Email Attacks on Microsoft 365 & Google Workspace: SMB Defense

Last month a mid-sized textile exporter in Surat almost wired ₹28 lakh to a bank account in Dubai. The email looked exactly like it came from their regular supplier in China: same signature, same invoice format, same broken English they'd grown used to over three years of business. The only difference was one character in the sender's domain and a "new banking details, please update your records" line buried in the third paragraph. Their accountant caught it at the last second because the amount didn't match the pending PO. Most don't get that lucky.

Business Email Compromise (BEC) and phishing have quietly become the most expensive cyber problem Indian SMBs face, and almost none of it involves the Hollywood-style "hacking" people imagine. There's no firewall being breached. Attackers simply log into a mailbox with stolen credentials, or spoof a domain, and let human trust do the rest. The FBI's IC3 has pegged global BEC losses at over $50 billion, and Indian businesses on Microsoft 365 and Google Workspace are squarely in the crosshairs precisely because so many now run on these platforms with default settings and no additional layers.

This post is about practical Microsoft 365 email security for SMBs and the equivalent Google Workspace hardening you can do without hiring a full security team. I'll walk through what these attacks actually look like, the settings that matter, a real hardening checklist, cost comparisons, and the mistakes I keep seeing in the field. If you're the person who signs off on IT spend for a 10 to 200 person company, this is written for you.

Key Takeaways

• Default M365 and Google Workspace tenants are not configured to stop targeted phishing and BEC. You must turn on and tune protections.
• MFA alone stops most credential theft, but modern attackers now bypass it with token theft and MFA fatigue. Enforce phishing-resistant methods.
• Get SPF, DKIM, and DMARC (set to p=reject) live on your domain. This single step blocks most domain spoofing of your brand.
• Add impersonation protection for your top executives and finance staff, and a hard rule: no bank detail change happens over email alone.
• Budget realistically. Proper protection for a 25-person team runs roughly ₹9,000 to ₹22,000 per month depending on plan tier and add-ons.
• Train your finance and procurement teams first. They are the highest-value targets and the most common failure point.

What do email attacks on Microsoft 365 and Google Workspace actually look like?

Forget the generic "you've won a lottery" spam. The attacks that drain money from Indian SMBs are tailored and patient. Here are the four you'll encounter most.

1. Credential phishing

An email pretends to be a shared document, a voicemail, a "your mailbox is full" alert, or a fake Microsoft/Google login page. The victim types their username and password into a lookalike site. Increasingly these pages also relay your MFA code in real time, so even 2FA doesn't save you. Once the attacker has a valid session, they sit inside your mailbox quietly reading email.

2. Business Email Compromise (BEC)

This is where the money goes. After getting into a mailbox (or spoofing a domain), the attacker studies your invoicing patterns, then sends a payment redirect request. The Surat exporter above is a textbook case. The finance version targets your accounts team. The CEO-fraud version pretends to be your MD asking for an urgent transfer while "in a meeting, can't take calls."

3. Vendor/supplier invoice fraud

The attacker compromises your vendor's mailbox, waits for a genuine invoice thread, and inserts changed bank details. This is nasty because everything is legitimate except the account number. You're not being phished. Your supplier is.

4. Internal lateral phishing

Once one employee's account is compromised, the attacker emails colleagues from that real, trusted account. "Hey, can you approve this?" lands very differently when it comes from your actual HR manager's real address.

Common Mistake: Assuming that because you're a small company in Nagpur or Coimbatore, nobody's targeting you. Attackers scrape MCA filings, GST portals, LinkedIn, and Justdial to find your directors, your CFO, and your vendors. Small size makes you a better target because you likely have weaker controls and still move real money.

Why do default M365 and Google Workspace settings leave you exposed?

Both platforms ship with baseline anti-spam and anti-malware. That's genuinely good at stopping mass junk. What it does not do out of the box:

• Enforce MFA for every user (unless you enable Security Defaults or Conditional Access).
• Block or flag domain lookalikes and executive impersonation.
• Reject spoofed email claiming to be from your own domain, unless you've published DMARC with an enforcement policy.
• Alert you when someone logs in from an unusual country or forwards all your mail to an external address, a classic post-compromise move.

The gap between "we bought M365 Business Standard" and "we're actually protected" is wide, and it's exactly where most SMBs get caught. If you're still deciding which platform fits, our comparison of Google Workspace vs Microsoft 365 for your SMB in 2026 is a good starting point before you worry about hardening either.

How much does proper email security cost for an Indian SMB?

Let me be specific because vague "it depends" answers help nobody planning a budget. Here's how the common options stack up for a business licensing per user, in rupees, at the time of writing.

Plan / Add-on	Approx. price (per user/month)	MFA	Anti-phishing / impersonation	Best for
M365 Business Basic	₹145	Yes (needs config)	Basic EOP only	Small teams, email only
M365 Business Standard	₹770	Yes (needs config)	Basic EOP only	Most SMBs wanting Office apps
M365 Business Premium	₹1,560	Yes + Conditional Access	Defender for O365 P1 included	SMBs serious about security
Defender for O365 P1 (add-on)	₹165	N/A	Safe Links, Safe Attachments, anti-impersonation	Adding protection to Basic/Standard
Google Workspace Business Standard	₹1,150	Yes (needs config)	Good native, no advanced impersonation rules	Google-first teams

Prices shift with annual vs monthly commitment and GST applies on top. For a 25-person firm, the practical sweet spot is usually M365 Business Premium at roughly ₹39,000/month all-in, or Business Standard plus the Defender P1 add-on if you want to trim cost. We help clients pick and provision the right tier through our Microsoft 365 licensing and Google Workspace licensing services, and it's rarely as simple as picking the cheapest SKU.

A real hardening walkthrough: what we did for a 40-person firm in Pune

A logistics and freight-forwarding company in Pune came to us after a near-miss. Their operations head had clicked a fake "shared shipment document" link and entered his password. Within 48 hours the attacker had set up a mailbox rule that auto-deleted any email containing the words "invoice," "payment," or "bank," so the finance team's warning emails to him vanished before he saw them. They caught it only when a vendor called about an overdue amount that had actually been paid to the wrong account.

Here's the exact sequence we ran on their M365 Business Standard tenant, adding a Defender P1 layer. Any competent MSP can follow the same path.

1. Enforce MFA for all users via Conditional Access. We disabled legacy authentication protocols (POP, IMAP, SMTP basic auth) that bypass MFA entirely. This one step closes a door most SMBs leave wide open.
2. Rolled out Microsoft Authenticator with number matching. No SMS OTP as primary. We pushed number-matching so users can't blindly approve a fatigue-attack prompt.
3. Published SPF, DKIM, and DMARC. We started DMARC at p=none to monitor for two weeks, reviewed the reports, then moved to p=quarantine and finally p=reject. This stopped anyone spoofing their domain to their own customers.
4. Turned on Safe Links and Safe Attachments in Defender so links get scanned at click-time and attachments are detonated in a sandbox before delivery.
5. Configured anti-impersonation policies protecting the MD, the CFO, and the operations head by name, plus the company's own domain and its top three vendor domains. Emails claiming to be from these but failing checks now get flagged or quarantined.
6. Blocked auto-forwarding to external domains and set an alert for any new inbox rule that deletes or forwards mail. This directly kills the trick that hid the attacker last time.
7. Enabled unified audit logging and sign-in alerts for impossible-travel and unfamiliar-location logins. A login from Lagos two hours after one from Pune now triggers a review.
8. Ran a simulated phishing campaign against all staff, then targeted training for the 30% who clicked.
9. Wrote a payment-verification policy: any change to vendor bank details requires a callback to a previously known phone number, never a number supplied in the email. This is the single most effective anti-BEC control and it costs nothing.

Total additional spend: about ₹6,600/month for the Defender add-on across 40 users, plus a one-time setup and training engagement. Against a ₹28 lakh potential loss, the ROI conversation is short. This kind of layered rollout is core to our IT consulting and broader managed services work.

Which settings should every SMB turn on this week?

If you do nothing else after reading this, do these. In priority order:

• Enforce MFA for 100% of users and disable legacy auth. In Google Workspace, enforce 2-Step Verification and consider security keys for admins.
• Publish DMARC and set it to p=reject once you've confirmed your legitimate mail sources pass. Include your marketing and invoicing tools in SPF/DKIM first.
• Block external auto-forwarding at the tenant level.
• Add impersonation protection for finance, directors, and top vendors.
• Protect admin accounts hardest. Separate admin accounts from daily-use mailboxes, and use phishing-resistant MFA for them.
• Turn on sign-in and inbox-rule alerts.

Pro Tip: Create a dedicated "invoices@" or "accounts@" shared mailbox with restricted access and monitor it closely, rather than letting vendor payments land in one person's personal inbox. When that person is on leave or leaves the company, the payment trail doesn't disappear, and you can apply tighter rules to a single high-risk mailbox.

How do you defend against BEC when the email is technically legitimate?

This is the hard part, and it's where pure technology fails. When an attacker has compromised your vendor's real mailbox, no spam filter will save you because the email genuinely came from them. Defense here is process, not software.

Build a payment control that doesn't rely on email

• Out-of-band verification: Any request to change bank details or make an urgent unusual payment must be confirmed by phone to a number you already have on file, not one from the email.
• Dual approval for transfers above a threshold, say ₹2 lakh. Two people, two devices.
• Cooling-off for new payees: A newly added beneficiary can't receive a large payment for 24 hours.
• Flag the language: Urgency, secrecy, and "don't call me, I'm in a meeting" are the tells. Train staff that these are red flags regardless of who the email appears to be from.

We often pair this with a WhatsApp Business API or SMS-based confirmation workflow so payment approvals leave a clean, timestamped trail outside the email channel entirely. For companies with heavier automation needs, an AI voicebot callback to verify large payments is becoming a realistic option too.

What about compliance, DPDP, and keeping records?

India's Digital Personal Data Protection Act adds a real obligation: if a mailbox breach exposes customer personal data, you may be required to notify affected individuals and the Data Protection Board. A compromised mailbox often contains PAN details, addresses, and financial data of your customers. That turns a "we caught it, no money lost" incident into a potential reporting event.

Practical steps that also help you here:

• Keep audit logs enabled and retained. In M365 this means turning on unified audit logging, which is not on by default in older tenants.
• Document your incident response steps before you need them.
• Apply retention and legal-hold policies so evidence isn't auto-deleted.
• Restrict who can access customer PII within mailboxes and shared drives.

If you're a manufacturer or exporter modernising your systems anyway, folding email security into a wider plan makes sense. Our digital transformation playbook for Indian manufacturers covers how this fits alongside ERP and cloud moves, and our cloud migration and managed services team handles the plumbing.

Should you consider a third-party email security layer?

For most SMBs, a well-configured M365 Business Premium or Google Workspace with 2SV enforcement is enough. But if you handle large payments daily, work with hundreds of vendors, or have already been hit once, a dedicated add-on gateway (products like Proofpoint, Mimecast, or lighter tools like Avanan-style API filters) adds a valuable second brain. They're stronger on impersonation detection and post-delivery clawback than native tools.

The trade-off is cost, typically ₹250 to ₹600 per user per month on top of your platform licence, and added complexity. Don't buy one until you've turned on everything free that's already sitting in your tenant. Most breaches I investigate would have been stopped by settings the company already paid for and never enabled.

If you're weighing platforms and add-ons together, our take on Zoho vs Google Workspace vs Microsoft 365 is worth a read, and if you're wary of getting locked into one ecosystem, see our multi-cloud exit strategy guide.

Frequently asked questions

Does MFA fully protect Microsoft 365 from phishing?

No. MFA stops the vast majority of basic credential theft, but modern phishing kits can relay your MFA code in real time or bombard you with approval prompts until you click "yes." Use phishing-resistant methods like number matching, authenticator apps, or security keys, and never SMS OTP alone for admin accounts.

What is DMARC and do I really need it for my small business?

DMARC is a DNS record that tells receiving mail servers what to do with email that fakes your domain. Yes, you need it. Without a p=reject policy, anyone can spoof your company's address to phish your own customers, and you'll never even know it's happening.

How do I know if my mailbox has already been compromised?

Warning signs include inbox rules you didn't create (especially ones deleting or forwarding mail), sign-ins from unfamiliar countries, contacts reporting odd emails from you, or sent items you don't recognise. Enable audit logging and sign-in alerts so you're notified automatically rather than finding out from an angry vendor.

Is Google Workspace safer than Microsoft 365 for email security?

Neither is inherently safer. Google Workspace has strong native protections and simpler defaults, while Microsoft 365 offers deeper, more configurable controls through Defender at higher tiers. The bigger factor is how well you configure whichever you choose, not the brand.

How much should a 25-person Indian SMB budget for email security?

Roughly ₹9,000 to ₹22,000 per month depending on whether you go with Business Standard plus a Defender add-on or full Business Premium, plus GST. Add a one-time setup and staff training cost. That's a fraction of a single successful BEC loss, which routinely runs into several lakhs.

Can we prevent BEC with software alone?

Not entirely. When an attacker uses a genuinely compromised vendor mailbox, the email is technically legitimate and passes all filters. The reliable defence is a process control: verify any bank-detail change or urgent payment by phone using a known number, and require dual approval above a set amount.

Do these email attacks fall under DPDP reporting rules?

They can. If a breached mailbox exposes personal data of your customers or employees, the Digital Personal Data Protection Act may require you to notify affected individuals and the Data Protection Board. Keeping audit logs and having a documented response plan makes handling such an event far less painful.

The bottom line

Email is still where your money and your trust live, and it's the channel attackers know best. The good news is that strong Microsoft 365 email security for SMBs is mostly about turning on and tuning what you already own, then wrapping a simple human process around payments. MFA everywhere, DMARC at reject, impersonation protection for your finance and leadership team, alerts on suspicious behaviour, and a strict callback rule for bank-detail changes. That stack alone would have stopped the Surat exporter's near-miss and the Pune firm's breach.

If you'd like help auditing your current tenant, closing the gaps, and getting the right licences without overpaying, our team does exactly this for Indian SMBs every week. Reach out through our contact page or read more about how we work. Spend a fraction of one fraudulent invoice now, and sleep a lot better later.

Image credit: People and perceptions of technology by renaissancechambara via flickr (BY 2.0), sourced through Openverse.