Picture a quiet Monday morning. Your book-keeper gets an email from a supplier you've used for years. Their bank details have changed, so could you pay this week's invoice into the new account? The logo is right, the tone is right, and the payment goes out. Two weeks later the real supplier phones to ask where their money is.This is called invoice redirection fraud, and it's one of the most common ways Irish businesses lose money. It doesn't need clever technology. It needs one believable email and one busy afternoon.If that sounds uncomfortably plausible, good. The aim of this article is to show you that a handful of simple habits, none of which need an IT department, close off most of the risk.
Why this matters to a business your size
Criminals rarely pick on small businesses personally. They send the same trick to thousands of companies and see who bites. Being small doesn't make you invisible. It often makes you easier, because there's no one whose full-time job is to spot the problem.There are three costs to think about:
Money. Fraudulent payments are usually gone for good. Ransomware (malicious software that locks your files until you pay) can stop you trading for days.
Reputation. Customers forgive mistakes. They are less forgiving when their details end up in the wrong hands.
Legal liability. Under GDPR, if personal data about customers or staff is lost or accessed by someone who shouldn't have it, you may have to notify the Data Protection Commission within 72 hours of becoming aware of it. Fines can reach €20 million or 4% of turnover, though for a small firm the more realistic damage is the time, disruption and lost trust.
You don't need to become a security expert. You need five good habits.
1. Tighten up passwords and access
What it is: Making it hard for someone to log in as you or your staff, and making sure only the right people can get in.
Why it matters: Most break-ins start with a stolen or guessed password. Many people reuse the same one across dozens of accounts, so one leak elsewhere can open your business email.
How to do it:
- Use a password manager. This is an app that creates and remembers long, unique passwords so nobody has to. Bitwarden has a free version that works well for small teams.
- Switch on two-step verification (also called multi-factor authentication). After entering a password, you confirm with a code from your phone. Start with email and online banking, then add accounting software and cloud storage. Most services have this under "Security" in account settings, and it takes a few minutes each.
- Keep access tidy. Give staff access only to what they need for their job. Avoid shared logins, because you can't tell who did what. When someone leaves, close their accounts the same day.
2. Keep software up to date
What it is: Installing the updates that Windows, Apple, your phone and your apps keep asking you to install.
Why it matters: Many updates fix security holes that criminals already know about. Putting them off leaves the door open.
How to do it:
- Turn on automatic updates on every computer, phone and browser. In Windows, look under Settings and then Windows Update. On a Mac, it's System Settings and then General and then Software Update.
- Don't forget the less obvious devices: the office router, the till, the old PC in the back room that runs the stock system.
- Check for anything that's too old to update. Windows 10 stopped receiving free security updates in October 2025, so any machine still running it should be upgraded or replaced.
Set a reminder to check this quarterly. It's a 20-minute job.
3. Make email harder to abuse
What it is: Protecting the channel where most attacks begin.
Why it matters: Phishing (fake emails designed to trick you into clicking a link, opening a file or sending money) is the most common route in. The fake supplier email above is a classic example.
How to do it:
- Adopt one firm rule: any request to change bank details or make an unusual payment gets confirmed by phone, using a number you already have on file, not one in the email. This single habit stops most invoice fraud.
- Check your spam filtering. If you use Microsoft 365 or Google Workspace, strong filtering is built in. Make sure it's switched on and set to a high protection level.
- Know the warning signs. Be wary of urgency ("pay today or we cancel"), slightly odd sender addresses (look closely at the spelling), and unexpected attachments. If in doubt, don't click. Ring the sender.
4. Back up your data and test it
What it is: Keeping copies of your important files somewhere safe, so you can recover from ransomware, a stolen laptop, a flood or a simple mistake.
Why it matters: A good backup turns a crisis into an inconvenience. It also supports your GDPR duty to keep personal data secure and recoverable.
How to do it:
- Follow the 3-2-1 rule: three copies of your data, on two different types of storage, with one kept off-site.
- Understand that file syncing is not backup. Services like OneDrive and Google Drive sync changes across devices, which means ransomware can scramble the synced copies too. Use them with version history turned on, and add a separate backup.
- A simple setup: an external hard drive that you plug in, run the backup and then unplug (a drive left connected can be locked along with everything else), plus a low-cost cloud backup service for the off-site copy.
- Test it. Once a quarter, try restoring a few files. A backup you've never tested is a hope, not a plan.
5. Train your people, kindly
What it is: Making sure everyone on the team knows what to look for and what to do if something seems off.
Why it matters: Your staff are your first line of defence, and also where most mistakes happen. That's not a criticism. Attackers design their tricks to catch smart, busy people.
How to do it:
- Hold a 15-minute chat every quarter. Share a real example, such as a suspicious email you received, and talk through what gave it away.
- Make it safe to speak up. If someone clicks something they shouldn't have, you want to hear about it in the first five minutes, not after a week of worrying. Tell the team plainly: no blame for reporting, serious conversations for hiding it.
- Use free resources. Ireland's National Cyber Security Centre publishes practical guidance for small businesses at ncsc.gov.ie, written in plain language and ideal for sharing with staff.
Your next step: one hour, this week
Reading about security doesn't protect anyone. Doing a few small things does. Block out one hour and work through this list in order:
1. Install a password manager and change the passwords on your email and banking.
2. Turn on two-step verification for those same accounts.
3. Switch on automatic updates on every device you can reach.
4. Agree the phone-call rule for payment changes and tell your team today.
5. Plug in an external drive and run a backup.
Then write down, on one page, what you'll do if something goes wrong: who to call, which bank to contact first, and the reminder that a breach involving personal data may need to be reported to the Data Protection Commission within 72 hours. Pin it somewhere visible.
None of this makes you untouchable, and nothing does. But it moves you out of the easy-target group, and for a small business, that's most of the battle.