Phishing

What it is

Phishing is the practice of sending deceptive messages, usually email, but also SMS (smishing) and phone calls (vishing), that impersonate a trusted person or brand. The goal is to trick the recipient into clicking a malicious link, entering their password on a fake login page, opening a malware-laden attachment, or handing over sensitive information. It is the single most common entry point for business cyber attacks.

How it works

1. 1

   The attacker impersonates a trusted sender: a bank, Microsoft, a supplier, or a senior colleague.

2. 2

   The message creates urgency or fear, for example "your account will be suspended" or "approve this payment now".

3. 3

   A link leads to a convincing fake login page, or an attachment carries malware.

4. 4

   The victim enters credentials or runs the file, handing the attacker access.

5. 5

   Stolen credentials are used to access email, steal data, or launch a larger attack such as ransomware or invoice fraud.

Business impact

• Compromised email accounts leading to data theft and further fraud
• Financial loss through fraudulent payments and invoice redirection
• Malware or ransomware footholds inside your network
• Breach of customer and staff personal information

How to defend against it