Phishing: what it is, how to spot it and how to protect your company

Phishing is a form of online fraud in which criminals pretend to be someone you trust, such as a bank, a supplier, a delivery company or your own boss, to make you reveal passwords, card numbers or company access. It usually arrives as an email, a text message or a fake login page. The word comes from "fishing": the attacker throws out bait and waits for someone to bite.

Phishing is the most common way into company systems. One successful message can give an attacker access to your mailbox, your files and your bank.

How an attack works

1. The criminal prepares a message that looks real, with the right logo and tone.
2. It creates urgency: "your account will be closed", "invoice overdue", "confirm your delivery".
3. The victim clicks a link to a fake page that copies the real one.
4. The victim types a login and password, and the criminal receives them at once.
5. The criminal logs in, reads your mail, changes payment details or sends more messages in your name.

Main types

• Email phishing: mass messages sent to thousands of people.
• Spear phishing: a targeted message to one person, using real names and details from your website or social media.
• CEO or invoice fraud: "the manager" asks the accountant for an urgent payment to a new account.
• Smishing and vishing: the same trick by text message (SMS) or by phone call.
• Malware phishing: an attachment or download that installs a harmful program, for example a keylogger that records everything typed.
• Fake login and QR codes: a code or link that leads to a copied login page.

Today criminals also use AI to write flawless messages in any language and even to imitate a voice on the phone. The old advice "look for spelling mistakes" is no longer enough.

Warning signs

• Pressure and deadlines: "within one hour", "last warning".
• A sender address that is almost right but not quite ([email protected]).
• A link whose real address differs from the text you see.
• A request for a password, a code or a card number. Real companies do not ask for these by email.
• An unexpected attachment, especially archives, or files asking you to enable macros.
• A change of bank details in a normal-looking invoice.

How to protect your company

• Two-factor authentication on email, bank and key systems. A stolen password alone is then not enough.
• A password manager, which fills in passwords only on the real address. A fake page will not get them.
• Email protection (SPF, DKIM, DMARC) and a spam filter.
• One rule for money: new or changed payment details are always confirmed by a phone call to a known number.
• Updates and antivirus on all computers and phones.
• Short training once or twice a year, with a harmless test message. People who know what to look for are the best protection.
• An easy way to report: make sure employees can forward a suspicious message without feeling silly.

If someone has already fallen for it

1. Change the password immediately and sign out of all sessions.
2. Call the bank if card or payment data were entered.
3. Tell your IT support and colleagues, since the same message probably went to others.
4. Check the mailbox for new forwarding rules the attacker may have added.
5. If personal data may have leaked, remember that GDPR can require you to report it within 72 hours.

Speed is the key. Quick reporting turns a disaster into a small incident.