You're Not Too Small to Hack Anymore

Picture a Tuesday morning at a six-person property management office. Hypothetical, but you'll recognize it. The bookkeeper gets an email from a vendor she has paid for three years. Real name, real address, real email thread. "Shared a document with you. Enter this code to view it."

She clicks. It opens Microsoft's actual sign-in page. She enters the code, approves the login on her phone like she does every day, and sees a blank document. Weird. She moves on.

Three weeks later, a reply lands in a real thread about a real invoice. Same vendor, same tone, same signature. New bank details, effective immediately. The office pays it.

Nobody stole a password. Nobody "fell for" anything obvious. And the person who pulled it off probably never read a single one of her emails.

An AI did that part.

The old math protected you

For years, small businesses had a quiet defense nobody talked about. You weren't worth the effort.

Running a good email scam takes work. Someone has to break into an inbox, read weeks of messages, figure out who pays whom, learn how people write, and time the fake request perfectly. That's hours of a criminal's attention. Spent on a big company, it might pay off in six figures. Spent on a landscaping company or a three-chair dental practice, it usually didn't pencil out.

So the careful, patient attacks went after bigger targets. Small shops mostly got the sloppy stuff. Typos, fake lottery wins, gift card requests from a "CEO" who has never once asked for a gift card.

That math just changed.

What AI actually changed

In September, Microsoft and its partners took down a criminal service called EvilTokens under a federal court order. According to Microsoft, it had been used to break into more than 12,000 inboxes across more than 10,000 organizations. Criminals rented access through Telegram for roughly $500 a month, the price of a decent software subscription.

The interesting part isn't the hacking. It's what came after. EvilTokens was built around an AI chatbot that read through a victim's inbox to find the trusted relationships and the payment approvals. Microsoft said the AI helped attackers decide who to target and who to impersonate, not just write the emails.

In other words, the expensive part of the job, the reading and the figuring out, got close to free.

Insurance data is starting to show what that means for smaller businesses. Coalition, a cyber insurer, published a briefing this month drawing on claims from more than 110,000 policyholders. As reported by Risk & Insurance and Insurance Business, business email compromise claims rose about 30% in the second half of 2025 compared with a year earlier, and the increase landed mostly on micro businesses that attackers previously didn't consider worth the effort. Coalition says the average claim is typically under $30,000.

Under $30,000 sounds small until it's your payroll week.

You were never too small to rob. You were just too small to bother with. AI made you worth bothering with.

Your MFA isn't the finish line

Most owners I talk to did the responsible thing a few years ago. They turned on the text-message code or the phone approval and stopped worrying about email.

Here's the uncomfortable part. In the scenario above, MFA worked exactly as designed. The bookkeeper really was on Microsoft's real page. She really did approve the login. The trick, called device code phishing, abuses a legitimate sign-in method built for smart TVs and printers, the "go to this website and enter this code" screens. The attacker starts the sign-in and gets her to finish it for them.

No fake website to spot. No misspelled domain. That's why it works on careful people.

Five fixes that cost almost nothing

None of this requires a security team. Most of it takes an afternoon.

1. Never enter a code someone sent you. Make it a house rule. A legitimate login code is one you asked for, on a device you're holding. If an email, text, or caller hands you a code to type in, stop and call the sender at a number you already have.

2. Turn off device code sign-in if you don't use it. If your business runs on Microsoft 365, this is a setting your IT person or provider can block in minutes. Microsoft recommends exactly that. Most small offices don't sign in to smart TVs with their work account.

3. Move the owner and whoever pays bills to passkeys. Passkeys and hardware security keys are what Microsoft calls phishing-resistant sign-in. Start with the two or three accounts that can move money. That's where it matters most.

4. Check your inbox rules once a month. Once attackers are inside, they often set up a quiet rule that hides or forwards certain replies so you never see the vendor saying "that wasn't us." It takes two minutes to look. Anything you didn't create, delete it and change the password.

5. Read the fraud section of your insurance policy. Many cyber and crime policies cover money sent to a fake account only up to a smaller sublimit, and some require you to show you verified the request. Know your number before you need it.

And yes, still call back on any change to payment details. Every time, at a number you already have, not the one in the email.

Use the same tools they use

There's a flip side here, and it's the reason I'm not writing this to scare anyone.

The same kind of AI that reads an inbox for a criminal can read your security settings for you. Paste a screenshot of your Microsoft 365 or Google Workspace admin page into the AI assistant you already pay for and ask what's turned on, what isn't, and what a five-person office should change first. Ask it to explain your insurance policy's fraud coverage in plain English. Ask it to draft the one-page "how we handle payment changes" rule for your team.

You don't need to out-tech anyone. You need to stop being the easiest inbox on the block.

The attackers got cheaper. Your defenses can too.

If you want a second set of eyes on how your business handles email, logins, and payments, that's the kind of practical work we do at Nexera Intelligence. No scare tactics, just the handful of changes that actually matter.