Email Security for SMBs: Stop Phishing on Workspace & 365

Last month, a garment exporter in Tirupur nearly wired ₹12 lakh to a supplier's "new bank account." The email looked perfect: same signature, same broken English the supplier always used, even a scanned invoice on the right letterhead. What tipped off the accounts manager was a single character in the sender domain. The real supplier used @fabrictextiles.com. The fraud email came from @fabrictextiles.co. One missing letter, nearly twelve lakh rupees.

This is the reality of email-based fraud in India right now. CERT-In and various industry reports have flagged business email compromise (BEC) as one of the fastest-growing attack categories, and SMBs are the softest targets because they run on default settings. If you moved to Google Workspace or Microsoft 365 and assumed "the cloud handles security," you're carrying more risk than you think. The default spam filter stops obvious junk. It does not stop a well-crafted invoice fraud aimed at your finance team.

This guide is a practical playbook for email security for Indian SMBs. We'll cover the layered defenses that actually matter, exact setup steps you can hand to your IT vendor, real rupee costs, and a case study of how a 40-person firm shut down a live BEC attempt. No jargon dumps. Just what works.

Key Takeaways

• Phishing and BEC succeed because of missing DNS records, not weak passwords. Fix SPF, DKIM, and DMARC first — it's free and blocks domain spoofing.
• Turn on multi-factor authentication (MFA) for every user, especially finance and directors. This single step stops the majority of account takeovers.
• Your default Workspace/365 plan is not enough for high-risk teams. Upgrade finance and leadership to advanced threat protection tiers.
• Train people, but design for failure — assume someone will click. External-sender warnings and payment verification rules catch what training misses.
• Budget ₹150–₹600 per user per month for meaningful protection, depending on plan and add-ons.

Why are Indian SMBs such easy targets for phishing?

Attackers follow money and weak defenses. Indian SMBs sit at the intersection of both. You're transacting in lakhs and crores with vendors, running GST-registered operations with predictable invoice cycles, and often relying on one part-time IT person or a friend's nephew who "knows computers."

Three specific weaknesses show up again and again when I audit SMB email setups:

• No DMARC record. Anyone on the internet can send email that appears to come from your domain. I've tested this for clients — sent a spoofed email from their own CEO's address to their finance head, and it landed in the inbox with no warning.
• MFA is optional or off. A leaked password from some unrelated breach gets reused, and suddenly an attacker is reading a director's mailbox for weeks, learning who pays whom and when.
• Everyone shares the "admin" login. No accountability, no audit trail, and one compromised laptop exposes the whole tenant.

The uncomfortable truth: most breaches I've investigated didn't need clever malware. They needed one confident email and one busy employee. Your defense has to assume that combination will happen.

What is the difference between phishing and business email compromise?

These get lumped together, but they need different defenses.

Phishing is the wide net. Fake bank alerts, fake "your mailbox is full" messages, fake GST portal notices. The goal is to steal a password or drop malware. Volume is high, personalization is low. A decent spam filter and user awareness handle most of this.

Business email compromise is the spear. The attacker researches your company — often for weeks after quietly accessing one mailbox — then impersonates a vendor, your MD, or a client to redirect a real payment. There's usually no malicious link at all, which is exactly why filters miss it. The Tirupur case above was classic BEC.

The distinction matters because BEC won't be stopped by antivirus. It's stopped by process: sender verification, payment approval workflows, and DMARC enforcement that prevents lookalike domains from impersonating you internally.

How do I set up SPF, DKIM, and DMARC (the free foundation)?

These three DNS records are your email passport. Together they prove your mail is genuinely from you and tell the world what to do with fakes. Skipping this is the single biggest mistake I see. It costs nothing but a bit of DNS work.

Here's the walkthrough you can follow or hand to your vendor. You'll edit DNS at wherever your domain is registered (GoDaddy, BigRock, Cloudflare, etc.).

1. Publish an SPF record. This lists which servers may send mail for your domain. For Google Workspace, a basic record looks like:
   v=spf1 include:_spf.google.com ~all
   For Microsoft 365:
   v=spf1 include:spf.protection.outlook.com -all
   If you also send through a bulk provider or CRM, add their include statement. Keep it to one SPF record with all sources listed.
2. Enable DKIM. This cryptographically signs your outgoing mail. In Google Workspace go to Apps > Google Workspace > Gmail > Authenticate email, generate the key, and publish the provided TXT record. In Microsoft 365, use the Defender portal under Email & collaboration > Policies > DKIM, then publish two CNAME records. Wait for propagation, then enable signing.
3. Start DMARC in monitoring mode. Add a TXT record at _dmarc.yourdomain.com:
   v=DMARC1; p=none; rua=mailto:[email protected]
   The p=none means "don't block anything yet, just send me reports." Watch these reports for two to four weeks to confirm all your legitimate senders (your billing tool, your marketing platform, your CRM) pass.
4. Move to quarantine, then reject. Once your reports are clean, tighten to p=quarantine (fakes go to spam), and finally p=reject (fakes are refused outright). This is the setting that stops criminals from spoofing your own domain.

Common Mistake: Jumping straight to p=reject without monitoring. I've seen a Pune manufacturing firm silently kill their own GST invoice emails and monthly newsletters for three days because their bulk-mail vendor wasn't authorized in SPF. Always run p=none first and read the reports. If you use a service like our bulk messaging and communication tools, make sure every legitimate sending source is authorized before you enforce.

DMARC report XML is unreadable by humans. Use a free parser like Postmark's DMARC digest or a low-cost tool to get plain-English summaries. If your team doesn't have the bandwidth to manage this, our IT consulting team handles the full SPF/DKIM/DMARC rollout as a fixed-scope project.

Which Google Workspace and Microsoft 365 security features should I actually turn on?

Both platforms have good built-in security that most SMBs never enable. Here are the settings that give you the most protection for the least effort.

On Google Workspace

• Enforce 2-Step Verification for all users. Admin console > Security > 2-Step Verification. Set an enrollment deadline. Prefer authenticator apps or security keys over SMS.
• Enable enhanced Safe Browsing and attachment protection under Gmail settings. Turn on protection against spoofing, suspicious links, and unauthenticated senders.
• Turn on the "external sender" banner so any email from outside your organization shows a visible warning. This alone catches many impersonation attempts.

On Microsoft 365

• Enable Security Defaults or Conditional Access to enforce MFA. Business Premium and up include Conditional Access for granular rules.
• Configure Defender for Office 365 anti-phishing policies. Turn on impersonation protection for your key people (MD, CFO, accounts) and your own domain.
• Enable Safe Links and Safe Attachments so links are checked at click-time and attachments are detonated in a sandbox before delivery.

Not sure which licence tier you're on or whether it includes advanced protection? We help clients right-size their plans through our Google Workspace licensing and Microsoft 365 licensing services, so you're not paying for seats you don't need or missing protection you do. If you're still deciding between platforms, our comparison of Zoho vs Google Workspace vs Microsoft 365 for Indian SMBs breaks down the trade-offs.

How much does proper email security cost for an Indian SMB?

Let's talk actual rupees. Here's how the main options stack up per user per month, before GST. Prices shift, so treat these as planning ranges, not quotes.

Plan / Add-on	Approx. cost (₹/user/month)	MFA	Advanced anti-phishing	Best for
Google Workspace Business Starter	~₹136	Yes	Basic	Small teams, low-risk roles
Google Workspace Business Standard	~₹736	Yes	Improved (Vault, more controls)	Growing SMBs needing retention
Microsoft 365 Business Standard	~₹770	Yes	Basic (EOP)	Office-heavy teams
Microsoft 365 Business Premium	~₹1,540	Yes + Conditional Access	Full (Defender for O365)	Finance/leadership, high-risk firms
Third-party filter (e.g. Proofpoint Essentials tier)	~₹150–₹300	N/A (add-on)	Strong	Extra layer over any platform

A practical approach for a 40-person firm: put the 30 general staff on Business Standard, and upgrade the 10 people who touch money or sign contracts (accounts, procurement, directors) to Business Premium or add Defender. That targeted spend gives you enterprise-grade protection exactly where an attacker will aim, without paying premium rates for the whole company.

Case study: how a Jaipur trading firm stopped a live BEC attack

A 42-person building-materials trading company in Jaipur came to us after a near-miss. Here's what happened and what we changed.

The incident: An attacker compromised a junior sales executive's mailbox through a reused password (no MFA). They lurked for about three weeks, reading email quietly and setting up a hidden inbox rule to auto-delete any replies to their fraud. Then they emailed a regular customer from a lookalike domain, sharing "updated bank details" for a pending ₹8.5 lakh payment. The customer's accountant got suspicious and phoned to confirm. That phone call saved the money.

What we found in the audit:

• No MFA on any account.
• No DMARC record, so the lookalike domain trick worked cleanly.
• A malicious auto-forwarding rule quietly copying the compromised inbox to an external Gmail.
• Shared admin credentials with no logging.

What we implemented over two weeks:

1. Enforced MFA org-wide via authenticator apps, with a 7-day enrollment deadline.
2. Rolled out SPF, DKIM, and DMARC — starting at p=none, moving to p=reject after clean reports.
3. Upgraded the 8 finance and management users to Microsoft 365 Business Premium with Defender impersonation protection.
4. Disabled external auto-forwarding at the tenant level and audited all inbox rules.
5. Wrote a one-page payment-change policy: any bank detail change must be verified by a phone call to a known number, never a number from the email itself.

The outcome: Total added cost was roughly ₹9,000 per month for the upgraded licences, plus a one-time project fee. Against a single ₹8.5 lakh loss they nearly took, the maths is not close. Six months on, their DMARC reports show dozens of blocked spoofing attempts per month that never reach anyone.

How do I train staff without wasting everyone's time?

Technology stops most attacks. People stop the rest. But "annual security training" that everyone clicks through is theatre. Here's what actually changes behaviour:

• Run realistic phishing simulations quarterly. Send a safe test phish, then show clickers a 60-second lesson right then. Both Google and Microsoft offer simulation tools in higher tiers.
• Make the payment-verification rule non-negotiable. Any change to vendor bank details gets a callback to a previously known number. Put it in writing and have directors follow it too, so juniors feel safe insisting on it.
• Teach the domain-check habit. Hover before clicking, and read the sender address character by character on any money-related email. The Tirupur firm's ₹12 lakh was saved by exactly this.
• Give people an easy "report" button. Both platforms have a report-phishing add-in. When reporting is one click, staff actually do it, and you spot campaigns early.

Pro Tip: Never punish people for reporting a false alarm or admitting they clicked. The moment staff fear blame, they hide incidents, and a hidden compromise is far more expensive than an embarrassing one. Reward the report, investigate the click quietly.

What else should be on my email security checklist?

Beyond the core steps, here are the finishing touches that separate a decent setup from a resilient one:

• Disable legacy authentication protocols (IMAP/POP/SMTP basic auth) that bypass MFA. Attackers love these.
• Set up alerts for suspicious activity — impossible-travel logins, mass deletions, new forwarding rules.
• Keep separate admin accounts that aren't used for daily email, and protect them with the strongest MFA (security keys).
• Back up mailboxes — cloud providers protect against their outages, not against you deleting or an attacker wiping data. Use a third-party backup.
• Document a response plan so that when something happens, you know who to call and what to shut off first.

If you're modernising more than email — moving servers to the cloud, tightening your whole stack — this often fits into a broader project. Our cloud migration and managed services team handles email security as one layer of a full hardening exercise. For manufacturers specifically, our digital transformation starter playbook puts email security in context with the rest of your IT roadmap.

Frequently asked questions

Does Google Workspace or Microsoft 365 protect against phishing by default?

Partially. Both filter obvious spam and known malicious links out of the box, but default settings do not stop domain spoofing or targeted BEC. You need to enable MFA, publish DMARC, and turn on advanced anti-phishing policies to be genuinely protected.

Is MFA really necessary if we have strong passwords?

Yes. Passwords leak through unrelated breaches and get reused, and even strong ones can be phished. MFA blocks the vast majority of account takeovers even when the password is known, which is why it's the single highest-value control you can enable.

What is DMARC and why does my SMB need it?

DMARC is a DNS record that tells receiving mail servers what to do with email claiming to be from your domain but failing authentication. Without it, criminals can send emails that appear to come from your own company. With DMARC set to reject, those fakes are refused, which directly stops a common BEC technique.

How much should a small business in India spend on email security?

The core foundation — SPF, DKIM, DMARC, and MFA — is free and only needs setup effort. For meaningful protection on higher-risk staff, budget roughly ₹150–₹600 per user per month via upgraded licences or add-on filtering. Targeting finance and leadership for premium tiers keeps costs sensible.

Can I set up SPF, DKIM, and DMARC myself?

If you're comfortable editing DNS records at your domain registrar, yes — the steps in this guide walk through it. The tricky part is reading DMARC reports and moving safely from monitoring to enforcement without blocking your own legitimate mail. Many SMBs prefer a one-time vendor project for peace of mind.

What is business email compromise and how is it different from a virus?

BEC is a fraud where an attacker impersonates a trusted person or vendor to redirect a legitimate payment, usually with no malicious file or link at all. Because there's nothing for antivirus to detect, it's stopped by process controls like payment verification and DMARC rather than by security software alone.

How do we prevent invoice fraud with our vendors?

Enforce a strict rule that any change to a vendor's bank details must be confirmed by phone to a previously known number, never a number supplied in the email itself. Combine this with DMARC enforcement and external-sender warnings, and the classic fake-invoice attack loses most of its power.

The bottom line

Effective email security for Indian SMBs isn't about buying the most expensive tool. It's about layering a few high-impact, mostly free controls — MFA, SPF, DKIM, DMARC — then targeting premium protection at the handful of people who handle money, and finally backing it all with a simple payment-verification habit your team actually follows. Do those things and you close the gaps that criminals exploit every single day.

The Jaipur firm's near-miss cost them ₹9,000 a month to fix. The alternative was ₹8.5 lakh, gone. That's the trade every SMB owner should weigh.

If you'd rather have this set up properly the first time, eDarpan can audit your Workspace or 365 tenant, harden it end to end, and right-size your licences so you're not overpaying. Explore our full range of services or get in touch for a straight-talking assessment. Security done once, done right, beats a crisis every time.

Image credit: Sad Cartoon versus Technology by Sean Loyless via flickr (BY 2.0), sourced through Openverse.