Zoes
← Blog

Phishing protection for a small business: a setup checklist

The settings and habits that stop most phishing at a company without a security team, in the order worth doing them - for Google Workspace and Microsoft 365.
By · October 14, 2026 · 6 min read
Four coworkers looking at a laptop together at a table
Photo: Jud Mackrill on Unsplash
Verizon's Data Breach Investigations Report has found for years that most breaches involve a person - a click, a reused password, a mistaken payment. The steps below are ordered by how much of that risk they remove per hour of work.

1. Lock down accounts

A stolen password turns phishing into a full mailbox takeover. Do this first.

Google Workspace
Microsoft 365
Require MFA
Admin console → Security → Authentication → 2-Step Verification → Enforcement
Entra admin center → turn on Security defaults, or a Conditional Access policy
Block external auto-forwarding
Admin console → Apps → Gmail → End User Access → Automatic forwarding: off
Defender portal → Anti-spam outbound policy → Automatic forwarding: Off
Separate admin accounts
Use a super admin account only for admin work
Use a Global Administrator account only for admin work

2. Protect your domain

SPF, DKIM and DMARC stop attackers from sending mail that claims to come from your exact domain. They do not stop lookalike domains, but they close the easiest door.

  1. 1Publish an SPF record listing only the services that send mail for you.
  2. 2Turn on DKIM signing in the Google Admin console or the Defender portal and publish the key.
  3. 3Publish DMARC at p=none with a reporting address, read the reports for a few weeks, then move to quarantine.

More on how these fit together: SPF, DKIM and DMARC explained.

3. Turn on built-in filtering

  • Google Workspace: Admin console → Apps → Gmail → Safety. Turn on the attachment, link and spoofing protections; Google recommends the defaults.
  • Microsoft 365: Defender portal → Email & collaboration → Policies & rules → Threat policies → Preset security policies. Apply Standard protection to everyone.

Platform detail: Google Workspace and Microsoft 365.

4. Add a payment rule

One written rule stops most business email compromise, whatever gets through the filters: any new or changed bank details are confirmed by phone, on a number already on file, before money moves. See how business email compromise works.

5. Add a detection layer

Built-in filtering misses targeted, low-volume mail. An API-based tool like Zoes adds that layer without touching mail routing.

  1. 1Connect Zoes from a Google super admin or Microsoft Global Administrator account.
  2. 2Protect the mailboxes that matter most first: owner, finance, payroll, anyone who approves payments.
  3. 3On a paid plan, read the first-scan report of what is already sitting in inboxes - it moves nothing.
  4. 4Set where alerts go: email on every plan, Slack, Teams or Telegram on Team and Business.

Ongoing

Weekly

  • Read the digest. Look for new names on the most-targeted list.
  • Correct any verdict that is wrong - the dashboard and future detection both use it.

When people join or leave

  • Protect new hires on day one - new staff are easy targets for "from the CEO" mail.
  • Suspend leavers' accounts the same day and check them for forwarding rules.

Keep reading

A person holding a payment card while typing on a laptop
6 min readBusiness email compromise: how it works and how to stop itWhat a business email compromise message looks like, why spam filters miss it, the payment controls that stop it, and what to do in the first hours if money has already gone.Read →
Hands typing on a laptop in a bright room
5 min readHow to spot a phishing email: five checks, in orderA checklist that catches most phishing and fraud, ordered by how quickly each check gives an answer, with worked examples. Written to be shared with a team.Read →

See what is reaching your inboxes

Connects to Google Workspace or Microsoft 365 in minutes. Try it free for 14 days.

Get startedView pricing