Phishing: what it is

In short

Phishing does not attack computers: it attacks people. It imitates a sender you trust (the bank, a courier, a supplier, your manager) and creates urgency. It is still one of the most common ways an incident begins, from the theft of an email account all the way to ransomware.

The variants

• mass phishing: the same message to thousands of addresses, for example a fake delivery notification;
• spear phishing: a message tailored to one person or one company, with real names and details;
• BEC (Business Email Compromise): the attacker poses as a manager or a supplier, often from a genuine mailbox that has been compromised, to get an invoice paid to a different IBAN;
• smishing by text message, vishing by phone, quishing with QR codes that lead to fake pages.

How to spot it

The typical signs: urgency or threats ("your account will be closed today"), unusual requests for money or credentials, a sender address or a link that does not match the name shown, unexpected attachments, changes of bank details communicated by email. The practical rule: if a message asks you to do something quickly that involves money or passwords, check it through another channel, for example by calling the number you already have on file.

How to defend yourself

No single defence is enough, but together they reduce the risk considerably:

• multi-factor authentication, which makes a stolen password less useful;
• configuring your email domain with SPF, DKIM and DMARC, which makes it harder to forge your sender address;
• training and regular simulations, which teach people to recognise attempts and report them;
• internal payment procedures, with mandatory verification of any IBAN change.

Example

The accounts department receives an email from the "usual supplier" with the monthly invoice and a note: "we have changed banks, here is the new IBAN". The message really does come from the supplier's mailbox, which was compromised weeks earlier. The accountant, trained to verify changes of bank details, calls the supplier's number held on file: nobody has changed banks. The payment is stopped and the supplier discovers that its email has been breached.

Related terms

• Multi-factor authentication (MFA)
• Dark web
• Supply chain attack
• Data breach