Most cybersecurity basics for small business content is written for a threat model you don't have. It talks about nation-state actors, zero-day exploits, advanced persistent threats. Meanwhile the actual attack that hits an Indonesian SME this quarter is someone impersonating your finance manager on WhatsApp, asking a junior staff member to transfer money to a "new supplier account" before end of day.
That's the real threat model. Not sophisticated. Just patient, cheap to execute, and effective because most small businesses have zero controls against it. Cybersecurity basics for small business owners don't need to start with encryption standards, they need to start with the five things that are actually being exploited right now.
I'm not here to fear-sell you an enterprise security suite. Here are five controls, all achievable in an afternoon, that address what SMEs in this market actually face.
1. WhatsApp and Email Impersonation
This is the number one threat, full stop. Someone creates a WhatsApp account using your owner's or finance director's name and photo, joins or messages into a group, and requests an urgent payment or vendor detail change. It works because it exploits urgency and hierarchy, not technical weakness.
The fix isn't technical either, it's procedural:
- Any payment or vendor bank detail change requires verbal confirmation through a known, pre-saved phone number, never the number the request came from.
- Post this rule visibly where your finance team works. Make it embarrassing to skip, not just optional.
- Train whoever handles payments to expect this attack specifically, by name, so it doesn't feel abstract when it happens.
This single control stops the most expensive and most common attack pattern I see in this market, and it costs nothing.
2. Invoice Fraud
Closely related: a fraudster intercepts or spoofs an invoice, changes the bank account number, and sends it back looking identical to your real vendor's invoice. Your accounts payable team pays it without noticing the account number changed.
Controls that actually work:
- Store your real vendors' bank details in a system your team checks against, not just the PDF that arrived in an email.
- Any invoice with a bank account different from what's on file triggers a phone call to the vendor before payment, every time, no exceptions for "urgent" requests.
- Reconcile against your own vendor master list monthly, not just at audit time.
3. Shared and Reused Passwords
I still walk into businesses where the admin login for the core system is written on a sticky note, or where five staff share one login "for convenience." This isn't a hypothetical risk, it's the reason you can't tell who actually did what when something goes wrong, and it's the reason one leaked password compromises everything at once.
The fix, achievable this week:
- Individual logins for every system, every person. No shared accounts, ever.
- A password manager for the business, there are free and low-cost options, the cost isn't the barrier, the habit is.
- Two-factor authentication turned on for anything touching money: banking portals, accounting software, payment gateways. This alone blocks the majority of account takeover attempts even if a password does leak.
4. No Recovery Plan for a Locked-Out Admin Account
Ask yourself right now: if the one person who has admin access to your core system left tomorrow or lost their phone, could you get back in? Most SMEs can't answer this cleanly, and it's a silent risk that turns into a crisis at the worst possible moment, usually right when you need the system most.
- Document who has admin access to every critical system, in one place two people can find.
- Set up account recovery methods (backup email, backup phone) before you need them, not during a lockout emergency.
- Review this list every quarter alongside your regular technology budget review, it's a natural pairing since you're already auditing systems.
5. Old Employee Accounts Still Active
When staff leave, their access to email, cloud storage, and business systems often stays active for months because nobody owns the offboarding checklist. That's a standing door left open, and it's one of the easiest things on this list to fix.
- Offboarding checklist includes access revocation as a mandatory, checked step, not an afterthought.
- Review active user lists across your core systems quarterly, not just when someone new is hired.
A Simple Priority Table
| Control | Setup Time | Cost | Attack It Stops |
|---|---|---|---|
| Verbal confirmation for payment changes | 30 minutes to establish | Free | WhatsApp/email impersonation |
| Vendor bank detail verification | 1 hour | Free | Invoice fraud |
| Individual logins + 2FA | Half a day | Free to low-cost | Account takeover |
| Documented admin recovery | 1 hour | Free | Lockout crisis |
| Offboarding access checklist | 1 hour to write | Free | Ex-employee access risk |
Takeaway
None of this requires a security vendor or a big budget, it requires deciding this quarter that these five things get done, then checking they actually happened. The businesses that get hurt aren't the ones without enterprise firewalls, they're the ones where a WhatsApp message convinced someone to move money before anyone stopped to verify. Fix that one habit first, the rest follows.