A practical phishing checklist for small businesses: verify unusual requests, protect account access, and make suspicious-message reporting easy.