Nice2GeekYou

56% of Small Businesses Were Hit Last Year — Fake Invoices and Payment Requests Lead the Way

The 2026 Hiscox Cyber Readiness Report says 56% of U.S. small businesses had at least one cyberattack in the past year. The cheapest fix for the most expensive scam is a callback rule.

  • business-email-compromise
  • phishing
  • payment-fraud
  • mfa
  • cybersecurity
  • msp
  • smb
  • texas-it
  • managed-it

More than half of U.S. small businesses (56%) had at least one cyberattack in the past year, according to the 2026 Hiscox Cyber Readiness Report, as covered this week by the Rochester Business Journal. Security experts quoted in that piece say the most common threats are phishing, business email compromise (BEC), supply-chain attacks and ransomware, and that AI is making impersonation far more convincing.

The pattern is simple: a message that looks like it's from the owner, the CFO or a regular vendor asks for a payment, a "new" bank account, or a login. One example from the article: a fraudulent transfer went out on a Friday afternoon, was discovered the next day, and the money was already overseas. The two employees involved had worked together for over 20 years.

It's not just email anymore

Verizon's 2026 Data Breach Investigations Report, summarized by Guard Street, found that phishing delivered by phone call or text had a 40% higher median click rate than email. Staff have gotten better at spotting bad emails, so attackers moved to the phone in everyone's pocket. The same report found unpatched systems are now the most common way in (31% of breaches) and third-party/vendor involvement rose to 48% of breaches.

The 15-minute fix: a callback rule

You don't need a big budget to stop the most expensive scam. You need a process everyone follows.

  1. Write a one-line rule. Any request to send money, change bank details, or share a password gets verified by calling a known number — never the number in the email or text.
  2. Require two people for new payees. One person enters a new vendor or bank account, a second person approves it.
  3. Turn on MFA for email, banking, payroll and any remote access first. These are built into Microsoft 365 and Google Workspace — use them.
  4. Slow down on Fridays. Urgent end-of-week payment requests are a classic pressure tactic. If it can't wait until Monday, it gets a phone call.
  5. Be honest on cyber insurance forms. If you aren't sure a control is in place, answer "no." Inaccurate answers can put a claim at risk.

For South Texas teams on-site: print the callback rule and tape it next to whoever pays the bills, and make sure the office phone list for vendors is current. For remote-managed teams nationwide: ask your MSP to confirm MFA is enforced on every finance and admin account and that spam filtering flags lookalike domains.

Nice2GeekYou is based in San Antonio, serving all of Texas, and our managed IT plans help remote clients across the U.S. with MFA rollout, email security, monitoring and staff training. Request a quote or see our monthly plans.

Sources: Rochester Business Journal — More than half of US small businesses face cyberattacks (citing the 2026 Hiscox Cyber Readiness Report); Guard Street — Three ways attackers are getting into mid-market companies (citing Verizon's 2026 DBIR).