The broader context — why being small makes you vulnerable. A small business does not mean a small risk.
I remember that my father, who spent his whole life repairing cars in a neighbourhood garage, always used to say that a thief doesn't break into houses with big dogs — he breaks into the ones with a low fence and the lights off. He was not a man given to elaborate metaphors; he was a man of mechanics, of tangible things, of direct cause and effect. 
If something wasn't working, you found the cause, you fixed it, you moved on. He knew nothing about cybersecurity, had never heard of Business Email Compromise, had never read any FTC report about the scams battering SMEs across America and Europe alike. But he had understood something fundamental about the nature of vulnerability: that nobody attacks you where you are strong and prepared — they attack you where you are distracted, rushed, tired, and above all, where you believe you are too small to matter.
I run a small firm. Based in Botoșani, in north-eastern Romania, a region that Bucharest systematically ignores and that investment maps pass through without stopping. I build websites for town halls, hospitals, schools, and private companies that have come to understand that existing on the internet is no longer a luxury — it is a condition of survival. I have clients who ask for quotes on European-funded projects and clients who negotiate the price of an SSL certificate with me as if they were haggling over tomatoes at a market. And within this entire spectrum of daily reality — invoices, contracts, emails, deadlines, deliverables, DNSC [National Directorate of Cyber Security] vulnerability reports, GDPR compliance, NIS2, Law 232 — I have discovered, particularly over the last two years, that I am not merely a provider of digital services. I am also a target.
Not a large, spectacular target of the kind that makes the news. Not a company with hundreds of employees, not a bank, not an operator of critical infrastructure. I am precisely the type of target that digital fraudsters prefer precisely because it is small, precisely because it has no IT department with twenty people and a well-paid CISO, precisely because behind the firm there is a single person who, at ten o'clock in the evening, is answering emails whilst his teenage son asks him to watch something together on YouTube, and the cat — Gri, a grey cat with the temperament of a Stoic philosopher — sleeps on the laptop keyboard with an indifference that is almost insulting towards the problems of the digital world.
Why does being small make you vulnerable?
The inverse visibility of the small
There is a widely held belief, almost consoling in its simplicity, that small firms are safe because they are not worth the attention of a sophisticated cybercriminal. That large, coordinated attacks, with complex malware and elaborate social-engineering operations, are reserved for corporations, banks, and government ministries. That the digital fraudster is a kind of wolf that attacks the herd, not the lone sheep on the margins.
Reality is precisely the opposite, and this is the first lesson you must absorb if you are a small or medium-sized entrepreneur in Romania in 2026.
Small firms are preferred precisely because they are small. Because they have no formal invoice-verification processes. Because the director, the accountant, and the IT person are often the same individual. Because work moves quickly, in flow, with trust extended on the basis of habit rather than protocol. Because an email that apparently comes from a supplier you have worked with for three years is read differently from an email by a stranger — it is read with the ease with which you read a message from someone familiar, without the critical filter you automatically activate for the unknown.
And the modern fraudster — who is no longer necessarily a hooded hacker in a dark basement, but may instead be a well-organised operation running out of a call centre in West Africa, Eastern Europe, or South-East Asia — knows this. They have studied it. They have industrialised it. They send thousands of perfectly calibrated emails, with copied logos, with the right tone, with plausible sums, waiting for one in ten, one in a hundred, to slip through the human filter of someone caught between a meeting and a cold cup of coffee.
My Botoșani and the economics of vulnerability
If we are talking about north-eastern Romania, we are talking about an economic territory with specific characteristics that amplify vulnerability: small firms operating on very tight margins, European funds introducing unusually large sums of money into the local economic circuit for local actors, public institutions with understaffed personnel managing complex contracts, and an organisational culture in which personal relationships take precedence over formal procedure. You know someone, you have worked with someone, you recognise their voice on the phone — and so when an email arrives from them, it never occurs to you to ring and verify. Why would you? It's them. Or it seems to be them.
This is the fertile ground on which digital fraud targeting SMEs flourishes: not brute ignorance, but precisely the trust built over time, converted into inattention.
I have spoken with local entrepreneurs — serious people, with real businesses, with decades of experience in their fields — who have received forged invoices from cloned suppliers, who have transferred money to the wrong accounts because the email looked identical to that of a long-standing partner, who have clicked on links that looked exactly like the ANAF [National Agency for Fiscal Administration] portal or their bank's internet banking platform. Some realised in time. Others did not.
Vulnerability as a state of mind, not merely a technical gap
The mistake many small entrepreneurs make when they hear about cybersecurity is that they immediately turn it into a technical problem. If I have a good antivirus, a firewall, if I update WordPress or Joomla — I'm fine. And that is partly true and partly a comfortable illusion.
The most effective scams that hit small firms do not pass through a code vulnerability, through a zero-day exploit, or through a sophisticated technical attack. They pass through the human. Through the human's haste, their fatigue, their trust, their embarrassment at seeming distrustful of a longstanding partner. Social engineering — the art of manipulating people, not systems — is the modern fraudster's preferred instrument when targeting SMEs, because it is cheap, scalable, and extraordinarily effective.
There is a Romanian proverb that everyone knows and that we apply in daily life with curious selectivity: omul sfințește locul — the man makes the place [translator's note: roughly equivalent to 'people make places great']. And it is true in both directions — a person can elevate a place, but they can also compromise it. No technical infrastructure can withstand a person caught in a moment of inattention, haste, or artificial emotional pressure created by a skilled fraudster.
The first step: recognising that you are a target
I am not saying this to generate anxiety — anxiety is, in fact, the enemy of security, because it paralyses rather than mobilises. I am saying it because the first pragmatic, concrete, immediately applicable step is a shift in mental framing: from I am too small to matter to I am exactly the right size for this type of attack.
My father repaired cars and knew that a low fence invites the thief. He did not put up a three-metre wall — he couldn't afford it and it wasn't necessary. But he got a dog, kept a light on, knew his neighbours, and learned to recognise new faces in the street. Security proportionate to the size, but real security.
That is the logic I try to build in my own firm, and in the advice I give to the clients I work with: not paranoia, not corporate infrastructure, but consistent digital hygiene, simple procedures applied systematically, and above all the habit of pausing for three seconds before any action involving money, data, or access.
Three seconds. That is all it costs. And sometimes, those three seconds are worth more than the entire firm.
In the following sections we shall go into the concrete details of the most common types of scam hitting small firms in 2025–2026, we shall dissect their psychological mechanisms, and we shall build step by step a set of habits and procedures that any entrepreneur — whether working alone or with a small team — can implement without large resources and without advanced technical knowledge. But the foundation is what is laid here: knowing that you are a target is half the defence.
The Anatomy of the Scam — the most common patterns
The invoice that wasn't an invoice, the email that wasn't from who you thought
It was a Tuesday, somewhere around two in the afternoon, when the email arrived. I no longer remember the exact date, but I know it was a Tuesday because on Tuesdays I typically have my most congested schedule — it is the day when everything left over from Monday accumulates, when all the urgencies put off over the weekend pile up, all the emails I promised I would answer in the morning and never got to because the morning brought others. I was sitting at my desk with a coffee I had reheated twice in the microwave, which had reached that ungrateful temperature at which it is neither hot nor cold, merely present, inert, like a liquid rebuke. Gri was sleeping on the chair to my right, with her back to the monitor, her spine arched in that comma shape cats adopt when they have decided the world no longer merits their attention.
The email looked perfect. The supplier's logo was correct, the sender's name was the one I knew, the sum was plausible — not enormous, not suspicious, but precisely in the range where you don't ask questions, you tick it off and forward it to the accountant. Thirty-six thousand lei for hosting and infrastructure services, with a payment deadline of two days. And a single changed detail: the bank account. A new IBAN, with an explanation in the body of the email — we've changed banks, please update in your system.
I sat with my hand on the mouse for about ten seconds. Ten seconds in which something — I don't know what to call it, a slight dissonance, a small sound in the background, like when an engine sounds imperceptibly different from how it sounded yesterday — stopped me. I rang the supplier. On the number in my phone, not the one in the email. And he knew nothing about any email, any new IBAN, anything at all.
That is all that scam cost: a phone call of three minutes and thirty seconds, according to the call log I checked afterwards.
What social engineering applied to small businesses actually is
The term social engineering sounds technical, almost academic, which is precisely why I avoid it in conversations with my clients in the public sector — with the town halls, the hospitals, the school heads who look at me when I talk about NIS2 and Government Emergency Ordinance 155 with the same expression you give someone trying to sell you something you don't understand. I prefer to say it differently: it is the art of making you do something you would not do if you had time to think. It is the manipulation of thought through emotional context, not technical force.
The fraudster targeting a small firm does not attack the server. They don't need to. They attack the person behind the server. They attack their fatigue on a Thursday afternoon, their embarrassment at seeming distrustful of a longstanding partner, their rush to tick off an invoice before going to collect their child from school, their anxiety that if they don't pay on time they'll lose an essential supplier. And they do this with tools that cost almost nothing — a cloned domain, a copied logo, a few carefully written lines of text, and the patience to wait for the right moment.
There are three major patterns, three anatomies of fraud that recur most frequently in the landscape of attacks on SMEs, and I shall dissect each one in turn — not abstractly, but starting from what I have seen, what I have heard from other entrepreneurs, what I have identified in my day-to-day work with clients who ask me to make their websites compliant, secure, visible — and, by extension, vulnerable to everything that is visible on the internet.
Pattern 1 — The forged invoice: exploiting routine
The forged invoice is probably the oldest trick in the manual, and precisely for that reason it is the most effective. It is based on something deeply human: routine. When you do the same thing often enough, your brain constructs a shortcut — a fast, automatic route that bypasses verification because verification has confirmed a hundred times over that everything is in order. And the fraudster knows this. They have studied it. Sometimes literally — there are attacks in which criminals monitor a firm's emails for weeks before acting, identifying the rhythm of payments, recurring suppliers, usual amounts, and the communication style of the legitimate sender.
The forged invoice typically comes from a domain almost identical to that of the real supplier. Not supplier.co.uk, but supplier-uk.com or supplierr.co.uk or invoicing.supplier.co.uk — a minor variation you don't notice when you are tired, rushed, or looking at the screen from the corner of your eye whilst talking on the phone with someone else. The sum is calibrated to be plausible — not a hundred thousand euros that would automatically trigger alarm bells, but a sum within the normal range of the commercial relationship. And there is almost always an element of urgency: due today, late payment penalties, service will be interrupted tomorrow.
Urgency is the key ingredient. Urgency suspends critical thinking. When you feel pressed for time, your brain shifts from analytical mode to reactive mode, and in reactive mode you do exactly what you are told, because there is no time to ask why.
I have a client in Botoșani, a building-materials supplier with around twenty employees, who paid twice for the same goods within a month — once to the real supplier, once to the fraudster who had cloned the real supplier's email exactly, with the same invoice format, the same series number slightly modified, the same tone. He discovered it when he did the end-of-month accounting reconciliation. The two thousand euros he never saw again.
Pattern 2 — Business Email Compromise: when the boss isn't the boss
Business Email Compromise, abbreviated to BEC in all the FBI and Europol reports documenting annual global losses of billions of dollars, is a scam with a more subtle psychological logic than the forged invoice. It does not forge an invoice — it forges a relationship of authority.
The mechanism is simple and almost elegant in its perversity: the fraudster accesses or clones the email of a manager, director, or company owner. They then send an email to an employee — usually in accounting or the finance department — with an urgent and confidential request. Transfer this amount to this account, now, it's an urgent transaction, confidential, don't discuss it with anyone for the time being, I'll ring you later to explain.
There are two psychological ingredients that make BEC work so well in small firms. The first is authority — when you receive an instruction from your boss, the instinct is to execute, not interrogate. That is not weakness or stupidity; it is normal organisational culture. The second is confidentiality — the request not to discuss it with anyone cuts off the most natural verification mechanism: turning to the colleague at the next desk and asking.
And in small firms, BEC has an additional particularity: the director really does often send emails at unusual hours, really does make urgent and apparently disorderly requests, really does sometimes bypass procedures because formal procedures are rarer. So the context is credible from the outset.
I heard of a case at a consultancy firm in Iași — not a client of mine, but a story told by someone who knows someone, that circuit of information in northern Moldova where everyone knows everyone — in which an accountant transferred almost eighty thousand lei because she received an email from the director's address, written in his style, with his characteristic turns of phrase, with a reference to a real meeting that had taken place the day before. The email address was identical — with a single letter changed in the domain, difficult to spot on a mobile phone where small letters compress and the address bar is in any case too short to read in full.
Pattern 3 — Impersonation attacks: institutions as a vector of panic
The third pattern differs from the first two in the central emotional ingredient it exploits. The forged invoice exploits routine. BEC exploits authority. The impersonation attack — impersonating ANAF, the bank, the Town Hall, the Romanian Police, DNSC, or any institution with formal power over you — exploits fear.
And fear is, of all the emotions available to the fraudster, the most effective. Fear does not merely suspend critical thinking — it suspends every other cognitive function. When you receive an email telling you that your firm is in enforcement proceedings, that your bank account will be blocked within 24 hours, that there is a tax investigation under way and you must immediately access a portal to upload documents — your brain no longer evaluates probabilities, no longer checks details, no longer rings anyone. It reacts. And in reacting, it gives the fraudster exactly what they want: a click, a password, a transfer.
I have seen these emails in Romania with increasing frequency over the past two years. Emails that perfectly mimic the visual style of ANAF communications — with the correct letterhead, with the recipient's tax identification code (public data, accessible to anyone), with a link leading to a website whose address is almost identical to anaf.ro. Emails that copy the style of bank communications, with perfectly rendered logos, with plausible reference numbers, with clear instructions for 'identity verification' through an external portal that is, in fact, harvesting your credentials.
And there is a nuance specific to the Romanian entrepreneur against which institutional impersonation works with almost surgical effectiveness: the relationship with the state. If you are an entrepreneur in Romania and have ever worked with public institutions — and I work with them daily — you know that the relationship with the state is by definition one of asymmetry, of bureaucratic urgency, of deadlines that are non-negotiable. When you receive a notification that appears to come from ANAF, the instinct is not to question it — it is to comply as quickly as possible, because your experience with the state has taught you that non-compliance is costly.
The common denominator: the three weapons of the fraudster
Whatever the pattern — forged invoice, BEC, institutional impersonation — there are three ingredients that are invariably present. I identified them by analysing every case I have studied or experienced directly, and I believe understanding them is more valuable than any list of specific warning signs, because the patterns change, adapt, and grow more sophisticated constantly, whilst the psychological mechanisms remain constant.
The first ingredient is fabricated urgency. Every well-constructed scam creates an artificially compressed time horizon. Today, within 24 hours, before close of business, by midnight. Urgency is the antidote to verification — you cannot verify something that must be resolved right now.
The second ingredient is authority or familiarity. The fraudster always presents themselves as someone or something you already trust — a longstanding supplier, a boss, a state institution, your bank. Not as a stranger begging for something, but as a legitimate source requesting something normal.
The third ingredient is the isolation of the decision. Either explicitly — don't discuss this with anyone — or implicitly through the construction of the situation: the email arrives during a holiday, in the evening, when you are alone at the office. It comes with direct instructions, leaving no room for dialogue. It arrives as a one-way communication, not as an invitation to a conversation.
These three ingredients, applied together, create a window of vulnerability that has nothing to do with your level of education, your business experience, or your intelligence. It has to do with the fact that you are human — tired, rushed, caught between a thousand responsibilities, with a cold coffee on the desk and an indifferent cat on the chair to your right.
What you do with this
The anatomy of the scam has no value if it remains an intellectual exercise. Its sole practical value is this: if you understand how the mechanism works, you can identify the moment when you are vulnerable not from an abstract risk assessment, but from a concrete recognition of your own state. Are you tired? Are you rushed? Have you received something that creates urgency, that comes from a source of authority, and that for some reason doesn't allow you to verify? Those are the three seconds I was speaking of at the end of the previous section. The three seconds in which, before anything else, you ring. On the number in your phone, not the one in the email. And you ask.
It is banal. I know it is banal. But the most effective defences are banal — wash your hands, wear a seatbelt, check before you sign. We all know them. The problem is not knowledge. It is habit.
Next section: how to recognise warning signs in real time — before you click, before you transfer, before it is too late.
Early Recognition — the signals you ignore for lack of time
Before you click
There is a specific, repeatable moment which I have identified in myself after years of observation and which I have seen replicated in every entrepreneur I have discussed this with — a moment that lasts perhaps two seconds and contains within it the entire difference between being deceived and not being deceived. It is the moment when something in the email, in the message, in the request, produces a slight sensation of internal friction — not alarm, not panic, but something subtler, more buried, like a small stone in your shoe that you feel with every step but don't stop to remove because you are in a hurry and you still have a distance to cover. And precisely because it is so small, precisely because it does not hurt enough to force a stop, you ignore it. You tick the email. You forward it to the accountant. You move on.
And sometimes, that small stone was all you had.
I noticed this in myself for the first time about three years ago, when I received an email from what appeared to be my domain registrar — an email that looked perfect, with the correct logo, the correct format, the correct tone, asking me to verify my account credentials because of a system migration. I felt the stone. I ignored it. I opened the link. I stopped only because the page I landed on loaded oddly, with a slight delay and with the heading font marginally different from how I remembered it. A difference of a few pixels in font weight. That is what saved me — not my vigilance, not my technical knowledge, but a font that was not quite right.
That is the problem with early recognition: it depends on details so small that recognising them has more to do with your state in that particular moment than with any formal preparation you might have undertaken.
The anatomy of the ignored signal
My son, who is at the age when all questions are about how things work and none about why you should stop, once asked me how you know something is fake. The question arose in the context of a video game in which he had to identify real objects from a list that contained replicas, and it was not a philosophical question — it was a pragmatic, instrumental one, as all his questions are: how do you know, Dad, concretely, what do you do to know.
I told him you don't always know. That sometimes a fake is so good there is no detectable difference with the means available to you. But that there is a practical rule, which I inherited indirectly from his grandfather, who repaired engines and knew that an engine that sounds fine can still be on the verge of failure if the vibration is slightly different from yesterday: when something changes a parameter from what you knew, whatever that parameter may be, it is a signal that you should verify, not that you should raise an alarm. Not catastrophe. Just verification.
And that is, essentially, everything you need to know about the early recognition of scams targeting small firms. Not an elaborate system, not a twenty-point checklist, not a two-day course. A single reflex: something has changed from what I knew — I verify before I act.
The problem is that this reflex must be trained. And training it enters into direct competition with the scarcest resource any small entrepreneur has: attention.
Signal 1: fabricated urgency — when time becomes a weapon
Friday afternoons are when I feel most acutely what it means to be a small firm. All the emails I didn't manage to resolve during the week, all the invoices that must be issued before the weekend, all the client requests that waited patiently until Thursday and became urgent on Friday, all the system updates I deferred, all the DNSC reports requiring a response within a deadline. And within this pile-up of real urgencies, a false urgency introduced with precision is almost impossible to distinguish from the background noise.
The fraudster knows this. Whether they know it theoretically or empirically — probably empirically, through trial and error, through thousands of emails sent and analysis of the ones that worked — they apply it consistently. Fabricated urgency is the first and most consistent warning sign, and its paradox is that the very urgency it creates makes it difficult to recognise as a signal.
How do you recognise fabricated urgency as distinct from real urgency? There are a few structural differences. Real urgency usually comes with context — you know why it is urgent, it makes sense in relation to a situation you already knew about. Fabricated urgency arrives in isolation, without antecedent, without a clear connection to anything you knew was coming. Real urgency generally allows a delay of a few hours for verification — the real supplier can wait an hour if you are in a meeting. Fabricated urgency allows nothing; any attempt to delay is blocked by a deadline expiring immediately or by an automatic consequence. Real urgency comes through channels you know — the phone rings as well as the email arriving. Fabricated urgency avoids dual channels, because the second channel would expose the fraud.
Practical rule: any urgency that arrives exclusively by email and that cannot withstand a five-minute telephone verification is, by definition, suspect. Not confirmed as false — suspect. And suspicion justifies verification, not action.
Signal 2: the domain deviation — the letter that costs you
I am someone who works with text and code every day, who reads URLs with an attention most people do not have, and yet, in a few specific moments of my professional life, I have missed a wrong letter in an email domain. Not because I cannot read. But because the human brain does not read letter by letter — it reads patterns. If the first and last letters of a word are correct and if the overall context supports the expected meaning, the brain automatically fills in the rest without requesting explicit verification. It is a feature of cognitive speed, not a deficiency.
And it is exactly the gap that the domain deviation exploits.
I have developed a habit that takes me literally three seconds and that has caught real problems twice: when I receive an invoice or a financial request from a supplier I work with regularly, I do not read the email from top to bottom. I read the sender's full address first. Not the display name of the sender — that can be set to any string of characters you like. The address. And I compare it not with what I remember it should be, because memory is unreliable, but with the last legitimate email from that supplier, which I look up in my inbox.
If it is not identical — complete stop. Not scepticism, not worry. Stop and ring.
Signal 3: a change in a known parameter — the new IBAN, the new number, the new portal
This is the signal I consider the most important, the most comprehensive, and the most consistent in identifying scams before they cause damage. Not because it appears most often — the others appear just as often — but because it is structural, logical, and independent of your emotional state in the given moment. You may be tired, rushed, distracted, and still recognise it, if you have internalised the rule.
The rule is simple: any communication that changes a parameter you knew from an existing relationship is, by its nature, a communication that requires independent verification before action.
A new IBAN from a longstanding supplier. A new phone number on a form that arrives by email. A new payment portal or authentication portal you did not know existed. A modified delivery address. A new email address from the same department. Any of these changes can, in itself, be perfectly legitimate. Suppliers change banks. Companies migrate systems. People move. But precisely because they are legitimate in real life, they work perfectly as a vector for fraud in digital life.
Verifying a new IBAN is not an insult to the supplier. I have said this several times, particularly to older clients, shaped by a business culture of face-to-face dealings in which verifying information provided by a trusted partner might seem like a demonstration of distrust. It is not. It is hygiene. Legitimate suppliers understand this. Any legitimate supplier who is offended that you rang to confirm a new IBAN should give you cause for concern for an entirely different reason.
Signal 4: the context of receipt — the time, the channel, your state
There is a dimension of early recognition that is rarely mentioned in cybersecurity guides and which I consider equally important to any of the technical signals: the context in which you receive the communication. Not what it contains — when it contains, through which channel it contains, and what state you are in when you receive it.
Scam emails are not distributed randomly throughout the day. There are patterns — not necessarily consciously calculated by every individual fraudster, but emergent from statistics, from testing, from the natural selection of tactics that work. Emails demanding urgent financial action tend to arrive on Friday afternoons, when banks are close to closing and verification becomes more difficult. They arrive in the first days of the month, when payment deadlines are real and routine. They arrive during peak fiscal periods — approaching ANAF deadlines, end of quarter, declaration submission periods — when anxiety about tax obligations is naturally heightened and an email that appears to come from ANAF immediately triggers an emotional response of compliance.
I know I have specific time-based and state-based vulnerabilities. I am less attentive after eight in the evening, when I have finished responding to urgent emails and my brain has shifted into decompression mode. I am less attentive on Tuesdays, for the reasons I described at the opening of the previous section. I am less attentive when my son is in the room and wants to show me something, because my attention is divided and I give him the priority he deserves, which means any email I open in that context receives a fraction of my evaluative capacity.
I do not know how to resolve this entirely, because I cannot and do not wish to be less present with my son in favour of vigilance against fraudsters. But I know I can postpone opening financial emails for moments when I am alone and relatively unencumbered. It is an organisational solution, not a technological one. And it works.
Signal 5: the request for confidentiality — when you are told not to ask
This is the clearest, most consistent, and most unambiguous signal of all, which is why I leave it until last: any communication that, explicitly or implicitly, discourages you from verifying with another person or through another channel is, by definition, a communication that must be verified with another person and through another channel.
Don't discuss this with anyone for the time being. It's a confidential transaction. Handle this internally without involving the finance department. It's a sensitive matter, don't mention it to colleagues. Each of these formulations, in the context of a request for financial action or data transfer, is a maximum warning signal.
Legitimate firms do not ask for confidentiality from their own employees regarding operational transactions. Legitimate suppliers do not ask you not to check with your accountant before paying. State institutions do not ask you not to discuss a tax notification with your colleagues. Any request that deliberately narrows the circle of people who could verify the information is a request constructed to eliminate precisely the mechanism that would expose the fraud.
Recognition as practice, not as event
I arrive, after all of this inventory, at the conclusion I knew from the beginning but which required the journey of the argument to become truly intelligible: early recognition is not a single act, not something that either happens or does not happen at a given moment. It is a practice, a set of trained reflexes, a way of processing business information that becomes, over time, as automatic as any other well-formed professional habit.
My father listened to engines. He did not seek out faults — he listened. And from listening, over the years, faults announced themselves as deviations from what he knew should sound right. He did not always know what the deviation meant. But he knew it was a deviation and he knew the deviation required verification.
That is all. To learn how your business relationships sound when they are right — how your suppliers' emails look, what the usual amounts are, what the rhythm of communications is, what the style of your partners is — and to treat any deviation from your own specific normal not as an alarm, but as an invitation to verify. Three seconds. One phone call. An eye on the full address before reading the content.
Small things. But in security as in mechanics, small things are what make the difference.
Next section: what you do concretely, step by step, tomorrow morning — practical measures, without a corporate budget, without advanced technical knowledge.
Practical Steps — what you do tomorrow morning
Protection without a corporate budget
Tomorrow morning I shall probably wake at half past six, ten minutes before the alarm, as happens to me almost every day now that I have passed forty and my body has decided that sleep is a negotiable luxury. I shall lie in bed for a few minutes listening to the house — Gri is already moving about the kitchen, I can tell from the specific sound of her paws on the cold tiles, a small rhythmic sound that works better for me than any alarm. My son is still asleep; he will sleep until half past seven with the precision of a laboratory programme, and in those fifteen minutes between my waking and his there is a silence that is probably the cleanest interval of thought I have in the whole day.
Tomorrow morning, in those fifteen minutes, instead of picking up my phone and reading emails — the bad habit I have had for years and which I recognise as bad with the same consistency with which I practise it — I should do something different. I should apply what I know.
That is, in fact, the central problem of security for small firms: not a lack of knowledge, but the distance between knowledge and practice. We know we must verify. We know we must have strong passwords. We know we must make backups. We know all of this with the same certainty with which we know we should sleep eight hours and eat less sugar. And yet we don't do it, or we do it inconsistently, because knowledge without system becomes intention, and intention without execution becomes diffuse guilt, that permanent background of I really should which accompanies your day without producing anything concrete.
What follows is not a list of abstract recommendations. It is a set of steps that I can take, with the resources I have, in the small firm I run, tomorrow morning. And if I can take them, any entrepreneur reading this can.
Step 1: the ten-minute audit of your digital accounts
In every small firm I have seen from the inside, there are a surprisingly large number of active digital accounts about which the owner has either forgotten, or does not know exactly what access they have to what, or which use passwords created five years ago in the spirit of something to serve, just to be able to log in. Hosting accounts, email accounts, accounts with cloud service providers, the firm's social media accounts, accounts on public procurement platforms, government portals, electronic invoicing platforms, internet banking accounts for one or two or three bank accounts. The real number is almost always larger than you think.
The first thing I recommend tomorrow morning, before the first email, before the first coffee if need be, is to take a sheet of paper — not a Word document, not an app, a physical sheet of paper, because paper stays and doesn't get lost in a forgotten folder — and write down every digital account you use or have used in the past two years in connection with your firm. Not to secure them all immediately — that would take days. But to know what you have. To have an inventory.
I did this exercise myself about six months ago and found twenty-three active accounts, of which I had not changed the password on eight for over three years, and on three I could not even remember precisely what access they had or why I had created them. Three of those had access to my clients' data. Three accounts I had forgotten, with access to data that nobody should forget.
Step 2: two-factor authentication — where and how
Two-factor authentication, which the industry abbreviates to 2FA with that fondness for acronyms all technical fields share, is probably the measure with the best ratio between implementation effort and level of protection obtained from the entire security arsenal available to an SME. It is not perfect. It does not solve everything. But it raises the difficulty threshold of an attack sufficiently that a large proportion of automated attacks stop there — not because they cannot get through, but because there are enough other targets without 2FA that are easier to attack.
The logic is simple: your password can be stolen — through phishing, through a breach at another service where you used the same password, through brute force if it is weak. But if you have 2FA activated, the stolen password alone is not sufficient. The attacker also needs your phone, or the authenticator app on your phone. And that fundamentally changes the cost-benefit equation of the effort required.
The accounts on which 2FA is mandatory, not optional, not I'll get round to it at some point: your business email, all internet banking accounts, hosting accounts and server access, electronic invoicing platforms, the firm's social media accounts, any platform through which you access your clients' data. The authenticator applications I recommend — Google Authenticator or Authy — are free, can be installed in three minutes, and work offline, eliminating dependence on a phone signal at the moment you need to authenticate.
There is one thing you must do immediately after activating 2FA on any important account: save the backup codes the platform offers you during configuration. Not in email. Not in the cloud. On paper, in the firm's safe or in a physically secure location. I witnessed an entrepreneur who lost access to his hosting account for three days because he had changed his phone without saving his backup codes and could no longer get through 2FA. Three days during which his clients' websites were down. The cost of recovering access exceeded anything that thirty minutes spent correctly saving the codes at setup would have cost.
Step 3: the transfer verification procedure — written, displayed, followed
This is the step I consider most important for firms that have at least one employee or collaborator with access to financial operations, and it is the step everyone — including me — puts off the longest, because it involves writing something down, printing it out, displaying it, and that seems bureaucratic, corporate, unsuited to a small firm where everyone knows one another and things get resolved through common sense and direct communication.
But common sense and direct communication don't work at eight o'clock in the evening when your accountant receives an urgent email from what appears to be your address and you are at a meeting with your phone on silent.
The transfer verification procedure need not be a twenty-page document. It can be an A4 sheet, printed, displayed next to the computer of the person who makes payments. Its essential content: no payment to the account of a new supplier, and no change of a current supplier's banking details, is made without telephone confirmation using a previously known phone number — not the one in the request email. No urgent payment that arrives exclusively by email is made without verbal confirmation from the person who requested it. Any transfer request containing the words urgent, confidential, or don't discuss this with anyone is automatically treated as suspect and escalated.
That is all. One A4 sheet. Three rules. Posted next to the computer. Followed consistently.
Step 4: the password manager — the last password you will ever need to memorise
I know that a password manager sounds complicated if you have never used one, and I know there is a specific psychological resistance to the idea of putting all your passwords in one place — if that one gets hacked, I lose them all. The resistance is legitimate as an abstract concern and almost entirely unjustified as a practical risk, because the real alternative is not different, strong, perfectly memorised passwords but the same password or easy variations of it reused across dozens of platforms, which is incomparably more dangerous than any theoretical vulnerability of a well-chosen password manager.
Bitwarden is free, open source, independently audited for security, and works across all platforms. I switched to it two years ago after discovering I had variations of the same password across fourteen different services. The migration took one afternoon and was one of the most productive afternoons I have invested in my firm's security.
The logic of the password manager is that it allows you to have genuinely different and genuinely strong passwords for every account, without depending on your memory. You memorise a single password — the master password for the manager. That one must be long, complex, and used nowhere else. The rest the manager generates and stores.
There is one additional rule I apply and recommend: the master password is not written down anywhere digitally. It is written on paper, in two copies, stored in different physical locations. Not on your phone, not in email, not in any cloud document. Paper. Because paper cannot be hacked.
Step 5: backup — not if, but when
There are two types of entrepreneur in the world, someone said many years ago in a context I no longer recall, and the formulation stuck with me because it is perfectly accurate: those who make backups and those who are going to start making backups. A joke that stops being funny when your business loses data.
A backup for a small firm need not be a complex operation. It must be a consistent one. And it must follow a simple rule the industry calls the 3-2-1 rule: three copies of important data, on two different types of storage media, with one copy stored off-site or in a cloud separate from the main system.
In practice, for my firm this means: the databases of client websites are automatically copied daily through the server's backup script, with a local copy and a copy on a cloud account separate from the main hosting account. Firm documents — contracts, invoices, important correspondence — are automatically synchronised to an encrypted cloud. And once a month, on the first day of the month, I perform a full manual backup to an external hard drive that sits physically in the office, disconnected from any network.
That last part, the disconnected external hard drive, is specifically important with regard to ransomware — the type of attack in which malicious software encrypts all your files and demands a ransom to decrypt them. Ransomware, if it gets into your system, also encrypts files synchronised to the cloud if they are actively connected. The disconnected external hard drive is immune — because there is no pathway through which the malicious software can reach it.
Step 6: business email separate from personal — the boundary that matters
For the first two years of my business I worked with a single email account for everything — professional communications, invoices, personal correspondence, newsletters I had subscribed to and no longer read, notifications from platforms I had forgotten. An ecosystem of several thousand emails in which urgent and unimportant coexisted without discrimination, and in which a forged financial request could hide with the same efficiency as a fish in the ocean.
Separating your business email from your personal email is one of the simplest and most effective digital hygiene measures, and one that many sole traders and small firms do not take because it works fine as is. It does. Until it doesn't.
A business email configured on the firm's own domain, with strong passwords and 2FA activated, with access restricted to firm devices only or with explicit authentication on new devices, creates a clear boundary that makes it easier both to recognise suspicious emails — if an invoice arrives on the personal address that should have come to the business address, that is already a signal — and to manage an incident if one occurs.
Step 7: a culture of verification — for you and your two employees
All the above steps are technical or procedural. They work on their own if you are working alone. But if you have employees, collaborators, or external accountants who have access to your firm's systems or data — and almost any functioning firm has at least one of these — your protection is exactly as strong as the weakest link in the entire human chain.
You do not need to organise a cybersecurity course. You need to have a conversation. One direct, concrete, informal conversation in which you tell the people you work with: here is what a suspicious email looks like, here is what we do when we receive something that seems odd, here is the fact that there is no shame in asking before paying. And above all: here is my preference that you ring me to check rather than pay a forged invoice because you were embarrassed about appearing not to trust the supplier.
A culture of verification is not built through fear or draconian procedures. It is built through normal conversations, through concrete examples, and through the fact that you, as the owner, practise what you preach. If I verify before I pay, if I ring the supplier when I receive a new IBAN, if I treat urgent emails with that deliberate three-second pause — the people I work with see this and internalise it as the normal of this firm, not as the boss's paranoia.
I return to the morning I was speaking of at the beginning. To those fifteen minutes between my waking and my son's, when Gri moves through the kitchen and the house is quiet and my brain is fresh, not yet contaminated by the urgencies of the day. I am not going to change everything tomorrow morning, because perfection applied all at once never lasts more than a week. But I can do one thing. One single concrete step from this list. I can open a sheet of paper and write the account inventory. Or I can activate 2FA on the business email. Or I can write the verification procedure and print it out.
One step. Applied tomorrow. And then another the week after.
That is all that separates knowledge from protection. Not a budget. Not an IT department. One step, then another, and the consistency to continue.
Next section: how to build a preventive culture — beyond technology, in the people you work with and in the habits of your working day.
Preventive Culture — beyond technology
Your employee is either your first line of defence or your first breach
There is a meeting I have with myself every Thursday evening, after my son has retreated to his room and before fatigue becomes dense enough to close every thought with its own weight. It is not a scheduled meeting, I have not written it in my calendar, I have no formal ritual for it — it is more of an interval that creates itself spontaneously, a space of ten or fifteen minutes in which I find myself sitting at the kitchen table with a cup of tea I am holding in both hands without drinking, and in which my brain, rather than stopping, does a kind of unsolicited inventory of the day, the week, the things I have done and those I have put off with the vague promise that tomorrow is a word that means something.
On a Thursday evening three weeks ago, I was sitting at that table with that tea and with Gri in my lap — because on Thursday evenings Gri mysteriously decides that my lap is the only acceptable location in the entire house, a decision she fully revokes by Friday morning — and I was thinking about a conversation I had had that afternoon with a collaborator who partially manages my client communications. I had told her something about how to verify suspicious emails, shown her a concrete example, explained the logic of the sender's address versus the display name, and she had listened with the polite attention you give to someone when you understand the subject is important to them but are not certain it is important to you.
And sitting there with the tea and the cat, I realised that I do not have a security problem. I know what I know, I apply what I apply, I have my procedures, I have my reflexes trained over years of working with digital infrastructure. My security problem is not me. My security problem is the space between me and the people I work with — that transmission space in which a culture either is transmitted, or is transmitted in truncated form, or is transmitted with an urgency that makes it sound like an imposed rule rather than a natural practice.
And a culture that sounds like an imposed rule is only practised when there is someone to verify that it is being practised. And I cannot permanently be that someone.
What culture means, in the most concrete sense
The word culture is one of those words that in a corporate context has lost almost all substance through overuse. Organisational culture, security culture, culture of innovation — phrases that appear in PowerPoint presentations and vanish in the reality of the working day with the same speed at which water evaporates from a glass left in the sun. We say them and they mean nothing, or they mean something too abstract to produce anything concrete.
When I speak of preventive culture in the context of a small firm, I do not mean any of that. I mean something far simpler and far more difficult at the same time: what the people you work with do when you are not in the room. How your collaborator reacts when she receives a suspicious email at six in the evening and you are at dinner. What your external accountant does when he sees a new IBAN on an invoice from a supplier he has known for years and whom he does not want to offend by ringing to verify. What your employee decides in that five-second moment when he has the email open and his hand on the mouse and there is no internalised procedure to tell him that pausing is permitted, that the question is legitimate, that not knowing whether something is real or fake is not a sign of incompetence.
Culture is what happens in those five seconds. And that culture is built by you, or it is built by nobody.
The problem of transmission: why saying it once is not enough
I grew up with a father who never repeated the same thing twice. If he told you something once, he considered you had heard it and that the responsibility for execution was yours. It was the logic of a man who worked with engines, with things that do not interpret, do not forget, do not have bad days — either you tighten the bolt correctly, or you don't. The engine makes no exceptions on the basis of your mood.
People are not engines, and that is simultaneously the most complicated and the most important thing to understand if you want to build a preventive culture around you. People hear something once and internalise it partially. They hear it a second time and the connections consolidate. They hear it a third time in different contexts and the information becomes reflexive, not merely declarative. There is solid cognitive research behind this observation — procedural memory, which is the type of memory responsible for habits and reflexes, is formed through contextualised repetition, not through a single instruction, however clear that instruction may be.
This means that telling your collaborators once what a suspicious email looks like is a beginning, not an end. And if you say it once and consider the problem solved, you have created an illusion of protection that is in some respects more dangerous than the complete absence of any preparation — because the illusion deactivates vigilance.
Concretely, in my firm, I have moved from a single conversation to a model of reminder integrated into the normal work flow. When I send an internal email containing an external link, I add a single line: link verified, from source X, safe to open. When I receive or send an invoice with new banking details, I add explicitly: IBAN verified by phone with the supplier on date X. It is not a formal protocol; it is a communication habit that implicitly models the way my collaborators treat similar information — if I verify and note the verification, they learn that verification is the norm, not the paranoid exception.
The shame of asking — an invisible obstacle with real consequences
There is something I have never seen mentioned in any cybersecurity guide and which I consider one of the most real obstacles in building a preventive culture: shame. The specific embarrassment of ringing a business partner you have worked with for years and saying to them, implicitly or explicitly, that you are not certain the email from him is genuinely from him.
It is an embarrassment with deep roots in Romanian business culture, in which the personal relationship precedes and often substitutes formal procedure, in which asking for verification is interpreted as a sign of distrust, and in which distrust towards a partner with whom you have built a relationship over time is a form of ingratitude or misplaced suspicion. Good heavens, you've known him ten years, don't you believe it's him? Yes. That is precisely why I ring — not because I don't believe it is him, but because one minute on the phone is the price I pay for certainty, and certainty is always worth more than the comfort of not being inconvenient.
I had this conversation explicitly with my collaborator. I told her that any verification call she makes, however unnecessary it may seem to her, however awkward it may be in relation to the supplier or partner being called, is a call I approve without reservation and consider part of a job well done. That my explicit preference is to ring ten times too many rather than not ring once when I should have. And that if any supplier is offended that I verified a new IBAN, that supplier is, through his reaction, raising a completely separate warning signal about the quality of our business relationship.
The explicit permission to ask, to verify, to appear distrustful of a request, is perhaps the single most important thing a small-firm owner can give to the people they work with. Not technology, not written procedures — permission. And permission must be given explicitly, not left to be inferred, because in its absence people implicitly infer that efficiency and fluidity are more valuable than verification, because that is what they see happening around them every day when things move quickly and nobody stops to ask.
The simulated scenario — the most effective tool you are not using
There is an exercise I do occasionally with my son, not for explicitly educational purposes, but because I like to understand how he thinks and because he responds better to concrete scenarios than to abstract principles — I present him with a situation and ask him what he would do. I do not judge his answer, I do not immediately tell him what is correct; I listen to the logic he applies and from that logic I understand what he knows and what he doesn't, what he has internalised and what he has heard but not processed.
The same principle, applied to your team of one person or five people, is the most effective preventive preparation tool available to you and which almost none of the small-firm owners I know use, because it sounds corporate, because it seems to require time, because there is always something more urgent.
The simulation need not be a formal exercise. It can be a ten-minute conversation in which you say: I'm going to show you an email — tell me what you notice. And you present a real phishing email you have received or found online — there are public collections of real, anonymised examples on the websites of cybersecurity organisations — and you listen to what the other person notices. What they see first, what stops them or does not stop them, what they would do in that moment.
Not to evaluate and mark. But to understand where the real gaps are, not the ones you assume. I did this exercise and discovered that my collaborator instantly spotted domain deviations in the email address — faster than me, because she has a differently formed eye — but completely missed fabricated urgency as a warning signal, because urgency is so normalised in our work flow that it has ceased to trigger any special reaction.
Information I would not have had without the concrete simulation. And which completely changed my approach in subsequent conversations with her.
The moment after an incident — how to build from a mistake without destroying trust
A small firm in which everyone is afraid to report a wrong click, an accidentally opened link, or an invoice paid before verification, is a firm in which incidents are discovered late, when the damage has already occurred and when reversing it is either impossible or extremely costly. Fear of the owner's reaction transforms a recoverable mistake into a buried secret, and the buried secret becomes a problem growing in the dark.
I have a rule which I have formulated explicitly and repeated often enough that I believe it has been heard: any security incident, however small, however embarrassed you feel about it, reported within the first thirty minutes produces incomparably less damage than the same incident reported after twenty-four hours. A click on a suspicious link that is reported immediately gives me time to check, to change passwords if necessary, to monitor account activity. The same click reported the next day — or never — takes that intervention window away from me.
And for the rule to work, my reaction to the report cannot be reproach, cannot be anger, cannot be any form of punitive response that implicitly teaches the person that reporting costs more than silence. It can be internal frustration — I am human, I have my reactions too. But internal frustration remains internal and external action remains constructive, focused on resolution, not on attribution of blame.
My father, when I made mistakes in the workshop — and I did, I was a child and I was clumsy and sometimes I broke what I was trying to repair — did not tell me I had made a mistake. He showed me how it was done correctly and let me do it again. Not out of indulgence, but out of a practical wisdom I did not understand then and which I understand only now: that the lesson comes from correction, not from reproach, and that reproach produces shame, and shame produces concealment, and concealment produces exactly the kind of organised ignorance you cannot afford when you work with engines or digital systems that do not forgive ignored errors.
Culture as daily practice, not as a project with a completion date
I am sitting at the kitchen table, on a Thursday evening, with the tea that has gone completely cold and with Gri, who has decided that my lap has ceased to be sufficiently warm and has moved to the chair beside me, from where she watches me with that expression cats have when they appear to be evaluating whether you merit continuing to exist. My son is asleep or pretending to be asleep or is awake with his phone under the duvet, which amounts to the same thing from the perspective of the quiet of the house. Outside it is dark and it is quiet and tomorrow is Friday and Friday is the day I have the most emails and the least time to think about them.
And I think that everything I have written in this section reduces, in the end, to a single truth that is simultaneously about digital security and about everything else in the life of someone who works with other people: that you cannot alone protect what you have built together. That your best technology is useless if the person alongside you does not know why it exists, how it works, and that they have permission to use it without fear of making a mistake.
Preventive culture is not a project with a completion date after which you tick it off and move on. It is a daily practice, as quotidian and as necessary as opening and closing the firm, as issuing invoices, as responding to emails. It is done in short, repeated conversations, in concrete examples, in explicit permissions, in correct reactions to mistakes, and in informal simulations that reveal gaps you had not suspected.
It is done on Thursday evenings too, sitting at the table, thinking about the people you work with and how much of what you know has truly reached them. Not as information. As reflex.
Next section: available resources — the institutions, platforms, and networks you can turn to when what you don't want to happen happens.
Available Resources — you are not alone
FTC, NCA, DNSC and you — why it matters who is in the room
I discovered that DNSC — the National Directorate of Cyber Security — existed not through a course, not through a guide, not through a recommendation from someone who knew more than me. I discovered it existed because I received an email from them. A real email, not a scam, although my first reaction was to verify whether it was real, which in itself is proof that the reflexes I wrote about in the previous sections work sometimes, even when you are tired and it is Thursday afternoon and Gri has just knocked your glass of water off the desk with that sovereign indifference cats have towards the consequences of their actions.
The email was a notification about a vulnerability identified on one of the websites I manage. Not a threat, not a sanction, but an information — someone, an automated monitoring system belonging to the Romanian state, had identified that a site in my portfolio was running a version of software with known vulnerabilities and was informing me, before the vulnerability was exploited, that I needed to act. This was DNSC in action: not police, not inspection, but an alert partner.
I spent a few minutes with that email open, verifying the address, verifying the links, verifying the digital signature — all the reflexes — and when I convinced myself it was legitimate, I felt something I had not expected to feel: relief. Not because the vulnerability was minor and easy to fix, but because someone, somewhere, had been looking at my infrastructure and had warned me that a problem existed before it became a crisis. I was not alone in the face of the internet and everything that moves through it unseen and unannounced.
That is, essentially, all I am trying to convey in this section: that you are not alone. That there are resources, institutions, networks, and tools that exist precisely for the moment when you do not know what to do or when you have not seen what needed to be seen. That access to them requires no special connections, costs nothing in the majority of cases, and that the only condition for benefiting from them is knowing they exist and knowing how to find them.
DNSC — the state that rings before you are attacked
The National Directorate of Cyber Security is the Romanian institution with the explicit mandate to protect national cyber infrastructure, including — and this is important to emphasise — infrastructure operated by private firms, SMEs, operators of essential services, and local public authorities. It is not an institution reserved for ministries and large corporations. It is an institution that, if you are connected to the internet and your systems are visible from outside, concerns you directly.
Concretely, what DNSC offers a small entrepreneur:
The security alerts it publishes periodically on its own website and by email for those subscribed represent an information stream about active vulnerabilities, ongoing phishing campaigns, and types of malware currently circulating in the Romanian cyber space. They are not written in inaccessible technical language — they are press releases, in Romanian, describing the threat and providing concrete mitigation steps. I look at them once a week, not because I have time to immediately implement everything they recommend, but because they give me a picture of the context in which I operate and warn me when something specific is active and relevant to my type of infrastructure.
The incident reporting mechanism is another instrument that too few small entrepreneurs use — either because they do not know it exists, or because reporting an incident seems to them an exposure, a confession of a vulnerability they prefer to manage internally and discreetly. I understand the logic. I have felt it myself. But this logic sacrifices a real collective good on the altar of an illusory individual comfort — the less that is reported, the less DNSC can identify patterns, warn other operators, and document new tactics and techniques. Every unreported incident is a piece of information missing from the national threat picture and which, indirectly, makes the person beside you more vulnerable.
Reporting is done through the form on cert.ro — CERT-RO is the operational arm of DNSC, the team that actually manages incidents — and involves no automatic legal consequences, is not a declaration of guilt, and does not trigger an inspection. It is a contribution to the collective database that protects everyone who is connected.
ANPC and FTC — when the fraud is also a commercial offence
The National Authority for Consumer Protection [ANPC — Autoritatea Națională pentru Protecția Consumatorilor] is better known in the context of disputes with firms selling defective products or engaging in misleading advertising, but its mandate covers part of the spectrum of commercial fraud as well — forged invoices issued in the name of real firms, fraudulent commercial practices, scams that take the form of apparently legitimate commercial transactions.
Registering a complaint with ANPC does not recover lost money and does not guarantee a swift investigation — the system is overstretched and underfunded, a reality there is no point concealing behind unrealistic optimism. But a complaint creates an official document, a case number, a written trace that may be useful if the situation escalates to legal proceedings, if your business insurer requires documentation for a compensation claim, or if the same fraudster subsequently targets other firms and investigators are building a broader case.
The Americans at the FTC, whose webinar provided the starting point for this series, operate at a scale and with resources incomparable to those of ANPC, but the principle is identical and partly applicable indirectly in Romania through international partnerships in combating cybercrime. If you are the victim of an attack involving actors outside Romania — and Business Email Compromise is frequently orchestrated from other countries — reporting to the FTC through reportfraud.ftc.gov creates a trace in the American system which, through international cooperation mechanisms, can reach Romanian investigators.
I am not saying you will resolve anything tomorrow. I am saying that reporting is part of hygiene, not naivety. It is what you do after it has happened, not instead of preventing it.
IGPR and Cyber Police — when you file a criminal complaint
The Romanian Police has a specialist department in cybercrime — the Cyber Crime Combating Service, part of the General Inspectorate of the Romanian Police [IGPR — Inspectoratul General al Poliției Române] — with territorial structures in every county. In Botoșani, as in any county seat, there is an officer or a unit with this mandate, even if the size and capacity vary significantly compared with what exists in Bucharest or in the large university cities.
A criminal complaint for computer fraud, computer forgery, or unauthorised access to computer systems — offences provided for in Law 161/2003 and in the Criminal Code — is the legal instrument of last resort, the one you use when the loss is real and when you have sufficient data to document a case. It is not simple, it is not fast, it does not guarantee the recovery of your loss, but it is the only mechanism that can trigger an investigation with real coercive power, with the possibility of identifying and holding to account those responsible.
What you must have prepared before filing a complaint: all original emails with their complete headers — not screenshots, but the full export of the email in .eml format, which contains the technical information about the routing of the message; bank statements documenting the fraudulent transfer if one occurred; any other relevant correspondence; and a clear written chronology of events in temporal order. The more complete and orderly the documentation from the outset, the more useful it is for investigators and the greater the chance that the enquiry produces something.
I helped a client prepare this documentation two years ago, after a BEC incident that had cost his firm a significant sum. I do not know how the investigation concluded — we lost contact in the meantime — but I know that the documentation process itself had an effect I had not anticipated: it gave the client a sense of agency, of partial control recovered over a situation in which he had felt completely a victim and completely powerless. Not the resolution, but the action. Sometimes that is what counts.
SME Centres and Chambers of Commerce — the network that exists and that you are not using
Romania has a network of centres for small and medium-sized enterprises — some financed through European funds, some operated through county chambers of commerce, some through regional development agencies — which periodically offer training sessions, consultancy, and information on topics including digital security, GDPR compliance, digital transformation, and protection against cyber risks. The quality of these sessions varies enormously, from excellent to useless, and there is no simple mechanism for knowing in advance which category what is available in your area falls into.
The Botoșani Chamber of Commerce and Industry is, like most county chambers of commerce in Romania, an institution with limited resources and an agenda dominated by the topics that attract funding — European projects, internationalisation, certification. Cybersecurity for SMEs is not, or was not the last time I checked, a central topic in their events programme. But there exists — and this is important — a human network there: local entrepreneurs, consultants, specialists who know one another and who, in the informal context of a networking event, exchange information about what has happened to them, what has worked, and what hasn't.
The informal network is, in many respects, more valuable than the formal programme. I have learned more about the types of scams active in the north-eastern Romanian business environment from conversations over a coffee with other entrepreneurs than from any official report. Not because the reports are poor — they are useful and I read them — but because local, specific, contextualised experience in the economic and cultural reality of the region does not appear in national statistics, let alone in European or American ones.
Be part of that network. Not necessarily through formal events — though those have their value — but through real conversations with people who do what you do, in the area you are in, with the clients you interact with. If someone in your network has received a specific type of attack, that information is more relevant to you than any global statistic.
Digital resources — where to go when you don't know what to do
There are a few online resources I use regularly and recommend without reservation — not because they are perfect, but because they are consistent, free, and useful at the level of technicality of an entrepreneur who is not a security specialist.
Have I Been Pwned — haveibeenpwned.com — is a service that lets you check whether your email address has appeared in any publicly documented data breach. You go to the site, enter the address, and within a few seconds you know whether your data has been compromised in any security incident at a platform you have used. It is free, created and maintained by Troy Hunt, a respected security researcher, and is an essential starting point for anyone wanting to understand what digital trace they have left behind and where they might be vulnerable. I checked all my firm's email addresses and discovered that two had appeared in breaches at third-party services I had completely forgotten about. I changed the passwords immediately.
ENISA guides — the European Union Agency for Cybersecurity publishes periodic practical guides for SMEs, free, available in several European languages, with concrete recommendations organised by level of complexity. They are not all available in Romanian, but those in English or French are accessible to anyone who has completed secondary school and require no basic technical knowledge. enisa.europa.eu is the address; the section dedicated to SMEs is easy to find.
PhishTank and VirusTotal — two free tools for checking suspicious links and files before opening them. Receive a link and not sure whether it is legitimate? Copy it into VirusTotal and within a few seconds dozens of security engines analyse it and tell you whether it is known to be malicious. It is not infallible — new links are not yet in databases — but it catches a significant proportion of attacks with malware distributed by email.
Community — not the LinkedIn network, but real people
I close this section with something that cannot be linked and has no URL: the real human community around you, the business people in your town, your accountant, your solicitor, the IT specialist at the firm you work with occasionally. They are, in moments of genuine crisis, the first and most useful resource you have — not because they have more technical expertise than a specialist institution, but because they are immediately available, know your specific context, and can make decisions together with you in real time.
I have a phone number for an IT specialist in Botoșani saved in my phone as IT emergency. I don't ring it often — a few times a year. But I know that if I ring at eleven in the evening because something looks wrong on a client's server, he answers. Not because I have a formal contract with him, but because over eight years I have built a relationship based on reciprocity and mutual professional respect, and because in the small communities of north-eastern Romania these relationships still function as networks of real support, not as connections tallied up on a networking platform.
My father knew nothing about cybersecurity. But he knew that you cannot fix a large engine alone — that at some point you need someone to hold one part whilst you tighten the bolt on the other. He knew that the neighbours in the neighbouring garages were a resource, not a competition; that information about where you could find a rare part or who did a particular type of repair well was a common good circulating among people who worked in the same trade and who had understood that long-term survival is not an individual sport.
Cybersecurity is no different. You are not alone in the face of the internet. But you must know where to look to find who can help you.
Final section: the mind as a security instrument — conclusion and synthesis of all the narrative threads.
VII. Conclusion — the mind as a security instrument
The best antivirus remains healthy doubt
Saturday morning. Quarter past seven. I am sitting at the kitchen table with the first coffee of the day, one I made with more attention than usual — I measured the coffee with a spoon instead of pouring straight from the packet, I waited for the water to stop boiling before pouring it over the filter, I let it steep for four minutes before taking the first sip — and I do not know whether I made it more carefully because it is Saturday and on Saturdays I allow myself the luxury of attention, or because I have spent the past few weeks writing about attention and something from that process has migrated into my everyday gestures without asking my permission.
Gri is on the window ledge, watching the courtyard with the total concentration cats give to things invisible to me — a bird I cannot see, a movement in the grass, a sound below my auditory threshold. Her tail beats rhythmically, gently, like a metronome, and in that movement there is something that seems to me, this morning, more than reflex: vigilance. Not anxiety, not agitation, but the complete and calm presence of an organism that is simultaneously relaxed and prepared, that makes no distinction between a state of rest and a state of alertness because for it the two are the same thing, a continuum of uninterrupted attention to the world around it.
My son is asleep. I hear him turning in bed occasionally, that specific sound of a pulled duvet and a repositioned pillow that tells me he is not in deep sleep, that he is in that surface layer of sleep where dreams are still anchored in reality and from which you emerge with the feeling that you have lived something, not that you have slept. I envy him sometimes for this sleep, for his capacity to abandon himself completely to rest without carrying in the background that continuous fund of calculated worries that I have, and which I suspect every person who runs something carries — however small that something may be.
I sit with my coffee and think about everything I have written in the months that composed this series, and I try to find the thread that connects all the sections — not the thematic thread, which is obvious: cybersecurity for small firms — but the deeper thread, the one that explains why I chose to write about this in the way I did, with my dead father and the cat and the sleeping son and the Saturday morning coffee, instead of writing an orderly technical guide with bullet points and comparison tables and links to official resources.
And that thread, I believe, is the mind. Not the mind as metaphor, not the mind as philosophical concept, but the concrete, biological, tired and distracted and generous and deceivable mind that you have and that I have and that every entrepreneur has who opens a laptop on a Saturday morning because a small firm has no truly free weekends, only weekends in which emails accumulate unread and which you will find on Monday morning with a weight proportional to the duration of your absence.
The mind that decides in five seconds
Everything I described in the previous sections — the patterns of scams, the warning signals, the practical steps, the preventive culture, the available resources — all converged, viewed from sufficient distance, on the same point: the moment of decision. That interval of a few seconds in which it is you, the email, the mouse, and everything you know or do not know, everything you have internalised or have not internalised, all the fatigue and all the attention and all the experience accumulated over years of small business and invoices and suppliers and partners and difficult clients and tax deadlines and nights you did not sleep well.
No security system can substitute the mind in that moment. There are systems that filter before the email reaches you — spam filters, malware scanners, two-factor authentication — and there are procedures that come into effect after you have identified a problem. But in the interval between receiving a suspicious email and your action in response to it, no technology decides in your place. You are alone with your mind and with what you have built within it.
And your mind, in that moment, is an instrument whose quality fluctuates. It is sharper in the morning after a good night's sleep than on a Friday evening after a busy week. It is more reliable when you are alone and quiet than when your son is calling from the next room and you are half there and half at the screen. It is better when you have eaten, when you have slept, when you do not have six simultaneous deadlines expiring on the same day. It is a biological instrument, not a digital one, and it behaves as any biological instrument behaves: the conditions in which it operates affect its quality.
This is the fundamental conclusion, the one that encompasses all the others: the security of your small firm is only as good as your worst moment. Not as the average of your good days, not as your most lucid moment of the week, but as the moment when you are most tired, most distracted, most pressed for time. And if this conclusion sounds discouraging, that is because its formulation is incomplete. The completion of it is: but you can raise the level of your worst moment through systems, procedures, and habits that work even when you are not operating at maximum capacity.
Healthy doubt — what it means in concrete terms
My father was not a man given to philosophical doubt. He had not read Descartes, did not know there was an entire tradition of western thought built on systematic doubt as a method of arriving at certainty. But he practised doubt in his workshop with a consistency that no philosophy book could have given him: he never believed a car was repaired until he had tested it himself, never accepted a client's diagnosis without verifying it himself, never considered a job finished until he had gone through it once from the beginning with a gaze that did not know what it had previously found.
I don't rely on what I've been told, he said to me once — I was a teenager, watching him check a repair that an apprentice had done, a check that cost him twenty minutes and which confirmed that everything was in order — I rely on what I see with my own eyes. It was not distrust of the apprentice. It was method. It was the verification protocol internalised so deeply that it no longer required justification, was no longer a conscious decision — it was simply how a job was completed.
Healthy doubt, applied to digital security, means exactly this: not distrust of partners, not paranoia towards every electronic communication, not a permanent state of alert that would make work impossible and life unbearable. It means an internalised protocol, so deeply assimilated that it no longer requires conscious deliberation, whereby any new or modified element in a familiar communication automatically triggers a verification step before action.
Invoice with a new IBAN: I verify. Urgent email from the boss requesting a confidential transfer: I verify. The link in the notification that appears to come from the bank: I don't click — I open the bank's website directly in the browser. An attachment from a known sender who did not usually send attachments: I ring before I open it. Not anxiety. Not suspicion. Protocol. As automatic as a seatbelt — you don't put it on because you are afraid, you put it on because it is part of the sequence of gestures that means you are setting off in the car.
What I learnt writing this
There is something I had not anticipated when I began this series and which I understand now, at the end of it, sitting with the second coffee of the morning — the first finished without my noticing, which happens when I write and thinking absorbs sensation — and with Gri, who has moved from the window ledge to the chair beside me and is now sleeping with her head on her front paw in a position that looks uncomfortable and seems perfect simultaneously.
What I had not anticipated is that in writing about security I was, in fact, writing about attention. That everything useful that can be said about protecting a small firm from digital scams reduces, in the end, to the quality of the attention you bring to what you do. Not to the technology you use, not to the budget you allocate, not to the courses you attend or the certificates you obtain. To attention. To the real, complete, undivided presence you bring to the moment when you open an email, check an invoice, authorise a transfer.
And attention, I discovered or confirmed, is a resource entirely different from money or time — harder to manage, harder to conserve, more sensitive to the conditions in which you use it, and more valuable than either of the others in the moments that truly matter.
I wrote this thinking of the entrepreneurs of Botoșani and of the whole north-east of Romania, people who run small firms with small resources in economic conditions that do not structurally favour them, who manage through ingenuity and perseverance and through that specific resilience of the person from Moldova who has learned for generations that you cannot depend on favourable external conditions and that what you control is narrower than you would wish but wider than you believe if you look carefully. People for whom a cyber attack is not an incident absorbed from quarterly profits but a potential existential blow, a sum that can mean unpaid salaries or disgruntled suppliers or lost clients or simply the sleep of several nights that does not return.
My son and the question he will ask
At some point — I don't know when, perhaps in a year, perhaps in five — my son will run something. A firm, a project, a team, something that will be his and for which he will be responsible and into which he will put more of himself than he thinks he will. And at some point he will receive an email that is not what it appears, or an invoice with a new IBAN, or an urgent and confidential request from someone who appears to be someone trustworthy.
I do not know what he will do in that moment. I cannot know, because that moment will be his, in his conditions, with his fatigue and his attention and his experience at that point in his life, which is completely opaque to me. But I know there is something I can do now, in the days and months and years that are ours together, that can infinitesimally influence that future moment: I can show him what attention looks like in practice. I can verify in front of him before I pay, I can ring the supplier when something is not clear, I can explain why I do this without turning it into a lesson with an explicit moral, but simply a normal gesture, part of how we do things.
The things you inherit are never the ones someone preached to you. They are the ones you saw being practised, the things that entered you through the lateral paths of observation and unconscious imitation, the things that are activated in you years later in moments you had not anticipated and in which you recognise, with an emotion that is difficult to name, the gesture of someone who is no longer here.
My father never taught me a lesson about verification and attention and healthy distrust. He showed me how you finish a job: by going through it once from the beginning, with your own eyes, without relying on what you already knew you had found.
The synthesis — seven things that remain
I do not wish to close with a list, because lists are the consolation of those who wish to believe that complex things reduce to numbered steps. But there are a few things that remain after everything I have written, a few certainties I hold more firmly now than I held them before writing, and it seems honest to those who have read this far to formulate them directly, without ornament.
You are a target. Not because you are important, but because you are accessible. Accepting this as a starting point — not as a reason for anxiety but as operational information — fundamentally changes how you relate to the digital security of your firm.
The most effective scams do not attack your systems; they attack your mind. Any investment in security that does not include an investment in educating your own mind and the minds of the people you work with is an incomplete investment.
Fabricated urgency is the primary weapon. Any communication that artificially compresses the decision-making time deserves, precisely for that reason, more time for verification — not less.
Verification is not distrust. It is protocol. Your legitimate suppliers understand this. Those who do not offer, through their reaction, a separate piece of information that is worth processing.
A three-minute phone call is worth more than any security system installed on a server you have never checked. Technology helps. People decide.
Preventive culture is built in small, repeated conversations — not in annual courses and forgotten procedures. The behavioural model you offer is more powerful than any rule you impose.
You are not alone. There are institutions, resources, networks, and people who can help. The condition of access to them is knowing they exist and having the humility to ask for help before a crisis, not after.
My son has woken up. I can tell by the specific sound of his bathroom door, by the footsteps in the hallway, by the specific silence of someone standing in the kitchen doorway watching you before saying anything. I turn round. He is there with dishevelled hair and that morning expression he has had since he was small — simultaneously sleepy and attentive, as though his brain is already awake but the body has not yet received the notification.
What are you doing? he asks.
Writing, I tell him.
About what?
I think for a second. About how not to be deceived.
He looks at me with that look adolescents have for parents — a look containing in equal proportions affection and indulgence towards the inexplicable preoccupations of adults — and goes to make himself some tea.
Gri opens one eye, follows him crossing the kitchen, then closes it again.
Outside it is already light.
What This Article Is Not
The author's acknowledged limitations
There is a specific moment in the process of any long text in which the author, if sufficiently honest with themselves, stops and asks what exactly they claimed to do and what they actually did. Not as an exercise in performative humility — performative humility is one of the most irritating forms of vanity, because it dresses itself in the clothes of modesty in order to attract precisely the kind of attention it claims to refuse — but as an act of intellectual hygiene, as a sincere check of the distance between intention and execution, between what you believe you have said and what the reader understood.
I am sitting now at my desk in Botoșani, on a Thursday afternoon with that specific quality of end-of-day light in which the sun no longer warms but has not yet completely disappeared, a light that makes everything look slightly older than it is, slightly more tired, slightly more worn, and I am looking at the seven sections I have written over the past few weeks and trying to be honest about what they are and what they are not.
Gri is on the desk. Not beside the desk, not on the chair beside the desk, but on the desk itself, directly on the keyboard of my secondary laptop, where she sits with her full weight of four and a half kilograms with a satisfaction she expresses through the simple absence of any intention to move. I have moved her three times. She has returned three times. On the fourth lift she raised her gaze to me as well, held it there for two or three seconds with that expression which in cats signifies a range of things of which none is assent, and I realised I was losing this battle and that it was more productive to move my own laptop than to continue moving the cat.
This is me. This is the context from which everything you have read came.
It is not a technical guide and never claimed to be, but sometimes it forgot that
The first and most important limitation I must acknowledge is this: everything I have written is filtered through the experience of a man who builds websites in Botoșani, who works with Joomla and with town halls and hospitals and private firms in north-eastern Romania, and who has read enough about cybersecurity to be dangerously confident in his own conclusions without being a specialist in the field.
I am not a cybersecurity specialist. I have no certifications in the field — no CISSP, no CEH, no CompTIA Security+, no formal accreditation attesting that what I say has been verified by an institution that verifies such things. I have practical experience, I have read widely, I have lived through several incidents and helped clients navigate others, and from all of that I have extracted a set of convictions which I have presented with a narrative fluency that may create the illusion of an authority I do not possess in the strict professional sense.
Narrative fluency is dangerous for precisely this reason: it mimics competence. A well-written text sounds convincing independently of the quality of its technical content, and a reader who does not have the means to distinguish between the two may take as verified truth what is, in reality, informed opinion. Informed opinion is valuable — I am not discarding it — but it is different from certified expertise, and the difference matters especially when we are talking about fields in which mistakes have real consequences.
My sincere recommendation: everything I have written in this series should be verified with a real specialist before you apply it in high-stakes contexts. A security consultant, a security audit of your infrastructure, a session with an accredited DNSC specialist. My text may be a starting point for more competent conversations. It cannot be the sole point of reference.
It does not know your specific situation and sometimes proceeded as though it did
I wrote about entrepreneurs from Botoșani and from north-eastern Romania with a familiarity that my experience partly justifies and that inevitable generalisation partly distorts. My firm is different from your firm. My clients are different from your clients. My infrastructure, my exposure, my specific risks are configured by a combination of factors I do not know about you and which my text has had no way of taking into account.
I said make backups without knowing whether you have your own server or use exclusively the cloud, without knowing whether you work with sensitive data requiring specific encryption or with public data requiring no special protection, without knowing whether you have two collaborators or twenty, whether your firm is in services or manufacturing or retail, whether you have already had incidents or not, whether your point of maximum vulnerability is email or server access or the accountant who works from home on a personal laptop running Windows 7.
The practical steps I described in the fourth section are real and valid in the sense that they are not harmful and represent an improvement over the absence of any measures. But the order of priorities among them, the depth of implementation required, the specific complexity of each step in your particular context — all of these require an individualised assessment that an article, however long and however well-intentioned, cannot substitute.
It is deeply personal and that simultaneously limits and defines it
My father appears in every section of this series. Gri appears in every section. My son appears in almost every section. Botoșani appears. The cold coffee appears. The Thursday evenings with tea appear. And if you are a reader from Bucharest or Cluj or Timișoara or from entirely outside Romania, it is possible that all these elements have created a distance, a sensation that the text was written for someone specific, not for you, that you are reading it as though looking through someone else's window.
That is a real limitation. I chose to write personally because I believe useful information goes deeper when it comes wrapped in concrete experience than when it comes stripped of all human context, like an assembly instruction for a household appliance. But that choice has a cost: the alienation of those for whom my context does not resonate, those who did not grow up in Moldova, who do not have mechanic fathers who are gone, who do not have cats with a philosophical temperament, who run firms with ten employees not two, who work in sectors I have not mentioned.
I do not know how I could have entirely avoided this limitation without sacrificing precisely what makes the text, in my view, more useful than its technical and impersonal alternative. I bet on the personal. That bet wins for some readers and loses for others, and it is a minimum of honesty to acknowledge it.
It is not updated in real time and will age
Everything I have written about the types of scam currently active, about the recommended protective tools, about the available institutional resources, about the specific platforms and services I have mentioned — all of this has an expiry date which I do not know but which certainly exists.
The landscape of digital fraud changes faster than any text that describes it. Tactics evolve, tools update, institutions reorganise, platforms disappear or are replaced. The Bitwarden I recommended may be compromised tomorrow. DNSC may change its reporting procedures. A new, more sophisticated form of BEC may make all the warning signals I have described irrelevant, replacing them with others I have not anticipated.
The principles remain valid longer than the details. Fabricated urgency as a psychological weapon, domain deviation as a technical tactic, changes to known parameters as a warning signal, independent verification as a protocol — these have greater durability because they are based on cognitive mechanisms and on manipulation logics that do not change at the same speed as technical tools. But the implementation details, the specific platforms, the concrete procedures — verify these with up-to-date sources before applying them as though they were fresh.
It has not said everything it knows and sometimes did not know what it claimed to know
There are subjects I have touched on tangentially that deserve separate, more rigorous, more technical treatments: the specific security of Joomla websites, which is my main infrastructure and in which vulnerabilities are different and more nuanced than I was able to describe in the economy of this text; security in the context of public procurement and contracts with state institutions, which adds layers of legal and procedural complexity I have not addressed; security for personal data processors under GDPR, which involves specific notification and incident documentation obligations I mentioned tangentially without treating seriously; and security in the context of NIS2 and Government Emergency Ordinance 155/2024, relatively recent legislation with significant implications for certain categories of operators which I have ignored entirely in these pages.
I ignored them not out of negligence, but out of a deliberate decision to keep the text accessible to a broad, non-specialist audience. But this decision has a real cost for readers who operate in areas where these subjects are directly relevant, and it is honest to acknowledge it.
There are also things I said with a confidence that, on closer examination, exceeded what I knew with certainty. Not lies, not fabrications — but generalisations from my specific experience presented with less of a question mark than they deserved. My experience is real and it is vast within its specific context. But my specific experience is not representative of all small firms in all possible contexts, and I sometimes forgot to make this distinction clearly enough.
What it is, nonetheless
I have spent several hundred words saying what this series is not and what it has failed at and where it has gone wrong, and that is fair, it is necessary, it is the only way I can be at peace with what I have published. But it is also incomplete if I stop there, if I let the last impression be a list of limitations without also saying what I believe it has succeeded at, because self-flagellation without discrimination is just as insincere as self-praise without discrimination — both avoid genuine evaluation in favour of a simpler emotional gesture.
I believe this series has achieved something that most of what is written about cybersecurity for small firms in Romania does not: it has placed the subject in the body of a real person, in their real day, in their real fatigue and attention and real relationships, and has shown that security is not a technical layer added on top of business life but a dimension of it, as integrated into everyday life as invoicing and client communications and paying suppliers.
If someone who has read this series does, as a result of it, a single thing they were not doing before — verifies a new IBAN before paying, or activates 2FA on their business email, or has an honest conversation with their collaborator about what a suspicious email looks like — then the entire effort has been worthwhile and all its limitations are, in the context of that concrete and modest and real effect, secondary.
No more than that. But no less either.
Gri has climbed down from the keyboard of my secondary laptop. I don't know when, I don't know why, I don't know where she has gone. She probably found something more interesting to examine elsewhere in the flat — a movement invisible to me, a sound below my auditory threshold, something that merits her complete and immediate attention, without any trace of hesitation or regret at the place she was abandoning.
That is what cats do: they are completely present wherever they are, without carrying with them the weight of the places they have been. It is a talent I do not have and which I do not know whether I envy or admire or simply observe with the kind of neutral attention you give to things that fascinate you without hurting you.
Outside it has grown dark. It is Thursday evening. Tomorrow is Friday.
I shall go and make some tea.
10 Questions with an Essentially Practical Answer
What you do tomorrow morning, concretely
I sit with this list in front of me and think that good questions are always harder to formulate than answers. The answers we mostly know — I have written them across seven sections and several thousand words. Questions are what decide whether the answers get somewhere or remain as fine text on a screen we close and move on from. Here are ten questions I ask myself and which I put to you, with an essential, practical answer applicable tomorrow morning.
1. Do you know how many active digital accounts your firm currently has?
Essential answer: Probably not. Take a sheet of paper — not a Word document, not an app, a physical sheet — and write down every account: hosting, email, internet banking, invoicing platforms, social media, government portals, cloud providers. Any account with a password. Count them. The real number is almost always larger than you think. Do this before the first email tomorrow. It takes ten minutes and is the first step in any real security strategy.
2. On how many of these accounts do you have two-factor authentication activated?
Essential answer: If the answer is less than half, you have a concrete and solvable problem — today. Absolute priority: business email, internet banking, hosting account. Install Google Authenticator or Authy — free, three minutes — and activate 2FA on those three priority accounts tomorrow morning. Save backup codes on paper, in a physical drawer. Not in your phone. Not in email. Paper.
3. The last time you received an email with a new IBAN from a supplier, did you ring to verify or pay directly?
Essential answer: If you paid directly, you were lucky or the supplier was legitimate. Next time — and there will be a next time — apply the rule without exception: any new IBAN, any modified banking details, mandatory telephone verification using the number you already know, not the one in the email. Write this on a Post-it note and stick it beside your computer. It is not corporate procedure. It is the reflex that costs one minute and may save thousands of pounds.
4. Do your employees or collaborators know what a phishing email looks like?
Essential answer: If you have never shown them a concrete example, they do not. This week, before Friday, send them a short email with a real phishing example — you will find one on phishtank.com or on the DNSC website — and tell them three things: check the full sender address, not just the display name; any financial urgency is confirmed by phone; you have my explicit permission to ask before paying anything. That is all. A ten-minute conversation that changes a reflex.
5. If your server or main computer were encrypted by ransomware tomorrow morning, could you recover your firm's data?
Essential answer: If the answer hesitates, your backup is insufficient. The 3-2-1 rule: three copies, two types of storage, one off-site or on a separate cloud. Minimum applicable tomorrow: check whether your hosting automatic backup is working and when it last ran. Buy a 1TB external hard drive — it costs very little — and perform a full manual backup of your firm's documents. Disconnect the hard drive after the backup. Repeat on the first day of every month.
6. Is your business email password used on any other account?
Essential answer: If yes, change it now, not tomorrow. Install Bitwarden — free, open source — and generate a new, unique password of at least sixteen characters for your business email. The master password of the password manager you write on paper in two copies and store in different physical locations. The complete migration of all passwords to the manager takes one afternoon. Schedule that afternoon in your calendar this week.
7. Does a written procedure exist in your firm for what you do when you receive an urgent financial request by email?
Essential answer: If not, write it now, on an A4 sheet, in three rules: no payment with new banking details without telephone confirmation; no urgent payment on the basis of an email alone without verbal verification; any email containing urgent, confidential, or don't discuss this with anyone is automatically treated as suspect. Print the A4 sheet. Put it next to the computer of the person who makes payments. If that is you, put it next to your computer.
8. Do you know the full email address of your five most important suppliers, not just their display name?
Essential answer: Open now the last legitimate email from each of those five main suppliers. Do not read the content — look at the sender's full address, including the domain after @. Make a note of it. Next time you receive an email appearing to come from them, you compare against the note, not against memory. Memory is unreliable. The note is fixed.
9. Have you ever checked whether your business email address has appeared in a data breach?
Essential answer: Go now to haveibeenpwned.com. Enter your firm's email address. If it appears in breaches, change the password for that account immediately and check whether the same password is used on other accounts. Check personal addresses too if you occasionally use them in connection with the firm. It takes two minutes and tells you something concrete about your current exposure, not a theoretical one.
10. If a collaborator of yours clicked on a malicious link right now, would you know within the next thirty minutes?
Essential answer: If you do not have a monitoring system — and you probably don't, because you are a small firm and monitoring is expensive — then the only available mechanism is a culture of reporting. Tomorrow, tell explicitly every person you work with: if you have opened something suspicious, tell me within thirty minutes, not the next day, not next week, now. That I won't tell you off. That I prefer to know immediately. That the intervention window closes quickly and open is the only one that matters. The explicit permission to report without fear is, in the absence of monitoring technology, your only early warning system.
Ten questions. Ten answers. Each answer contains an action that can be taken tomorrow morning before the first email of the day, or at the latest before the end of the week. Not all at once — one per day for ten days is more sustainable and more durable than all ten in a single Saturday of enthusiasm that never repeats.
My father used to say that a half-repaired car is more dangerous than one that is fully broken, because the fully broken one won't start and you know it won't start. The half-repaired one starts, runs for a while, and leaves you stranded right in the middle of the road.
Half-hearted security works the same way.
Complete Bibliography
Verified, accessible, free resources — with the author's annotations
I sit with this list in front of me and realise that a bibliography is, at its core, an autobiography of a thinking process. It does not say only what you have read — it says how you thought, what you leant on when you did not know, where you returned when you got lost, what you found useful and what you found decorative and what you found after you had finished writing and realised you should have found it before. I spent longer than I expected in front of this list, not because the resources are hard to find, but because I wanted to be honest about every link I include — to have opened the page, to have read at least what it promises to offer, not to build a decorative bibliography of titles that sound good and addresses leading somewhere vaguely relevant.
Every resource below I verified personally in the weeks in which I wrote this series. Some I have been using for years. Others I discovered during the documentation process and have integrated into my current practice. The annotations are personal, not marketing summaries.
Romanian institutions with a cybersecurity mandate
National Directorate of Cyber Security (DNSC) https://dnsc.ro
The main page of the Romanian institution with an explicit national cybersecurity mandate. The alerts section publishes notifications about active threats, ongoing phishing campaigns, and vulnerabilities identified in Romanian infrastructure. I recommend subscribing to their newsletter — the form is on the site — which sends alerts periodically, without spam, with concrete and actionable information. Here too you will find best-practice guides adapted to the Romanian context, including materials explicitly aimed at SMEs and small public institutions. I discovered DNSC existed not through a course or a recommendation, but because I received an email from them — a notification about a vulnerability on a site in my portfolio, sent before the vulnerability had been exploited. That email made me understand I was not alone in the face of the internet.
CERT-RO — National Centre for Cyber Security Incident Response https://cert.ro
The operational arm of DNSC, the team that actually manages reported incidents. The page contains the incident reporting form, periodic statistics about types of attacks recorded in Romania, and an educational resources section updated with a regularity that Romanian institutional funding does not favour, but which contains useful material, particularly in the archive. If you have had an incident, this is where you report it. Reporting does not automatically trigger an inspection and is not a declaration of guilt — it is a contribution to the collective database that protects everyone who is connected.
National Supervisory Authority for Personal Data Processing (ANSPDCP) https://www.dataprotection.ro
Relevant for any small firm that processes clients' personal data — which means almost any small firm. The section dedicated to data controllers contains GDPR compliance guides in Romanian, including a guide specifically for SMEs without the resources for a dedicated Data Protection Officer. More importantly: if you have suffered a data breach involving your clients' personal data, you have a legal obligation to notify ANSPDCP within 72 hours. The notification procedure is on this website. The 72-hour deadline is not a recommendation — it is an obligation with concrete legal consequences for non-compliance.
National Authority for Consumer Protection (ANPC) https://anpc.ro
Better known in the context of classic commercial disputes, but with a mandate covering part of the spectrum of commercial fraud as well — forged invoices issued in the name of real firms, fraudulent commercial practices, scams that take the form of apparently legitimate transactions. A complaint does not recover lost money and does not guarantee a swift investigation — the system is overstretched and underfunded, a reality there is no point concealing — but it creates an official document useful if the situation escalates to legal proceedings or an insurance compensation claim.
General Inspectorate of the Romanian Police — Cyber Crime Combating Service https://www.politiaromana.ro/ro/combaterea-criminalitatii-informatice
The specialist structure in cybercrime, with territorial branches in every county. The page contains information about types of computer offences, the procedure for filing criminal complaints, and contacts for territorial structures. If the loss is real and the documentation is solid — original emails with complete headers, bank statements, a written chronology — a criminal complaint is the legal instrument that can trigger an investigation with real coercive power.
International reference resources
Have I Been Pwned https://haveibeenpwned.com
Created and maintained by Troy Hunt, one of the most respected independent security researchers. Enter your email address and find out immediately whether it has appeared in any publicly documented data breach. Free, no registration required, no adverts. I verified all my own and my firm's addresses on this site and recommend you do so immediately after finishing reading this bibliography. There is also an option for automatic notification if your address appears in future breaches — a function I consider as useful as any other security alert you can activate free of charge in three minutes.
VirusTotal https://www.virustotal.com
Free tool for analysing suspicious links and files. Copy a URL or upload a file and it is analysed simultaneously by over seventy security engines, returning an aggregated verdict in a few seconds. It is not infallible — new links are not yet in databases — but it catches a significant proportion of attacks distributed by email. I use it whenever I receive an unexpected attachment or a link from an unverified source. It takes ten seconds and costs nothing. There is also a browser extension for direct verification without manually copying the URL.
PhishTank https://phishtank.org
A collaborative database of verified and community-reported phishing sites. Useful in two ways: to check whether a specific URL is known as malicious, and to see real examples of active or recent phishing pages — useful if you want to show your collaborators what an impersonation attack looks like in practice. Operated by Cisco Talos, one of the serious global threat intelligence teams. The contributing community is active and updates are frequent.
ENISA — European Union Agency for Cybersecurity, SME section https://www.enisa.europa.eu/topics/cybersecurity-education/awareness-raising
The awareness-raising section of ENISA contains free educational materials for SMEs, including practical guides, employee training kits, and annual reports on the European cyber threat landscape. Quality varies — some materials are excellent, others too generic — but there is a section explicitly dedicated to SMEs worth an hour of exploration. Materials are available in several European languages, not all in Romanian, but those in English are accessible to anyone who has completed secondary school.
FTC — Federal Trade Commission, Small Business section https://www.ftc.gov/business-guidance/small-businesses
An American institution with American jurisdiction, but with educational materials for small firms that are among the clearest and best-structured available free online in the English language. The guide on Business Email Compromise and the one on forged invoices are reference points I used directly in documenting this series. The language barrier exists, but for anyone who reads English it is a valuable resource that surpasses its European equivalents in clarity and immediate practical applicability.
Cybersecurity & Infrastructure Security Agency (CISA) — Stop Ransomware https://www.cisa.gov/stopransomware
The page dedicated to preventing ransomware attacks, with prevention guides, preparedness checklists, and incident response resources. It also contains a section of alerts about active ransomware campaigns targeting specific sectors. Again an American institution with materials in English, but with universal applicability for the logic of attacks and prevention steps. The ransomware preparedness checklist is the document I recommend to anyone wanting a quick audit of primary vulnerabilities without engaging a consultant.
IC3 — Internet Crime Complaint Center (FBI) https://www.ic3.gov
The American cybercrime reporting centre, relevant indirectly for Romanian entrepreneurs through the fact that it publishes annually the Internet Crime Report — the most comprehensive publicly available document about types of cyber attacks, associated financial losses, and trends in the current year. The annual report is available free on the site in PDF format and is the reading I recommend to anyone wanting to understand the real scale of the phenomenon, not in abstract terms but in concrete figures and specific categories of victims.
Free tools
Bitwarden https://bitwarden.com
The password manager I recommended in the fourth section. Open source, independently audited, free for personal use and for small teams. Its philosophy is cloud-first: the password database is stored on Bitwarden's servers, encrypted with a key that only you hold, accessible from any device through automatic synchronisation. The convenience is real and the price is zero for basic functionality. I have no commercial relationship with them — the recommendation is based solely on two years of daily use without incident.
KeePassXC https://keepassxc.org
There is a distinction I understood late and which I now consider fundamental in choosing a password manager: the difference between storing your secrets on someone else's server and storing them on your own computer, in a file you control completely, that you can move, copy, archive, and delete according to your own logic, without depending on the continuity of a cloud service you did not build and do not entirely understand.
KeePassXC is the password manager for someone who wants this second option. Open source, free without restriction, no account required, no cloud synchronisation unless you want it, no monthly subscription reminding you at every invoice that your security is leased, not owned. The password database is a single file encrypted with AES-256, which you put wherever makes sense to you — on the office computer, on a USB drive kept in a drawer, on an external hard drive, anywhere that suits you. If you want synchronisation between devices, you do it yourself, with your own tools, through Nextcloud or any other solution you control.
I discovered it after having used Bitwarden for two years and being satisfied with it, and immediately understood that these are two different philosophies, not two competing products. Bitwarden is for someone who accepts the convenience of automatic cloud synchronisation in exchange for trust placed in an external server, however well audited it may be. KeePassXC is for someone who wants to know that their password file exists physically, tangibly, in places they have chosen, and that if someone's server shuts down tomorrow, their passwords remain exactly where they put them.
It is not a choice about paranoia. It is a choice about the model of control you want over your essential data. Both options are incomparably better than no option, or than the shameful option of an Excel file with passwords in the Desktop folder. Available for Windows, macOS, and Linux.
A note on the operating system — what I use and why I do not recommend the same thing
I have been running Linux for many years. A desktop distribution I installed one Saturday afternoon ten years ago when my son was small and the house was quiet and I decided it was the moment to do something I had long put off — a migration I considered necessary for reasons I could articulate technically: greater control over the system, a smaller attack surface, the absence of Windows telemetry sending data somewhere about what you do on your own computer — and which I had put off for reasons I could articulate equally clearly: time, friction, familiarity with a known environment, and that specific kind of intellectual laziness that dresses itself in the clothes of pragmatism and tells you that what works need not be changed.
I made the migration. It went well. I work on Linux every day, on the same laptop on which I wrote this series, at the same kitchen table where Gri knocks over glasses of water and where the coffee goes cold while I write, and I have no intention of going back. And precisely because I like it and precisely because I use it every day, I do not recommend it.
I do not recommend it because this series was not written for me. It was written for the entrepreneur in Botoșani or Suceava or Iași who has a small firm, who works on Windows because Windows is what came on the computer they bought and because Windows is what their accountant knows and what their collaborator knows and what Romanian invoicing software supports without trouble and what the public procurement platforms and the internet banking applications and all the other tools of everyday business life in Romania in 2026 are compatible with. Security is not an exercise in technical purity. It is a balance between protection and functionality, between the ideal and what is sustainable in the real life of someone running something. Windows with updates activated, a decent antivirus, 2FA on all important accounts, and the procedures described in this series is incomparably better than Linux on a computer operated by someone frustrated who has abandoned half the tools they used to work with because they are no longer compatible.
I use Linux. I do not recommend Linux — reasons here. Both sentences are true and do not contradict each other.
Google Authenticator https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2 (Android) https://apps.apple.com/app/google-authenticator/id388497605 (iOS)
The two-factor authentication app I recommend as an entry point for those who have never used 2FA. Free, simple, works offline. The main limitation: it does not automatically back up codes, so if you change your phone without manually migrating the app you lose access to the protected accounts. For anyone encountering 2FA for the first time and wanting to understand how it works before investing time in a more complex solution, it is the correct starting point.
Authy https://authy.com
The alternative to Google Authenticator with automatic encrypted backup — solves the problem of losing access when changing phones. Free, available on all platforms including desktop, synchronisation across devices. I recommend it to those who work from multiple devices or who have ever changed their phone and been through the nightmare of recovering access to accounts protected with 2FA without saved backup codes. That nightmare has an irreversible pedagogical quality, but it is easier to avoid than to live through.
Romanian legislation and compliance
Law 362/2018 on the security of networks and information systems https://legislatie.just.ro/Public/DetaliiDocument/208651
The Romanian transposition of the NIS Directive, with specific obligations for operators of essential services and providers of digital services. If your firm falls within the regulated categories, reading it is mandatory. If not, it is useful background for understanding the legislative framework within which the institutions you work with as suppliers operate — the town halls, hospitals, and schools that are my direct clients and which have specific obligations under this act which I, as their supplier, must understand in order to help them comply.
Government Emergency Ordinance 155/2024 on cybersecurity https://legislatie.just.ro
The most recent major legislative act in the field, transposing the NIS2 Directive into Romanian law. Search the site by the act number. It significantly extends the circle of entities required to comply with cybersecurity requirements, including categories of SMEs not previously covered. If you work with public authorities or operate digital infrastructure relevant to essential services, check whether you fall within the regulated categories. The penalties for non-compliance are real and have begun to be applied.
GDPR — General Data Protection Regulation, consolidated Romanian version https://eur-lex.europa.eu/legal-content/RO/TXT/?uri=CELEX%3A32016R0679
The full text of the GDPR in Romanian, on the EUR-Lex platform. It is not easy reading and I do not recommend reading it in full without a specific reason — it is an eighty-page legal document with all the complexity of the genre. But Articles 32 to 34, which address the security of processing and the obligations to notify breaches, are directly relevant to any firm that processes personal data and are worth reading carefully and, if necessary, with a solicitor present.
Law 161/2003 on measures for ensuring transparency in the exercise of public office and in business, the prevention and sanctioning of corruption — Title III https://legislatie.just.ro/Public/DetaliiDocument/43323
Title III of this law — often overlooked because the law is better known for its sections on incompatibilities and conflicts of interest — defines computer offences in Romanian law: unauthorised access to computer systems, illegal interception, alteration of data integrity, disruption of system operation. It is the criminal framework within which cyber attacks are classified as criminal acts, useful to know both for understanding what you can report and for understanding what constitutes an offence in the sense of Romanian law, not merely in common parlance.
This bibliography was verified in May 2026. The links were functional at the date of publication. The digital landscape changes, institutions reorganise, platforms migrate — if you find a broken link, search directly for the name of the institution or resource; do not abandon the search.
No resource in this list implies any commercial relationship or affiliation with the author. All are free. All have been used personally. Those I have not used personally are implicitly marked by the absence of an annotation confirming direct experience — the absence of personal detail is, in this bibliography, a signal in itself.