How to Protect Your Irish Business from Phishing Attacks

What phishing looks like now

The "Nigerian prince" email is not what attackers send to Irish businesses in 2025. Modern phishing is called spear-phishing: targeted emails that impersonate someone the recipient knows, using information gathered from LinkedIn, your website, and public company records.

A typical scenario: your accounts payable contact receives an email that appears to be from your supplier, using a domain that looks nearly identical (replace an 'l' with a '1', or add '-ie' to the end). The email says banking details have changed and asks them to update the account number before the next payment run. By the time the real invoice arrives, the money is gone.

Another common scenario: a staff member gets an email appearing to come from your CEO, on a Sunday evening, asking them to urgently buy gift cards for a client and send the codes. The CEO's email was spoofed or the attacker registered a similar domain.

Why training alone isn't enough

Annual phishing awareness training reduces click rates but doesn't eliminate them. The most targeted attacks fool security-trained professionals. You need both human awareness and technical controls, neither is sufficient alone.

The technical controls that actually work

1. SPF, DKIM, and DMARC

These are email authentication standards that prevent attackers from sending emails that appear to come from your domain. If you don't have DMARC configured with a policy of at least p=quarantine, anyone can send emails that look like they're from your domain.

Check your domain's DMARC record by looking up the TXT record at _dmarc.yourdomain.ie in any DNS lookup tool. If it's missing or set to p=none, you're unprotected. This is a quick fix, RAIT configures DMARC for clients in under an hour.

2. Multi-factor authentication on email

If a staff member clicks a phishing link and enters their email password, MFA is the last line of defence. With MFA enabled, the attacker has the password but still can't access the account without the second factor. This stops the majority of account takeover attempts cold.

Microsoft 365 and Google Workspace both support MFA and make it straightforward to enforce it for all users via admin policy. There is no good reason not to have it on.

3. Email filtering and sandboxing

Both Microsoft 365 Defender and Google Workspace's built-in filtering catch a large proportion of phishing emails before they reach inboxes. But the default settings are not maximally protective. Microsoft's "Safe Links" and "Safe Attachments" features (available in Defender for Business) rewrite URLs in emails and sandbox attachments before delivering them, this catches zero-day phishing links that slip past signature-based filters.

4. DNS filtering

A DNS filtering service blocks requests to known malicious domains at the network level. If a staff member clicks a phishing link, the DNS filter prevents their browser from resolving the attacker's domain. Cloudflare Gateway, Cisco Umbrella, and similar services can be deployed across your entire network in under a day. OPNsense firewalls (which RAIT deploys) can be configured with blocklists covering millions of malicious domains.

5. Conditional access policies

If you use Microsoft 365 Business Premium or Entra ID, Conditional Access lets you block logins from unexpected geographies, require compliant devices, and flag sign-ins from unfamiliar locations for additional verification. An attacker who has stolen credentials from a phishing page but is attempting to log in from Eastern Europe gets blocked even if MFA was bypassed.

Process controls

Technical controls stop automated attacks. Process controls stop the targeted ones.

Two controls matter most for Irish SMEs:

• Bank account change verification: Any supplier or payroll bank account change must be verified by a phone call to a known number, not a reply to the email that requested the change. This single policy eliminates the most common business email compromise fraud vector.
• Invoice payment approval: Payments above a certain threshold (set appropriate to your business) require a second approver. One person receiving a convincing email cannot unilaterally authorise a large payment.

What to do if you've been phished

If you suspect a staff member has clicked a phishing link or entered credentials on a fake site: reset their password immediately, revoke all active sessions for that account, review the account's sent mail and login history for the past 30 days, and check whether any mail forwarding rules have been created (attackers often set these up silently to monitor a compromised inbox).

If money has been transferred to a fraudulent account: contact your bank immediately. Irish banks have dedicated fraud teams and can sometimes reverse transfers, but only within a very short window.