Phishing is social engineering delivered through email, text messages (smishing), phone calls (vishing) or QR codes (quishing). The goal is to trick a person into handing over credentials, approving a payment, or running malicious code.
How an attack unfolds
- Pretext — the attacker impersonates someone trusted: IT support, a supplier, a parcel service or a senior executive.
- Lure — urgency or fear (“your account will be suspended”) pushes the victim to act quickly.
- Payload — a link to a look-alike login page, a malicious attachment, or a request to change bank details.
- Action — stolen credentials or session cookies are used to access mailboxes, cloud apps and payment systems.
Common variants
- Spear phishing — tailored to one person using public information.
- Business email compromise (BEC) — fraudulent invoices or payroll changes from a real or spoofed executive mailbox.
- Adversary-in-the-middle kits — proxy the real login page to capture session cookies and bypass one-time-code MFA.
- MFA fatigue — repeated push prompts until the user approves one.
Warning signs
- Sender domain that is close to, but not exactly, the real one.
- Unexpected attachments, shared documents or QR codes.
- Requests to bypass normal process, keep things secret, or act immediately.
- Login pages reached from a link rather than your bookmark.
Defence
- Use phishing-resistant MFA such as FIDO2 security keys or passkeys.
- Publish SPF, DKIM and DMARC records and enforce DMARC.
- Give staff a one-click “report phishing” button and respond to reports quickly.
- Verify any payment or bank-detail change through a separate, known channel.
- Detect new inbox forwarding rules, impossible-travel sign-ins and new MFA devices.