Fraud protection · Phishing · Email security
Stop scams and fraud.
Practical protection against phishing, fake invoices and email fraud, so a single convincing email cannot cost you thousands. Calm, sensible defences for small businesses in Manchester and across the UK, no scare tactics.
The problem
Most business fraud does not look like fraud. It looks routine.
- A supplier email arrives with quietly changed bank details.
- A message pretending to be your bank asks you to log in.
- The boss appears to ask for an urgent, secret payment on a Friday.
- Your domain has nothing set up to stop others spoofing your name.
- A busy member of staff clicks before they think.
- One convincing fake invoice can wipe out a month of profit.
None of this happens because your team is careless. It happens because the messages are designed to blend in, the days are full, and no one has been shown what to look for. That is a fixable problem.
Why it matters
Stop the payment, protect the business.
Protect your cashflow
For a small business, one fraudulent payment can equal a month of profit. Simple checks keep your money where it belongs.
Protect your reputation
If your email domain gets used to scam your own customers, the damage lands on your name. Proper email security protects the people who trust you.
Give your team confidence
When staff know the warning signs and have a clear "stop and check" routine, they become your first line of defence.
What we put in place
Calm, sensible defences that work together.
The same advice the national bodies give
We follow NCSC, Take Five and Action Fraud guidance.
The controls we set up are the ones recommended by the UK’s own fraud and cyber security bodies. If you want to read the source material, or report an incident, start here.
- NCSC: Small Business Guide The UK authority’s core practical guidance.
- NCSC: phishing, defending your organisation The recognised standard on layered defence.
- NCSC: email security and anti-spoofing SPF, DKIM and DMARC, from the source.
- Take Five: invoice and mandate fraud How fake bank-detail changes work.
- Action Fraud: report fraud and cyber crime The official UK reporting route.
- GOV.UK: report suspicious emails Forward scams to report@phishing.gov.uk and 7726.
Who this is for
If you pay suppliers or handle email, you are a target.
Part of a bigger system
Fraud protection is part of everyday security.
Stopping fraud overlaps with the rest of your protection: it shares controls with Cyber Essentials and security, it is delivered through your Microsoft 365 and IT, and it works best when your team is trained through awareness and AI training. See the whole picture on the homepage.
Where to start
Start with a free fraud health check.
We look at where your business is exposed to phishing, fake invoices and spoofing, in plain terms. You do not need the technical answer first.
You will get a simple list of your biggest exposures and the quickest ways to close them.
Book a free checkWe check
- Email authentication (SPF, DKIM, DMARC)
- Phishing filtering
- Multi-factor authentication
- Bank-detail change controls
- Staff awareness
- Account access and old logins
- Your response plan
- How to report an incident
How it works
Six steps, no jargon.
-
Review
We look at your email setup, accounts and payment habits, and show you plainly where the risks are.
-
Fix email authentication
We configure SPF, DKIM and DMARC and tighten your inbox filtering to cut spoofing and phishing.
-
Lock down accounts
We turn on multi-factor authentication and remove unnecessary or old access.
-
Put payment controls in place
We agree simple, written rules for verifying invoices and any change of bank details.
-
Train your team
A short awareness session so everyone knows the warning signs and the "stop and check" routine.
-
Keep it current
Ongoing checks and updates, plus a response plan ready if anything ever slips through.
A quick self-check
How exposed are you to fraud?
- Would your staff know how to spot a convincing phishing email?
- If an email asked to change a supplier’s bank details, is there a rule to phone and confirm first?
- Is multi-factor authentication switched on for every business email account?
- Has your domain got SPF, DKIM and DMARC set up correctly?
- Could someone easily send an email that looks like it came from your company?
- Do you have a clear plan for the first hour after a suspected fraud?
- Do you know how to report an incident to Action Fraud and the ICO?
- When did you last talk to your team about scams and fake invoices?
If any gave you pause, that is exactly where we can help.
Questions
Frequently asked questions.
What is invoice and mandate fraud?
It is when a criminal poses as one of your genuine suppliers and asks you to change the bank details you pay into. Future payments then go to the criminal’s account. Take Five to Stop Fraud reports that most of these losses fall on business accounts.
What is CEO fraud?
An email or message that appears to come from a senior person in your business, asking a member of staff to make an urgent payment or share information. It relies on authority and urgency to stop people questioning it.
What is business email compromise?
When a criminal gains access to, or convincingly imitates, a business email account and uses it to redirect payments or trick people. The NCSC calls it business payment fraud; invoice fraud and CEO fraud are common forms.
What are SPF, DKIM and DMARC?
They are three free email security settings for your domain. In plain terms, they help prove your email genuinely came from you and make it much harder for criminals to send convincing fakes in your name. The NCSC recommends all three.
Do these things really matter for a small business?
Yes. The NCSC’s guidance is aimed squarely at small organisations because they are frequently targeted. Criminals often see smaller firms as having fewer defences, and the losses hit harder.
Isn’t staff training a waste of time?
Good training is short, practical and specific. When people know the warning signs and have a clear "stop and check" habit, they catch the emails technology misses. It is one of the most cost-effective steps you can take.
What is multi-factor authentication and why does it help?
MFA means logging in needs a second step as well as a password, such as a code or an app prompt. It means a stolen password on its own is not enough to break into an account. The NCSC recommends it for online services.
What should I do if we have been hit?
Contact your bank immediately, ideally by calling 159 or the number on the back of your card. Then report it to Action Fraud. If personal data may have been exposed, you may also need to tell the ICO. We can help you work through a clear checklist calmly.
How do I report fraud in the UK?
Report it to Action Fraud, the national fraud and cybercrime reporting centre. You can forward suspicious emails to report@phishing.gov.uk and suspicious texts to 7726, both free.
When do I have to report a data breach to the ICO?
If a breach is likely to put people’s personal data at risk, you must tell the ICO without undue delay and, where feasible, within 72 hours of becoming aware. The ICO has a self-assessment tool to help you decide.
Will this stop every scam?
No honest provider can promise that, and we will not. What we can do is close the common gaps criminals rely on, so you are far harder to target and far quicker to respond if anything gets through.
How does this fit with Cyber Essentials?
Very neatly. Many of these steps, such as MFA and account controls, are part of the government-backed Cyber Essentials scheme. If you want formal certification too, we can guide you through it.
Make one email far less likely to cost you thousands.
If you pay suppliers, handle invoices or worry about phishing, start with a free fraud health check.