Cyber security is no longer just a topic for IT people. Today, it is mainly about protecting the money in your business account. Fraudsters now use artificial intelligence, so their messages look genuine. A single payment to the wrong account can cost more than a year of accountancy fees. In many cases, that money is never recovered. Below, we show how to spot the new types of scam. We also explain which simple rules protect a business and what to do if something goes wrong.
Cyber security for small businesses – Contents
- Why is cyber security for small businesses now a financial issue?
- How has AI changed the scams aimed at small businesses?
- Which scams most often target small business owners in the UK?
- Cyber security and HMRC payments: what should you watch out for?
- What basic protection should cyber security for small businesses include?
- How do you set safe payment rules in a small business?
- Is it safe to use AI tools with client data and finances?
- Cyber security and UK GDPR: what do you owe the ICO?
- What should you do when cyber security for small businesses fails?
- How can Lidertax help with your cyber security?
- Frequently asked questions
Why is cyber security for small businesses now a financial issue?
In May 2026, the Information Commissioner’s Office (ICO) published a warning for businesses. It said that criminals are using AI more and more. As a result, their attacks are faster, more polished and harder to detect. Importantly, the target is rarely the computer itself. Criminals are after money, client data and access to accounts.
A small business is an easy target for fraudsters. It usually has no IT department and no written procedures. Often, one person issues invoices, pays suppliers and deals with tax. That means fooling just one person is enough for the money to disappear. In other words, digital risk has become ordinary financial risk. You need to manage it just as you manage cash flow or HMRC deadlines.
How has AI changed the scams aimed at small businesses?
A few years ago, a fake email was easy to spot. It had spelling mistakes, odd phrases and a generic greeting. AI has removed those warning signs. Today, a fraudster can scan your website, LinkedIn and social media in minutes. Then they write a message with real names, a real supplier and a genuine order number. The tone sounds like someone you know well.
You are most likely to come across four techniques:
- Personalised phishing. The message looks like an email from a client, supplier or accountant.
- Voice cloning. A short recording is all it takes, such as a Facebook video or a voicemail greeting.
- Fake video calls. The face and voice of someone you know can now be convincingly faked.
- Copied documents. The invoice has the real logo, layout and reference numbers. Only the bank details change.
In practice, this means one thing. Replying to an email no longer counts as a check, because AI can hold a convincing conversation. So what matters is not how a message looks, but what it asks you to do.
Which scams most often target small business owners in the UK?
Fraudsters rely on a handful of proven tricks. Each one plays on trust and urgency.
- Fake tax refund. A text or email says HMRC owes you a refund. The link leads to a page that steals your card or login details.
- Threat of an HMRC penalty. A message or call threatens a fine, or even arrest. The caller then demands immediate payment.
- Fake Companies House email. It asks you to update company details urgently or pay an extra fee. Increasingly, fraudsters also send fake identity verification requests. Genuine Companies House emails end in .gov.uk.
- Invoice with new bank details. A regular supplier supposedly switches banks. The invoice looks exactly like the previous ones.
- Urgent request from the boss. A director apparently writes from the airport and asks for a quick transfer. The matter is “confidential”, so you must not ask anyone.
- Change of salary account. An employee asks the payroll team for new bank details just before payday. In reality, a fraudster is writing from a hacked mailbox.
Picture this situation. A building firm owner receives an invoice from a builders’ merchant for £8,400. The email looks familiar, and only the account number has changed. A two minute call to the merchant on a known number saves the whole amount. Have you received a suspicious message about tax or invoices? Contact us before you pay, and we will help you check whether it is genuine.
Cyber security and HMRC payments: what should you watch out for?
Fraudsters very often pretend to be HMRC. According to HMRC, it received over 170,000 scam reports in the 12 months to 31 July 2025.
The rule is simple. According to HMRC, it never contacts you by email, text or phone about a tax refund. It also never asks for personal or financial details by email or text. Nor does it leave voicemails threatening legal action or arrest. Apart from tax reminders on the official government channel, HMRC does not use WhatsApp.
Genuine HMRC emails end in gov.uk, for example @hmrc.gov.uk. However, the sender’s address alone proves nothing, since fraudsters can fake it. You can claim a tax refund safely through your HMRC online account or the HMRC app.
Pay tax only through the GOV.UK website, and type the address in yourself. Never click links in messages. Check your payment reference in your HMRC account or in a letter from HMRC.
This matters for our clients. From 20 October 2026, Lidertax no longer pays tax on clients’ behalf. You now pay VAT, Corporation Tax, CIS, PAYE and NI yourself. Therefore, it is up to you to tell a genuine demand from a fake one. If in doubt, ask us before you make the payment.
Report suspicious messages directly to HMRC:
- forward emails to [email protected],
- send texts to 60599,
- take a screenshot of a WhatsApp message and send it to [email protected],
- report a suspicious phone call using the form on GOV.UK.
You can forward other suspicious texts to 7726. Suspicious emails not related to HMRC should go to [email protected].
What basic protection should cyber security for small businesses include?
According to the ICO, most successful attacks exploit simple oversights. Fortunately, basic protection costs almost nothing.
- A separate password for every account. If one password leaks, it will not open your other accounts. A password manager remembers them for you.
- Two step verification wherever possible. Start with email, online banking, your accounting software and your HMRC account.
- A separate login for each person. Shared accounts make it hard to see who changed what in the system.
- Access only to what each person needs. Someone who handles invoices does not need access to online banking. When an employee leaves, remove their access straight away.
- Regular updates. AI tools quickly find known gaps in software. For this reason, install updates without delay.
Businesses that want to go further can consider Cyber Essentials certification. It is an NCSC scheme covering five basic technical controls. The ICO expects businesses that handle personal data to have them in place. Not sure who in your business can access the bank account and accounting software? Book a free consultation, and we will help you sort it out.
How do you set safe payment rules in a small business?
This is the most important part of your protection. Rule number one is this: check every request for money or new bank details through a different channel. There are no exceptions, even when the request comes from the boss.
- Confirm every change of bank details by phone. Call a number you already have, never one from the message.
- Set a payment threshold. A second person must always approve any transfer above an agreed amount.
- Agree a code word. Choose a word that only your team knows. Ask for it whenever a conversation involves money or access.
- Never cut corners under pressure. Urgency, secrecy and pressure from a manager are classic signs of fraud.
- Watch for a change of channel. Does a conversation that started by email suddenly move to WhatsApp? That is a reason for caution.
Let’s put it simply. A phone check takes two minutes. On the other hand, a £12,000 payment to the wrong account can mean months of trying to get it back.
Since October 2024, UK banks have had to reimburse APP fraud losses of up to £85,000. APP fraud covers payments that the victim made themselves after being tricked. The protection applies to consumers, micro-enterprises and charities. However, it only covers Faster Payments and CHAPS transfers within the UK. Card payments and international transfers are not included. Even so, a bank can refuse a refund if it decides the business was grossly negligent. That is why written payment rules protect you twice. They reduce the risk of fraud, and they show the bank that you acted sensibly.
Is it safe to use AI tools with client data and finances?
Not every risk comes from fraudsters. Some of it stems from everyday habits that seem completely harmless. Many people paste client emails, invoices or financial reports into free AI tools. They want a quick summary or a tidier version. Depending on the settings, though, the tool may store that data or use it to train the model.
- Choose specific tools for the business. Check their privacy settings and switch off data sharing for training.
- Do not paste personal data into free tools. This includes client and staff details, bank account numbers and NI numbers.
- Set simple rules for your team. To begin with, one page listing the approved tools is enough.
In addition, remember that you are responsible for your clients’ data. You cannot pass that responsibility on to the AI tool provider.
Cyber security and UK GDPR: what do you owe the ICO?
Every business that holds client or employee data is subject to UK GDPR. This also applies to a small limited company and to sole traders.
The law requires appropriate technical and organisational security measures. Among other things, the ICO points to the following steps:
- Data minimisation. Keep only the data you really need. The less data you hold, the less there is to steal.
- Regular data reviews. Know what data you have, where you store it and who can access it.
- Staff training. Your team should be able to recognise phishing, cloned voices and fake video calls.
- Encryption. Encrypted data limits the damage if a breach happens.
Many businesses must also pay an annual data protection fee to the ICO. For the smallest organisations, it is currently £52. You can check whether you need to pay using the calculator on the ICO website. If a data breach puts people at risk, you must report it to the ICO. Do so without undue delay, and no later than 72 hours after you discover it. Weak security or a late report can lead to a fine and a loss of client trust.
What should you do when cyber security for small businesses fails?
Act straight away, even if you are not sure what has happened. Every hour of delay reduces the chance of getting the money back.
- Call your bank. Report the suspicious payment and ask the bank to block further payments. Use the number on your card, or dial 159 to reach your bank.
- Change your passwords. Start with your email, because fraudsters use it to reset your other accounts.
- Report the fraud to Report Fraud. In December 2025, this service replaced Action Fraud in England, Wales and Northern Ireland. Its helpline is 0300 123 2040. In Scotland, contact Police Scotland on 101.
- Check whether personal data has leaked. If it has, assess the risk and report the breach to the ICO within 72 hours where required.
- Tell your team and your accountant. A scam that worked once often comes back in a different form. Your accountant can also record the loss correctly in your books.
At this stage, keep all the evidence: emails, texts, screenshots and payment confirmations. Your bank, the police and your insurer will all need them.
How can Lidertax help with your cyber security?
Fraudsters do not need to break into your systems. One rushed payment is enough for them. Therefore, the best protection is a set of simple rules that the whole team follows consistently. As an accountancy firm, we cannot replace an IT specialist. We do, however, know your company’s finances, your HMRC payments and how your invoices flow. During a free consultation, we can help you:
- check who has access to your bank account, accounting software and HMRC account,
- set safe rules for approving payments,
- assess suspicious messages about tax and invoices,
- find out whether your business needs to pay the ICO fee.
Book a free consultation with Lidertax in Chatham today. We work with businesses across Medway and Kent. Email [email protected] or use the contact form on our website. A few minutes of conversation could save your business thousands of pounds.
Frequently asked questions
HMRC never contacts you by email, text or phone about a tax refund. It also never asks for personal or financial details by email or text. Forward any suspicious message to [email protected].
Call your bank immediately and ask it to stop the funds. Then report the case to Report Fraud and keep all the evidence.
UK banks must reimburse APP fraud losses of up to £85,000 if you paid by Faster Payments or CHAPS. The protection covers consumers, micro-enterprises and charities. However, a bank can refuse a refund in cases of gross negligence.
Yes, if the breach puts the people whose data is involved at risk. You must report it without undue delay, and within 72 hours of discovering it at the latest.
We do not recommend doing this with free versions of AI tools. They may store data or use it to train their models. Choose tools with suitable privacy settings and set clear rules for your team.
