The days when you had to be a Fortune 500 company to be targeted by phishing attacks are gone. Set up a responsive e-mail contact for customers who’ve received messages pretending to come from you, issue website warnings about fresh attacks, and train customers not to click e-mailed login links - by not sending any yourself.