Is my business too small to be hacked?

Is my business too small to be hacked? No. Most scams and break-ins aren't aimed at a business because it is big or famous; they go out to thousands of inboxes at once and land wherever a password is weak or an invoice gets paid without a phone call. Being small mostly means there is nobody to double-check.

Why small businesses still get hit

Scammers want two things almost every business has: an email account that sends invoices, and money that moves by bank transfer.

  • Fake invoices. False billing was the scam Australian small businesses reported most to Scamwatch in 2025, according to the National Anti-Scam Centre. Small businesses lodged 2,228 scam reports that year; 287 of them involved losses, totalling $9.5 million.
  • Taken-over email. Business email compromise was among the most common cybercrimes businesses reported to the Australian Signals Directorate in 2024 to 2025.
  • The cost when it lands. The average self-reported cost of a cybercrime for a small business was $56,600 per report in 2024 to 2025 (a self-reported average; many cases cost far less), according to the Australian Signals Directorate.

None of that needs anyone to know your name. It needs one password, or one payment made on a busy afternoon.

What it looks like for a small business

You run a three-person bookkeeping practice. Nobody has ever heard of you outside your suburb, which is how you like it. One morning a client rings to ask why your invoice has a new bank account on it. You didn't send it. Someone signed in to your email weeks ago with a password you'd reused, watched quietly, and waited for invoice week. The client has already paid. The money is gone, you still need it, and the client now wonders what else in your inbox someone has read. The code on your phone that would have stopped the sign-in takes about ten minutes to switch on.

Do this today, member or not

  1. Turn on multi-factor sign-in for your email. Signing in then needs a code from your phone as well as your password, so a thief who has your password still can't get in. Then do your banking and accounting software. About ten minutes each; the government's guide walks you through it.
  2. Make "ring them first, then pay" your rule. When a supplier's bank details change, ring them on a number you already have before you pay a cent.
  3. Turn on automatic updates on every computer and phone, then restart the one you've been putting off.
  4. Back up your files somewhere a thief can't delete. If you could delete your own backup from your laptop, so could someone with your password. Look for a backup service that keeps older copies you can't delete from your own computer.

Multi-factor sign-in, updates and backups are the three things the Australian Cyber Security Centre tells small businesses to start with. None of them need you to be technical.

If you'd rather it was simply done

WISECLICK is a cybersecurity membership for Australian businesses of one to five people, from $59 a month. It looks after the parts that slip when you're busy.

  • Protection someone watches. Security software runs on each computer and a phone, and every alert comes to our team as it happens. We work out what happened and fix it, and the fix is part of the membership.
  • Backups nobody can touch. Your files are backed up every day and locked, so not even someone with your password can delete or change them. Every new backup renews the lock on everything still on your computer, and anything you delete can be brought back for sixty days. We do the restore for you.
  • A second opinion on odd invoices. Forward anything that looks off, and a person checks it and replies the same business day.

AUD, GST included. Cancel any time.

See membership plans

Or start with your Cyber Report Card

Questions

Why would anyone bother with a business my size?

Because it isn't much bother. The same fake invoice or password guess goes to thousands of businesses at once, and small ones are less likely to have someone checking.

I've never been hacked. Doesn't that mean I'm fine?

Not necessarily. Someone in your email can sit quietly for weeks before they act, so "nothing has happened" and "nothing is happening" aren't the same thing.

What is the single most useful thing I can do?

Turn on multi-factor sign-in for your email. Then a stolen password on its own isn't enough to get in.

Who's behind it

WISECLICK (wise.click) is a cybersecurity membership for Australian businesses of one to five people. WISECLICK Pty Ltd is a Sydney company at 56 Pitt Street, built by people who have run IT for Australian businesses since 2004.

Sources

Last reviewed 29 October 2026. The bookkeeping practice is an illustration, not a member's case.

Related