Phishing: types, warning signs and how to reduce the risk
Phishing is how most attackers start: one convincing message, one click or one payment. This guide covers what a phishing attack is, the types a business actually meets — from spear phishing and business email compromise to QR codes and AI-written lures — how to spot a phishing email, and how to manage phishing as a risk with controls and indicators rather than posters.
Phishing is a message that impersonates someone you trust to make you hand over credentials or payment details, run malware or send money. It arrives by email, text, phone call, QR code or chat. The most damaging version for businesses is business email compromise, where a fake or hijacked email account redirects a payment. Reduce the risk with phishing-resistant multi-factor authentication, email authentication (SPF, DKIM, DMARC), a rule that payment changes are verified by phone on a known number, and a culture where people report suspicious messages quickly. Track click and report rates as key risk indicators.
Put this into a living risk registerRisk Samurai gives you a ready-made register: score risks on your own scales, assign owners and track actions, with no spreadsheet to maintain.
Get early accessWhat is phishing?
Phishing is a form of social engineering: the attacker manipulates a person rather than breaking a system. The message pretends to come from a bank, a supplier, a colleague, a delivery company or a software provider, and asks you to do something that feels routine — sign in, open an invoice, approve a request, scan a code, pay a bill. The action hands the attacker what they want: your password, a foothold on your laptop, or your money.
A phishing attack usually has one of three goals:
- Credential theft — a link to a fake login page for Microsoft 365, Google Workspace, a bank or a payroll portal.
- Malware delivery — an attachment or download that installs remote access tools, often the first step of a ransomware attack.
- Direct fraud — persuading someone to pay a fake invoice, change a supplier’s bank details or buy gift cards.
Phishing is one threat among many in a cybersecurity risk assessment. It deserves its own analysis because it bypasses technical defences by design, and because the controls that work are a mix of technology, process and behaviour.
Where does the name come from? The word dates from the mid-1990s, when attackers “fished” for America Online account passwords with fake messages; the “ph” spelling follows older hacker slang such as “phreaking”. The bait has changed since, but the method has not: cast a convincing lure and wait for someone to bite.
Types of phishing
The names describe the channel or the target. The underlying trick is the same, but the defences differ, which is why it is worth knowing them apart.
| Type | How it works | Typical target and goal |
|---|---|---|
| Bulk (“deceptive”) phishing | Generic emails sent at scale, imitating well-known brands: “your mailbox is full”, “your parcel is held” | Anyone; passwords and card details |
| Spear phishing | Targeted at a named person using details about their role, colleagues, suppliers or projects | Finance, HR, IT admins; credentials or payments |
| Whaling | Spear phishing aimed at directors and senior executives, or impersonating them | Executives and their assistants; large payments, sensitive data |
| Business email compromise (BEC) | Impersonates or takes over a real email account of a director, employee or supplier; often no link or attachment at all | Accounts payable, conveyancing, payroll; redirected payments |
| Smishing | Phishing by SMS or messaging app: delivery fees, bank alerts, “new number” messages from a boss | Staff on mobile devices; credentials, card details |
| Vishing | Phone calls — sometimes with cloned voices — posing as the bank, IT support or a senior manager | Help desks, finance staff; password resets, payments |
| Callback phishing | An email with no link, just a phone number to “cancel a subscription” or “dispute a charge”; the call leads to remote access software being installed | Any employee; device access |
| QR code phishing (“quishing”) | A QR code in an email, PDF, parking sign or letter leads to a fake login or payment page, often opened on a phone outside corporate filters | Any employee; credentials, payments |
| Clone phishing | Copies a real email you received earlier, swapping the link or attachment for a malicious one | Recipients of the original; credentials, malware |
| MFA fatigue and adversary-in-the-middle phishing | Repeated push prompts until someone approves, or a proxy login page that relays the real site and captures the session | Users with MFA; account takeover despite MFA |
| AI-generated phishing | Fluent, personalised messages written at scale by language models; deepfake voice or video for high-value requests | Anyone; removes the old “bad grammar” warning sign |
Spear phishing in more detail
What is spear phishing in practice? The attacker does homework. Company websites, LinkedIn profiles, press releases, job adverts and out-of-office replies reveal who approves payments, which suppliers you use, who is travelling and what the email signatures look like. The message then fits naturally into the target’s week: an updated invoice from a real supplier, a request from the finance director who is “in a meeting”, a shared document about a project the target is actually working on.
Because spear phishing is tailored, generic training slides about obviously fake lottery wins do little against it. The defences that work are process controls that do not depend on spotting the lie — such as verifying payment changes by phone — and technical controls that make stolen credentials less useful.
Business email compromise
Business email compromise deserves special attention because it goes straight for money and often leaves nothing technical to detect. The FBI’s Internet Crime Complaint Center consistently ranks BEC among the most financially damaging forms of cyber-enabled crime it sees. Common patterns:
- Supplier bank detail change. A message — sometimes from the supplier’s genuine, compromised mailbox — says the bank account has changed. The next payment goes to the criminal.
- CEO fraud. A “director” asks for an urgent, confidential transfer, often timed for when they are travelling.
- Payroll diversion. An “employee” asks HR to update their salary account.
- Conveyancing and deposit fraud. Completion funds are redirected by an email that appears to come from the solicitor or agent.
The single most effective control is procedural: any new or changed bank details are confirmed by phone using a number from your own records, never one in the email, and the change is approved by a second person. Many BEC losses are only recoverable if the bank is told within hours, so the procedure should also say who calls the bank and how.
Phishing examples a business will recognise
Real phishing rarely looks exotic. These are the lures that reach small and mid-size organisations week after week, with the detail that gives each away and the right response:
| Lure | What it says | Giveaway | Right response |
|---|---|---|---|
| Password expiry or full mailbox | “Your Microsoft 365 password expires today — keep it here” | Link to a login page that is not your real sign-in domain | Never sign in from an email link; open the app or portal directly |
| Shared document or e-signature | “A document has been shared with you for review and signature” | Unexpected; asks you to sign in to view | Check with the sender on a known channel |
| Supplier invoice with new bank details | “Please note our new account for this and future payments” | Bank change by email, often with urgency | Call the supplier on a number from your records; second approver |
| Director asks for an urgent favour | “Are you at your desk? I need you to handle a confidential payment / buy gift cards” | Secrecy, urgency, unusual channel | Verify by phone; follow the payment procedure regardless of seniority |
| Payroll change | An “employee” asks HR to update their salary account | Request by email only, close to payroll date | Confirm in person or by a call to the number on file |
| Parcel or delivery fee text | “Your parcel is held — pay a small redelivery fee” | Payment link in an SMS; you were not expecting a delivery | Delete; check orders on the carrier’s own site |
| Tax refund or penalty | Message claiming to be from HMRC or the IRS | Tax authorities do not ask for card details by email or text | Report it; check your account on the official site |
| IT support call | “We’ve seen suspicious activity — I’ll send an MFA prompt, just approve it” | Unsolicited call asking you to approve or read out a code | Hang up; call your help desk on its published number |
| QR code in an email or letter | “Scan to review your benefits / pay your parking fine” | QR code used instead of a normal link, leading to a login or payment page | Do not scan; go to the organisation’s site directly |
A phishing link is simply the web address in such a message: it leads to a fake login page, a payment form or a file download. Hovering over it (or long-pressing on a phone) shows where it really goes — but lookalike domains can be very close to the real one, so the safer habit is not to sign in from links at all.
How to spot a phishing email: a checklist
Well-crafted phishing — especially AI-written — may have no spelling mistakes and a perfect logo. Teach people to look at what the message asks for and where it really comes from, not at how polished it is.
- Unexpected request. Were you expecting this invoice, document, delivery or password reset?
- Urgency or secrecy. “Today”, “before close of business”, “don’t mention this to anyone” are pressure tactics.
- Sender address. Check the actual address, not the display name. Look for lookalike domains (an extra letter, a swapped character, a different ending) and free email accounts claiming to be a company.
- Reply-to differs from sender. Replies going somewhere other than the apparent sender is a classic BEC sign.
- Links. Hover or long-press to see the real destination. Be wary of link shorteners, file-sharing links you did not expect and login pages reached from an email.
- Attachments. Unexpected archives, HTML files, macro-enabled documents or “secure messages” that ask you to sign in to read them.
- Payment or bank changes. Treat any request to pay a new account as suspicious until verified by phone on a known number.
- Request to bypass process. “Just this once”, “I’ll approve it later”, “use your personal phone”.
- QR codes in emails. Legitimate business emails rarely need you to scan a code to sign in.
- MFA prompts you did not start. Never approve a sign-in you did not initiate — report it.
- Tone that is slightly off. A colleague who never writes formally suddenly does, or vice versa.
- External sender banners. If your email system flags a message as external but it claims to be from a colleague, stop.
When in doubt, verify out of band. Call the person on a number you already have, or message them on a different channel. Never use the contact details in the suspicious message.
Where to report: inside the business, use a one-click “report phishing” button that goes to IT. In the UK, suspicious emails can be forwarded to the NCSC’s Suspicious Email Reporting Service at report@phishing.gov.uk and scam texts to 7726. In the US, phishing can be reported to the FTC at ReportFraud.ftc.gov, and BEC losses to the FBI’s IC3.
How to report phishing in Outlook and Gmail
Reporting from inside the mail client is quicker than forwarding, and it sends the full message, headers included, to the people who can act on it.
- Outlook (desktop and web): select the message and use the Report button on the Home ribbon (labelled “Report Message” or “Report phishing” in some versions), then choose Report phishing. In the mobile app the option sits in the message’s more-options menu. Many organisations replace the built-in button with their security provider’s “report phish” add-in — use whichever your IT team has installed.
- Gmail: open the message, click the three-dot More menu next to Reply and choose Report phishing.
- Text messages: in the UK forward to 7726; elsewhere use your carrier’s spam reporting or the phone’s built-in “report junk” option, then delete.
Whatever the tool, the business needs one clear route, a person who looks at reports quickly, and a habit of thanking reporters — including when the message turns out to be harmless.
Phishing controls for a business
No control stops all phishing. The aim is layers: fewer messages arrive, fewer people act on those that do, actions that succeed achieve less, and incidents are reported fast. The table orders controls by how much they reduce risk for a typical small or mid-sized organisation.
| Control | What it does | Notes |
|---|---|---|
| Multi-factor authentication everywhere | A stolen password alone no longer opens email, VPN or cloud apps | Prefer phishing-resistant methods (passkeys, FIDO2 security keys) for admins and finance; enable number matching for push approvals |
| Payment verification procedure | Stops BEC even when the email is perfect | Call-back on a known number for new or changed bank details; second approver above a threshold |
| SPF, DKIM and DMARC on your domains | Makes it harder to send email that exactly spoofs your domain; DMARC reports show who sends as you | Move DMARC from p=none to quarantine or reject once legitimate senders are aligned. Gmail, Yahoo and Microsoft now require authentication from bulk senders |
| Email filtering and sandboxing | Blocks known malicious links and attachments; rewrites and checks links at click time | Most cloud email platforms include this; check it is switched on and tuned |
| External sender tagging and lookalike-domain alerts | Flags messages that pretend to be internal or come from near-copies of your domain | Cheap and effective against CEO fraud |
| Conditional access and impossible-travel alerts | Blocks or flags sign-ins from unusual places or unmanaged devices | Reduces the value of stolen session tokens |
| Least privilege and no daily admin use | Limits what a compromised account can do | Separate admin accounts with stronger MFA |
| Endpoint protection with EDR | Detects malware launched from a phishing attachment | Pairs with blocking macros from the internet |
| Report button and fast response | Turns staff into sensors; one report can pull the same message from every inbox | Thank reporters, including for false alarms |
| Awareness training and simulations | Builds recognition and, more importantly, the reporting habit | Short, frequent, role-specific; no public shaming |
| Help desk identity checks | Prevents vishing-driven password and MFA resets | Verify callers by call-back or manager confirmation before resets |
If you handle card payments, PCI DSS v4 also requires automated anti-phishing mechanisms (requirement 5.4.1) and security awareness training that covers phishing — see our PCI DSS compliance checklist.
Training and simulations that change behaviour
Phishing simulations are useful when they measure and teach; they backfire when they trick and punish. A few principles:
- Measure reporting, not just clicking. A team where most people report quickly is safer than one with a low click rate and silence.
- Vary difficulty and record it. A click rate only means something alongside how hard the lure was. NIST’s Phish Scale is one published method for rating difficulty.
- Make it role-specific. Finance staff need BEC and invoice scenarios; IT staff need fake vendor alerts and MFA reset calls; executives need whaling and deepfake voice examples.
- Give feedback in the moment. A short explanation straight after a click teaches more than an annual course.
- Never punish honest reports, including from people who clicked. Fear delays reporting, and delay is what turns a click into an incident.
What to do when someone clicks
Have a short, rehearsed procedure so that the first hour is not spent working out who to call:
- The person reports immediately — through the report button, a phone call or a dedicated channel.
- If credentials were entered: reset the password from a trusted device, revoke active sessions and tokens, review and remove any MFA methods or mailbox forwarding rules the attacker may have added.
- If an attachment was opened: isolate the device from the network and run an EDR scan or hand it to IT.
- If a payment was made: call the bank straight away to try to recall it, and report to the police or the relevant fraud reporting service.
- Search for and remove the same message from other mailboxes.
- Check whether personal data was exposed; if so, start the breach assessment in your data breach response plan.
- Record what happened and what changed as a result.
Phishing as a risk register entry
“Phishing” is a cause, not a risk. Write register entries as scenarios with a consequence, so each has an owner and controls you can test. Examples with illustrative residual scores on a 5×5 risk matrix:
| Risk statement | Key controls | L | I | Score | Owner |
|---|---|---|---|---|---|
| Fraudulent change of supplier bank details leads to a payment to a criminal account | Call-back on known number; dual approval; supplier master-data change log | 3 | 4 | 12 | Finance director |
| Staff credentials phished and used to access email and customer data | MFA on all accounts; conditional access; alerts on new forwarding rules | 3 | 4 | 12 | IT lead |
| Admin account phished despite MFA via adversary-in-the-middle kit | Phishing-resistant MFA for admins; separate admin accounts; sign-in alerts | 2 | 5 | 10 | IT lead |
| Phishing attachment installs malware that leads to ransomware | Macro blocking; EDR; email sandboxing; isolation procedure | 2 | 5 | 10 | IT lead |
| Attackers spoof our domain to defraud our customers, damaging trust | DMARC at reject; lookalike-domain monitoring; customer guidance on payment details | 2 | 3 | 6 | Marketing manager |
| Help desk resets a password or MFA after a convincing phone call | Caller verification procedure; call-back; manager approval for MFA resets | 2 | 4 | 8 | IT service manager |
For the payment fraud line, the overlap with wider fraud risk is large — our guide to ecommerce fraud and chargebacks covers the customer-facing side.
Key risk indicators for phishing
Phishing KRIs should tell you whether behaviour and controls are improving, not just how many emails were blocked. Choose a few and review them monthly; see key risk indicators for how to set thresholds.
| Indicator | What it tells you | Example thresholds |
|---|---|---|
| Simulation click rate (at a stated difficulty) | How many people act on a realistic lure | Set from your own baseline; red if it rises two cycles in a row |
| Simulation report rate | Whether people raise the alarm | Rising trend green; falling trend amber |
| Median time from delivery to first report | How fast your human sensors work | Green < 15 min · amber 15–60 min · red > 60 min |
| Credential submissions in simulations | Clicks that went as far as entering a password | Track separately from clicks; investigate any rise |
| Accounts without MFA | Exposure to simple credential phishing | Green 0 · red any |
| Admins without phishing-resistant MFA | Exposure of your most powerful accounts | Green 0 · red any |
| Bank detail changes processed without documented call-back | Whether the BEC control is working | Green 0 · red any |
| DMARC policy on all sending domains | Protection against exact-domain spoofing | Green reject · amber quarantine · red none |
| Real phishing incidents with account compromise | Outcome measure | Review each; track trend quarterly |
Common mistakes
- Relying on people to spot every lie. Process controls such as call-back verification work even when the email is flawless.
- Treating SMS codes as the end of the story. MFA is essential, but code-based MFA can be phished; protect admin and finance accounts with stronger methods.
- Leaving DMARC at p=none forever. Monitoring is a start, not protection.
- Judging training by click rate alone. Without difficulty and report rate, the number is easy to game.
- Punishing clickers. It teaches people to hide mistakes.
- Forgetting phones. Smishing, vishing and QR codes bypass email filters entirely.
Frequently asked questions
What is a phishing attack?
A phishing attack is a message — usually an email, but also a text, call, QR code or chat message — that pretends to come from someone you trust in order to make you reveal passwords or payment details, open malware, or send money. It works by exploiting trust, urgency and routine rather than a technical flaw.
What is spear phishing?
Spear phishing is a targeted phishing attack aimed at a specific person or small group, using details about them — their role, colleagues, suppliers or current projects — to make the message convincing. Whaling is spear phishing aimed at senior executives.
What is business email compromise?
Business email compromise (BEC) is fraud in which an attacker impersonates or takes over a trusted email account — a director, employee or supplier — to trick someone into making a payment, changing bank details or sending sensitive data. It often contains no link or attachment, which makes it hard to filter.
What should you do if you clicked a phishing link?
Report it immediately to your IT or security contact. If you entered a password, change it from a trusted device and make sure active sessions are signed out. If you opened an attachment, disconnect the device from the network. If payment details were involved, contact the bank at once. Fast reporting matters far more than blame.
Does multi-factor authentication stop phishing?
It stops many attacks that rely on a stolen password alone, but not all. Adversary-in-the-middle phishing kits can capture one-time codes and session cookies, and users can be pressured into approving push prompts. Phishing-resistant MFA such as passkeys or FIDO2 security keys is much stronger, especially for administrators and finance staff.
Is phishing a form of social engineering?
Yes. Social engineering means manipulating people rather than breaking technology, and phishing is its most common form: a message that exploits trust, urgency or routine to make someone reveal a password, open malware or send money.
What is a phishing link?
A phishing link is a web address in a fraudulent message that leads to a fake login page, a payment form or a malicious download. It often uses a lookalike domain or a link shortener. The safest habit is not to sign in from email or text links but to open the service directly.
What is the difference between phishing, smishing and vishing?
They are the same trick through different channels. Phishing usually means email, smishing uses SMS or messaging apps, and vishing uses phone calls, sometimes with cloned voices. Quishing uses QR codes.
How do I report a phishing email in Outlook?
Select the message and use the Report button on the Home ribbon (called Report Message or Report phishing in some versions), then choose Report phishing. If your organisation has its own report button, use that, so the security team sees the message.
Phishing risk with numbers behind it
In Risk Samurai phishing and payment fraud scenarios sit in the same register as your other risks, with owners, linked controls and indicators such as MFA coverage, report rate and unverified bank changes — so a slipping control is visible before a fraud is. AI drafts the first version of your register.
Get early access