A practical look at how phishing reaches small businesses, the defenses that reduce the damage, and why a fast reporting habit matters more than a perfect catch rate.