Phishing

Phishing attacks people rather than systems. Instead of breaking through technical defences, the attacker persuades someone to open the door: log into a fake page, approve a payment, download an attachment. That is why strong software security alone does not stop it.

It comes in several forms. Mass phishing sends the same fake message to thousands of people. Spear phishing targets one person or company with personal details. Smishing uses text messages and vishing uses phone calls. Business email compromise, where an attacker poses as a supplier or manager to redirect a payment, is one of the most costly for small firms.

How it works

A typical attack starts with a message that creates urgency or fear: an unpaid invoice, a suspended account, a delivery problem, a shared document. The sender name looks familiar, and the link leads to a convincing copy of a real login page on a look-alike address, such as a misspelled brand name or a long subdomain that starts with the real brand.

When the victim enters a password, the attacker captures it, often in real time. More advanced kits also capture the two-factor code as it is typed and use it immediately, which is why app codes and SMS codes do not fully stop phishing while passkeys and security keys largely do. Other messages carry attachments or links that install malware.

Attackers who gain access to a mailbox often wait and read. They learn who pays whom, then reply inside a real email thread with "updated bank details" for an upcoming invoice. Because the message comes from a genuine account in an ongoing conversation, it is very hard to spot.

Example

A construction company's office manager receives an email that appears to come from a regular materials supplier. It sits in a real thread about an order and says the supplier has changed banks, with new account details attached. The amount matches the outstanding invoice.

The office manager follows the company's rule: any change to payment details is confirmed by phoning the supplier on a number already on file, never one from the email. The supplier knows nothing about it; their mailbox had been compromised. The payment goes to the correct account, and the supplier resets its passwords and turns on two-factor authentication.

Why it matters for your business

Phishing is one of the most common starting points for account takeovers, ransomware and data breaches, and small businesses are attractive targets because they often lack formal checks. A single fraudulent payment can be hard or impossible to recover once the money has moved. Defences are cheap: a payment-verification rule, two-factor authentication, a password manager that will not fill passwords on fake sites, email authentication records (SPF, DKIM and DMARC) on your own domain so attackers find it harder to send mail that appears to come from you, and short staff training with real examples. No defence is perfect, so make it easy and blame-free for staff to report a click quickly.

Common mistakes

• Confirming changed bank details using the phone number or email in the suspicious message itself.
• Trusting a message because the sender's display name looks right, without checking the actual address.
• Punishing staff who report clicking a link, which teaches people to hide mistakes.
• Relying on SMS codes as full protection, when fake login pages can capture and replay them.

Questions people ask

How can I tell if an email is phishing?

Look for urgency, unexpected requests for passwords or payment, a sender address that does not match the real organisation, and links whose real destination differs from the text. When unsure, do not click; go to the website by typing its address yourself or call the sender on a known number.

What should I do if I clicked a phishing link?

If you entered a password, change it immediately on the real site and on any account that shares it, and check that two-factor authentication is on. If you downloaded a file, disconnect the device and run a security scan. Tell whoever manages your IT so they can check for further access.

Can phishing happen through text messages and phone calls?

Yes. Phishing by text message is often called smishing, and by phone call vishing. The tactics are the same: a trusted-looking sender, urgency and a request to click, log in or pay. Treat unexpected messages the same way you would a suspicious email.