The cyber attack on M&S cost over £100 million and started with a phone call, not a technical exploit. Here is what UK small businesses need to know about social engineering attacks, and what to do to protect yours.