October brings darker evenings, Halloween decorations and, unfortunately, another season of increasingly convincing cyber scams.

For UK small businesses, phishing is no longer limited to poorly written emails from suspicious addresses. Criminals now use artificial intelligence, realistic Microsoft 365 login pages, fake delivery messages and convincing phone calls to exploit busy teams.

The consequences can be severe:

• Stolen Microsoft 365 credentials
• Fraudulent payments and redirected invoices
• Ransomware and malware infections
• Loss of customer or financial data
• Operational disruption and reputational damage
• Increased recovery and compliance costs

According to Business.gov.uk, 1 in 2 UK small businesses identify a cyber attack, with around 1 in 4 experiencing a cyber crime, based on the 2025 Cyber Security Breaches Survey.

So, what should you be looking out for this October?

1. Could AI-written spear phishing be targeting your team?

What does the trick look like?

AI allows criminals to create polished, personalised messages in seconds. A phishing email may appear to come from:

• Your managing director
• A trusted supplier
• Your accountant
• A customer or solicitor
• Your IT support provider

It may refer to a genuine project, recent meeting or real member of staff. Unlike traditional scams, it might contain perfect spelling, natural phrasing and an entirely believable tone.

Why does it work?

Attackers gather information from company websites, LinkedIn and social media. They then use that information to manufacture urgency, authority and familiarity.

When a message appears connected to something you are already working on, you are less likely to question it. Particularly when you are busy.

How do you defend against it?

• Treat unexpected requests for payments, data or passwords with caution.
• Verify unusual instructions through a separate, trusted channel.
• Do not rely on spelling mistakes as your main warning sign.
• Create a clear policy for approving payments and sharing sensitive information.
• Provide role-specific training for finance, payroll and senior staff.

As the NCSC explains, spear phishing is targeted phishing that uses information about your organisation or employees to make messages more persuasive.

2. Is that Microsoft 365 login page real?

What does the trick look like?

You receive an email stating:

“Your Microsoft 365 account will be suspended. Verify your details immediately.”

The link opens a page that looks almost identical to the genuine Microsoft sign-in screen. You enter your email address, password and possibly an MFA code. The information goes straight to the attacker.

Why does it work?

Most businesses use Microsoft 365 every day. A security warning, shared document notification or password expiry message feels routine.

Once criminals capture your credentials, they may be able to:

• Read confidential emails
• Search for invoices and payment details
• Create hidden inbox rules
• Impersonate you to customers and suppliers
• Access other connected services
• Launch further attacks inside your business

How do you defend against it?

• Access Microsoft 365 through a known bookmark or by typing the official address yourself.
• Use MFA and conditional access policies.
• Encourage staff to report unexpected login requests.
• Monitor for suspicious sign-ins, mailbox rules and forwarding settings.
• Never provide passwords or MFA codes in response to an email.

Your Microsoft 365 environment should be actively managed, not simply switched on and forgotten.

3. Could a fake invoice or “urgent CEO” request empty your account?

What does the trick look like?

An email appears to come from your director, supplier or customer. It asks you to:

• Pay an invoice urgently
• Change a supplier’s bank details
• Make a confidential transfer
• Set up a new payee
• Send payroll or customer information

The attacker may have compromised a genuine mailbox, making the request appear to come from a real account.

Why does it work?

This is often called CEO fraud, payment diversion or BEC. Business Email Compromise. It exploits normal business relationships and the authority of senior people.

The criminal wants you to act quickly before you have time to check the details.

How do you defend against it?

• Always verify bank-detail changes using a known telephone number.
• Never verify a payment request by replying to the original email.
• Introduce two-person approval for unusual or high-value payments.
• Keep a trusted contact list for key suppliers.
• Treat last-minute changes and secrecy requests as major warning signs.

Business.gov.uk recommends contacting a trusted person at the organisation requesting the payment, not using the details supplied in the suspicious message.

4. Have QR codes become the new fishing hook?

What does the trick look like?

Quishing is phishing delivered through a QR code. The code may appear in:

• A Microsoft 365 security email
• An invoice or document
• A poster in your office
• A delivery notification
• A message asking you to re-register a device

Scanning it on your phone takes you to a fake login page or malicious website.

Why does it work?

People have learned to hover over email links, but QR codes hide the destination until after they have been scanned. They can also move the attack from a well-protected business computer to a personal mobile phone.

How do you defend against it?

• Treat QR codes exactly like clickable links.
• Do not scan codes from unsolicited emails or messages.
• Check the destination address before entering credentials.
• Use official mobile apps or type the organisation’s website manually.
• Make sure mobile devices have suitable security controls and updates.

5. Could a voicemail or callback be the start of an attack?

What does the trick look like?

You receive an email, text message or voicemail telling you to call urgently about:

• A suspicious payment
• A Microsoft 365 security alert
• A failed subscription
• A compromised account
• A parcel or delivery problem

When you call, the criminal pretends to be your bank, supplier, IT provider or another trusted organisation.

This is known as callback phishing or vishing. Voice phishing.

Why does it work?

A phone conversation feels more personal and reassuring than an email. Attackers use scripts, background noise and pressure to appear legitimate. They may ask for passwords, MFA codes, remote access or payment approval.

How do you defend against it?

• Never share passwords or MFA codes over the phone.
• Hang up if the call creates pressure or panic.
• Find the organisation’s number independently.
• Confirm the caller’s identity before discussing sensitive information.
• Make sure staff know how your genuine IT provider communicates.

6. Are repeated MFA prompts trying to wear you down?

What does the trick look like?

Your phone receives repeated MFA approval requests. They continue until you are distracted, frustrated or assume someone in the business is trying to sign in.

Eventually, you press “Approve” simply to make the notifications stop.

This is an MFA fatigue or push-bombing attack.

Why does it work?

MFA is an essential protection, but criminals understand that people can be pressured into approving an unexpected request, especially after their password has already been stolen.

How do you defend against it?

• Deny all unexpected MFA prompts.
• Report repeated prompts immediately.
• Use number matching or phishing-resistant authentication where available.
• Investigate suspicious sign-ins and reset compromised credentials.
• Explain clearly that staff will never be criticised for reporting an MFA mistake quickly.

MFA is powerful, but it is not a substitute for monitoring, sensible access controls and informed users.

7. Is that parcel notification really worth the risk?

What does the trick look like?

A text message claims that your parcel is waiting at a depot or cannot be delivered. It asks you to pay a small fee or update your address.

Common lures include:

• “Your parcel requires a £1.99 delivery payment.”
• “Your delivery address is incomplete.”
• “Choose a new delivery date.”
• “Confirm your details to avoid return to sender.”

These are examples of smishing: SMS phishing.

Why does it work?

Most people receive parcels regularly. The message arrives on a mobile, often while the recipient is travelling or distracted. The small payment makes the request feel harmless.

However, the link may steal payment details, install malware or capture personal information.

How do you defend against it?

• Use the courier’s official app or website instead of the text link.
• Never enter card details into a page reached from an unexpected message.
• Encourage employees to report suspicious texts, even on business mobiles.
• Include smishing in staff induction and refresher training.
• Consider Mobile Device Management (MDM) for company-owned devices.

Why technology alone cannot defeat phishing

Email filtering, endpoint protection, MFA and 24/7 SOC monitoring are essential layers of defence. They can block threats, identify unusual activity and limit the damage when something gets through.

But technology cannot understand every business conversation or recognise every trusted relationship.

That is why human risk management training matters.

Human risk management is a structured approach to helping people recognise, question and report cyber threats. It combines:

1. Practical, scenario-based security awareness training
2. Role-specific guidance for finance, HR and leadership teams
3. Clear processes for payments, access and data sharing
4. A positive culture where people can report mistakes quickly
5. Technical controls that support, not blame, the user

The goal is not to make everyone suspicious of every email. That is unrealistic and damaging to productivity. The goal is to make safer behaviour simple and repeatable.

The NCSC recommends a layered approach combining technology, processes and people. Its phishing guidance also stresses the importance of making it easy for users to report suspicious messages without fear of blame.

Turn phishing tricks into a security treat

This October, do not leave your business relying on outdated assumptions such as “our team will spot anything suspicious”.

Modern phishing is polished, targeted and designed to exploit pressure. The good news is that a simple, proactive solution exists.

Stevens I.T. Solutions can help you:

• Fortify Microsoft 365 and email security
• Improve MFA and access controls
• Monitor suspicious activity
• Deliver practical security awareness training
• Build clear incident response processes
• Provide scalable IT support for small business UK

For a real example of layered protection in action, read our case study on stopping a phishing attack with 24/7 SOC monitoring.

Do not wait for a frightening surprise. Contact Stevens I.T. Solutions today and simplify the process of securing your people, systems and business, with ease.