Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

What is phishing? How to spot it and protect your business

In one sentence: Phishing is a fake email, text or call designed to trick you into clicking a bad link, opening a bad file or giving away a password or payment.

What it is

The NCSC defines phishing as criminals using scam emails, text messages or phone calls to trick victims. The aim is often to make you visit a website that downloads a virus or steals bank details or other personal information.

It can be sent to thousands of people at once, or written for one person (spear phishing). It nearly always pretends to be someone you trust: a bank, supplier, delivery firm, government department or your own IT team.

How it works

  1. The attacker picks a disguise and a target list from earlier breaches, websites and social media.
  2. They send a message carrying a link to a fake sign-in page, an attachment, or a request such as “pay this invoice”.
  3. The message creates a feeling. The NCSC lists the triggers: an official sender, a short deadline, a threat of a fine, curiosity or a rare offer.
  4. The victim enters their details. Some fake pages also capture the one-time code.
  5. The attacker logs in as the victim, reads email, sets hidden forwarding rules and phishes the victim’s contacts.
  6. They cash in through fraud, stolen data or a way in for ransomware.

Who it affects and how badly

Every business that uses email. Sole traders can lose a mailbox or bank account. Firms of 10 to 50 staff, such as accountancy, legal, recruitment and estate agencies, hold client money and documents, so one hijacked inbox can pass fraud to clients. Schools, charities and councils hold personal data on shared devices. Manufacturers and construction firms get fake supplier invoices.

Regulated firms add duties. Under UK GDPR a notifiable personal data breach must reach the ICO within 72 hours of becoming aware. Worst cases are a day or more of lost email, stolen client data, an unrecoverable payment, or a foothold for ransomware.

Real examples

Reddit, February 2023. Reddit’s chief technology officer said a sophisticated phishing campaign sent employees “plausible-sounding prompts” to a site cloning its intranet gateway, to steal credentials and second-factor tokens. One employee was compromised, and the attacker reached some internal documents, code and business systems. The employee reported it quickly. As quoted by CPO Magazine: https://www.cpomagazine.com/cyber-security/reddit-confirmed-a-security-breach-after-a-sophisticated-phishing-attack/

How to detect it

  • Check the real sender address, hover over links, and ask “was I expecting this?” The NCSC notes scams now fool experts too.
  • Use Report Message in Outlook or Report phishing in Gmail, and review reports weekly.
  • Check sign-in logs for logins from unfamiliar places soon after a click.
  • Look for new inbox rules, external forwarding and sent items the user does not recognise.
  • Watch for customers replying about emails you did not send.

How to fix or prevent it

  1. Switch on MFA everywhere, and use passkeys or security keys for administrators and finance staff.
  2. Set up SPF, DKIM and DMARC. The NCSC says DMARC stops phishers spoofing your domain.
  3. Enable your mail provider’s anti-phishing and safe links protection, and block executable attachments.
  4. Make reporting one click and thank people who report. The NCSC advises against reprimanding users.
  5. Use a call-back rule for payment and bank detail changes.
  6. Keep systems patched and limit admin rights.
  7. Run phishing simulations and track the report rate.

Related terms

Browse all entries in the social engineering hub.

FAQ

What is the aim of phishing? The NCSC says it is often to get you to visit a site that downloads a virus or steals bank details or personal information.

Does MFA stop phishing? It helps, but Reddit’s 2023 attack tried to capture second-factor tokens, so phishing-resistant MFA is stronger.

What if I clicked? Report it at once, change the password, and ask IT to check sign-in logs and mailbox rules.

How Wolfcore helps

Phishy runs realistic phishing simulations against your own staff and shows you who clicked, so you can train the people attackers target. See Phishy phishing simulation.