If Google and Facebook can get scammed, how do you protect a small business?

After learning that Facebook and Google were conned out of $100m in a sophisticated phishing scam, you’d be forgiven for wondering what hope the rest of us have. If these tech giants can’t protect themselves, how are small business owners supposed to?It’s a story I see often. The con was the well thought out work of a confidence trickster. Evaldas Rimasauskas is alleged to have duped Facebook and Google employees into transferring money to accounts he owned, rather than the Taiwanese electronics manufacturer to whom they actually owed money. The technique used is known as phishing, which can be as simple as a fraudulent email requesting assistance.

According to the UK government cyber security research published recently, 52% of small businesses have experienced some form of cyber security breach over the past 12 months. Fraudulent emails are “by far the most common breach experienced”, in 72% of cases.

A routine phishing scam might involve a criminal impersonating a supplier, faking a familiar email address or faking an invoice to the accounting department. When done correctly, phishing scams are extremely difficult to detect and can be extremely effective. Why? Because of the way the human brain works.

The limitless nature of obedience

When you know a little about human psychology, it’s not such a daunting task to defraud two of the world’s largest tech companies.

In the 1960s, Yale psychologist Stanley Milgram, led an experiment to study the limits of human obedience. In this case, a nominated teacher would ask a learner a series of questions. Following an incorrect answer, the teacher would administer the learner with an electric shock, the severity of which increased up to an extremely painful 450 volts.

All of the participants were given the role of the teacher, in charge of administering the shocks under the direction of the experimenter. What they didn’t know was the learner was an actor who was pretending to receive the shocks.

Before starting the experiment, researchers predicted less than 3% of participants would administer the final 450-volt shock to their victims. But incredibly, 65% went through with it – demonstrating just how obedient humans can be.

The Milgram experiment does a lot to explain why phishing scams work. When asked, humans often go out of their way to comply with requests. After almost two decades gathering military intelligence, I know that even the world’s most cold-blooded terrorists respond to fraudulent phishing requests.

The bad news is inherent human psychology isn’t going to change anytime soon. The good news is it can be controlled – and even harnessed – to increase cyber resilience.

1. Make use of technology

Technology alone will not completely protect your business from cyber crime, but the spam and security filters built into many email systems and security products will intercept mass phishing attempts and block emails with malware attached. Ensure these are fully utilised, updated, and that staff are trained to use them.

2. Establish a security conscious culture

Introducing regular security awareness training will help staff understand how phishing occurs and how their everyday behaviour affects the security of their personal affairs and the company.

Take care to explain the logic behind maintaining proper security. This eases cognitive dissonance, which arises when people believe one thing but are told to act in another way entirely. If employees believe passwords consisting of random strings of capitals, symbols and numbers are overkill, you’re always going to have insecure passwords like Password1, regardless of your security guidelines.

3. Set up an early warning system

Phishing attempts rely on building up a profile of the business and its stakeholders, often engaging multiple people.

Encourage the team to question any unusual or suspicious instructions from colleagues, clients, suppliers – and even managers – without fear of reprisal. Some of the most effective phishing attempts involve attackers impersonating senior staff, when a trusting employee will obediently send over whatever information is being requested. If a member of staff finds out an email is not from the person it claimed to be, they must report it immediately. Likewise if they think they may have disclosed personal or sensitive data, so action can be taken to limit the effects.

4. Revisit social media policies

Fraudulent emails may include personalised and plausible information, which is often gleaned from social media profiles and posts. Hackers may also send friend requests to gain access to information, or messages impersonating a colleague or stakeholder.

Businesses should implement clear social media guidelines that highlight what can be shared and the details they should keep away from social media.

5. Don’t trust the phone

Phishing is not only an information technology phenomenon, but a criminal activity that exploits human behaviour – and they may use the telephone to verify or collect information. These attempts can sound very plausible and take businesses by surprise.

Employees must be trained to verify a caller’s identity even if he or she purports to be a senior colleague, supplier or client. They should not be afraid to end the call or refer it to a colleague if they have any suspicions that the caller is not who they say they are.

Oz Alashe is the CEO and founder at CybSafe.

Sign up to become a member of the Guardian Small Business Network here for more advice, insight and best practice direct to your inbox.