox — and then used it to email the agency’s clients: some received fake invoices with new bank details, others received phishing links.

The fraud was discovered by one of the agency’s customers. That customer then cancelled all future business — worth €200,000 to €300,000 per year — citing concerns about the agency’s security.

Notice what actually caused the damage. Not data loss. Not downtime. The agency’s domain and identity were turned into a weapon against the people who trusted it, and the lasting cost was trust.

Why email is the front door

The 2021 SME report cites older threat research on social engineering. It should not be read as a current percentage of all cyberattacks. Email remains one way to manipulate a recipient: attackers can imitate a familiar sender name, use a lookalike domain, forge a domain or take over a real mailbox. These are different problems, and DNS authentication addresses only some of them.

There are two distinct attacks here, and they need different defences:

Account takeover — criminals steal a real mailbox login. Your defences are multi-factor authentication and staff awareness.

Domain spoofing — criminals send from their own servers but forge your domain as the sender. No password is stolen; nothing of yours is “hacked.” Your defence is making receiving mail servers reject the forgery — and that is exactly what DMARC, built on SPF and DKIM, does when configured with an enforcement policy.

Most small businesses have partially addressed the first and completely ignored the second — usually because nothing visibly breaks. Spoofing is invisible to you by default: the fraudulent mail goes to your customers and suppliers, not to you.

The checklist, in order of impact

ENISA’s recommendations for SMEs emphasise that effective security doesn’t have to be expensive — most measures are about discipline, not budget. For email specifically:

1. Turn on multi-factor authentication for mailboxes. It reduces account-takeover risk, especially with phishing-resistant methods. DMARC would not have stopped mail sent through the compromised account in the agency case.
2. Publish a DMARC record with reporting. Received reports show sources seen by participating receivers, including some you may not recognise. Check them against your sender inventory; coverage is incomplete and reports can arrive late.
3. Move DMARC towards enforcement once you have checked legitimate senders over a full sending cycle.p=reject requests rejection of mail that fails DMARC, reducing direct spoofing where receivers apply it. Receiver overrides, lookalike domains and compromised accounts remain possible.
4. Institute a payment-verification rule: no change of bank details and no urgent transfer is ever executed on the strength of an email alone — confirm by phone or in person. ENISA recommends exactly this pairing of technical and procedural controls.
5. Train, briefly and regularly. Staff who have seen one simulated phishing mail recognise the real one faster.

Only 28% of SMEs in ENISA’s survey had assigned security responsibility to anyone at all. You don’t need a CISO. You need someone who owns this checklist — internally or through your IT provider.

The supply-chain clock is ticking

One more reason to act now rather than eventually: under the EU’s NIS2 framework, larger companies are legally required to manage security in their supply chains. In practice, that means questionnaires and contract clauses flowing down to their suppliers — including small ones. “Do you enforce DMARC?” is appearing on those questionnaires. Being able to answer yes, with evidence, is becoming a condition of doing business with bigger customers — not a nice-to-have.