Phishing doesn't catch the uninformed, it catches people in a hurry
The person who opens the wrong link is rarely a careless or inexperienced colleague. It is the person in accounts with twenty invoices to record at the end of the month, the salesperson reading email on their phone between customer visits, the warehouse manager receiving yet another shipping notification. Phishing imitates everyday habits and arrives when there is no time to think.
People know that phishing exists. What they need is to recognise it in the middle of normal work, to be able to report it effortlessly and to have technical defences that limit the damage when someone clicks.
The forms it takes today
- Generic email: the parcel awaiting collection, the full mailbox, the shared document. It relies on sheer numbers.
- Spear phishing: a tailor-made message, with the name of a real supplier, an ongoing project, the right tone.
- CEO fraud and fake supplier fraud (business email compromise): an email that appears to come from the owner asks for an urgent, confidential bank transfer, or a regular supplier announces its "new bank details". Often there is no link or attachment at all, just a plausible request.
- Smishing and vishing: the same scheme by text message or over the phone. The fake technician calls and asks for the code that has just arrived on your mobile.
- QR codes: inside a PDF or in the body of the email, they move the victim onto their personal phone, where company controls often do not reach.
- Fake Microsoft 365 login pages: identical to the original, they ask you to sign in again to read a document. The most advanced ones sit between you and the real site and capture the code for the second verification step as well.
The signs to look for
No single sign is proof on its own, but two together are reason enough to stop and ask.
- unusual urgency or secrecy: "by the end of today", "don't mention this to anyone";
- the sender's name is right, but the actual address is not, or the domain has one letter changed;
- the request changes an established procedure: a new IBAN, a payment outside the usual process, buying gift cards;
- the link, when you hover over it with the mouse, leads to a different address from the one shown;
- the login page opens from a link, rather than from a bookmark or by typing the address;
- the phone call asks for codes, passwords or for you to install a remote support program.
Why one hour of training a year is not enough
A once-a-year classroom course is soon forgotten, and uses examples that attackers have already stopped using. A habit built up over time works better.
- Short, regular simulations: realistic test emails that keep changing, with a one-minute explanation straight away for anyone who falls for them.
- An easy way to report: a button in the email client or a dedicated address. If people have to look for someone to call, nobody does it.
- Blame-free reporting: anyone who reports, even after clicking, gets a thank-you. People who fear a telling-off keep quiet, and precious minutes are lost.
- Measure reports, not just clicks: the click rate tells you how many people fell for the test, the reporting rate how many are acting as an early warning system. The more reports come in, and the sooner, the faster a real attack is detected.
The rule that stops IBAN fraud
Every request to change a supplier's bank details, or to pay in a different way from usual, is verified with a phone call to a number you already have: the one in your supplier records or on the contract, never the one given in the email or the signature. If the request is genuine, the supplier confirms it in a minute. If their mailbox has been compromised, the email will be perfect but the phone call will not.
A written rule takes the burden of deciding whether an email "looks genuine" off the individual. It applies to the owner too: anyone asking for an urgent, confidential bank transfer should expect a confirmation call.
The defences that limit the damage
Sooner or later someone will click: defences have to be designed for that moment. Multi-factor authentication makes a stolen password useless, and phishing-resistant methods, such as security keys and passkeys, hold up even against pages that intercept the code. Email filters stop many malicious messages before they reach the inbox and flag those coming from outside. SPF, DKIM and DMARC checks prevent a fraudster from sending emails with your domain as the sender.
In the story The Friday evening the files changed their names, the attack had started from a mailbox compromised weeks earlier.
What to do if you clicked
Tell IT straight away, even if you are not sure. If you entered your password, change it from a clean device and let IT know; if you opened an attachment, disconnect the computer from the network without switching it off. IT will check recent logins, any email forwarding rules created without your knowledge and who else received the same message.
If personal data was sent out from the compromised mailbox, the notification required by the GDPR may be triggered: we cover this in the guide on data breaches.
In short
Phishing exploits haste and habit, not ignorance. It is reduced with short, frequent simulations, easy and blame-free reporting, a verification call for every IBAN change, and technical defences, such as MFA and domain protection, that limit the damage when someone clicks.