Most offices judge their spam filter by how much junk gets through. That's the wrong test. The one that matters is the fake invoice that looks real enough to get paid.
Junk mail is annoying. A convincing fake costs money. So the question for a small business is whether the filter that came with your email is good enough, or whether it's worth paying for a better one.
What this means in plain English
Every email service comes with a spam filter. If your office uses Microsoft 365 or Google Workspace, there's one already working in the background, sorting incoming mail into "probably fine" and "probably junk".
Those built-in filters do a decent job on the obvious stuff: the miracle pills, the lottery wins, the prince with a fortune to share. What gets past them is the careful stuff. An email that appears to come from a supplier you really use, asking you to update their banking details. A "shared document" link that opens a fake sign-in page built to steal a password. A message that looks like it's from the owner asking someone in accounting to buy gift cards in a hurry.
A dedicated email filter is a second set of eyes on top of what you already have. We sell the email security that's part of Acronis Cyber Protect Cloud. It checks the links and attachments in a message before that message ever reaches anyone's inbox.
Why a small business should care
The numbers are not small. The Canadian Anti-Fraud Centre received 813 reports of spear phishing in 2025. Those are the targeted fake emails aimed at one specific business. Reported losses came to $67.9 million, which works out to about $83,000 per report. That one category made up nearly a tenth of the more than $704 million Canadians reported losing to fraud of all kinds last year.
In the United States, the FBI counted almost US$3.05 billion lost in 2025 to business email compromise, its name for the same fake-invoice and fake-boss emails. Verizon's 2026 breach report found that a person was involved in 62% of breaches.
Your staff are good at their jobs, and their jobs aren't spotting forgeries. Every bad email that never arrives is one less decision somebody has to get right.
The other side
There's a fair case against paying for more filtering.
It's another monthly cost per mailbox, on top of what you already pay for email. The built-in filtering in Microsoft 365 and Google has improved a lot, and for some offices it may be enough if it's set up properly. Many aren't.
Stricter filtering also has a price in convenience. Sooner or later it will hold back a real email, like a customer's quote request or a supplier's statement. Somebody has to check the holding folder, usually called the quarantine, and release the real ones. If nobody does, you've traded one problem for another.
Where I land
I'd still take a held email over a paid fake invoice. A delayed quote is an awkward phone call. Money wired to a criminal is usually gone.
For an office where people pay bills, handle payroll or deal with customer information by email, the extra layer is worth it. That covers nearly every office I can think of.
What to do: everyone
Slow down on any email that asks for money, a password or a change to banking details.
Confirm payment changes by phoning a number you already have, not the one in the email.
Report suspicious emails to whoever looks after your IT instead of just deleting them.
What to do: if you run the business
Find out what email filtering you have today and who set it up.
Decide who checks the quarantine, and how often.
Make it a rule that banking changes are always confirmed by phone.
Questions to ask your IT provider
What is filtering our email right now, and when was it last reviewed?
Are links and attachments checked before they reach us, or only after someone clicks?
Who gets told when a real email is held back?
Sources
Canadian Anti-Fraud Centre: Top 10 frauds in 2025
CyberScoop: FBI Internet Crime Complaint Center annual cybercrime report
Help Net Security: Lessons for organizations from the Verizon 2026 Data Breach Investigations Report
Acronis: Cloud Email Security Solution & Email Threat Protection
Is the spam filter that came with your email good enough, or is it worth paying for a better one?
Tell me where you land on LinkedIn or X.
Contact Nautalex to see how we can help you with better spam filtering.
