Cybersecurity for People Who Think Phishing Is a Weekend Hobby
Question: what is phishing? If your first answer involves a rod, a cooler box and a quiet Saturday at the dam, you are in good company. But in the world of cybersecurity for small businesses in Kenya, phishing is something far less relaxing, and it is the way most attacks begin. Let us talk about it without the scary hoodie pictures.
What phishing actually is
Phishing is when someone sends you a message pretending to be someone you trust, hoping you will click a link, open an attachment, share a password or send money. It might arrive by email, SMS, WhatsApp or even a phone call.
Nyambura, an accounts assistant, once received an email that looked like it came from her director. It said he was in a meeting, very urgent, please pay this supplier today, here are the new bank details. The logo was right. The tone was right. Even the "kindly revert" was right. The only thing wrong was the email address, which was off by one letter.
She almost paid. What saved her was a simple habit: she called the director on his known number. He was not in a meeting. He was in traffic on Waiyaki Way, and very glad she called.
Red flags to watch for
Phishing messages often share a few warning signs:
Urgency: act now, today, before the account is closed
Secrecy: do not tell anyone, I am in a meeting
Changes to payment details, especially bank accounts or paybill numbers
Links that do not go where they claim, which you can often check by hovering
Attachments you were not expecting, especially with odd file names
Small spelling errors in names, email addresses or website addresses
Attackers are getting better at writing convincing messages, so do not rely on bad grammar to spot them. Rely on the situation. If a message asks for money, passwords or access, pause.
Cybersecurity basics for small businesses in Kenya
You do not need a huge budget to be much safer than average. Most attacks succeed because of a few common gaps. Close these and you are already ahead:
Turn on two-factor authentication for email, banking and important systems
Keep computers, phones and software updated, because updates fix known holes
Use a password manager and stop reusing passwords
Back up important data automatically, with at least one copy offsite
Give staff access only to what they need for their job
Remove access immediately when someone leaves
Make verification a normal habit
The single most powerful rule is this: any request to change payment details, or to send money urgently, must be confirmed through a different channel. If it came by email, call. If it came by WhatsApp, call the number you already have, not the one in the message.
Make this an official policy, and make sure the bosses follow it too. Staff should never feel they will get in trouble for double checking a request from a director. Wanjala, a finance manager, puts it simply to his team: "If I ever get angry that you called to confirm, that is how you know it is not really me."
Train people, kindly
Technology helps, but people are the main line of defence. Short, regular, friendly training beats a long annual lecture that everyone sleeps through after the chai.
Share real examples of scam messages your team has received. Celebrate people who report suspicious emails, even when they turn out to be harmless. And if someone does click something they should not have, the right response is "thank you for telling us quickly", not shouting. People who are afraid of blame hide mistakes, and hidden mistakes are where attacks grow.
When something goes wrong
Have a simple plan before you need one. Who should staff tell? Who can reset passwords, contact the bank or call in outside help? Write it on one page and put it somewhere everyone can find.
If you are building or upgrading business software, security should be part of the design from day one. You can read about how we approach that in our services. Otherwise, here is your next step: forward this article to your accounts team and agree, today, that every change to bank details gets a phone call first. Then go fishing, the relaxing kind.