Phishing is a social-engineering attack that impersonates a trusted person or brand to trick you into revealing a credential, opening malware, or making a payment. It is the most common way attacks begin, because it targets people rather than patched software. The main variants are spear phishing, whaling, and business email compromise, and the core defenses are multi-factor authentication, email authentication, and a habit of verifying unusual requests.
How does phishing work?
Phishing works by borrowing trust. The attacker sends a message that looks like it comes from someone you would believe, your bank, a supplier, a colleague, a well-known brand, and asks you to do one thing: enter a password on a fake login page, open an attachment, click a link, or approve a payment.
The message succeeds through pressure, not technology. It manufactures urgency (your account will be closed), leans on authority (a request from the CEO), and gives a plausible reason to act now. Because it targets a person rather than a patched system, phishing works even against organisations with strong technical defenses.
The main types of phishing
Phishing comes in several forms, mostly defined by how targeted they are and how they are delivered:
- Bulk phishing is the wide net: the same generic message sent to thousands, hoping a few respond.
- Spear phishing is targeted, using real details about you or your company to be convincing.
- Whaling is spear phishing aimed at executives, whose access and authority are worth more.
- Business email compromise (BEC) impersonates a boss or supplier to request money or a change of bank details, often with no malware at all.
- Clone phishing copies a real message you have seen before and swaps in a malicious link.
- Smishing and vishing move the attack to text messages and phone calls.
Business email compromise: the costly one
The most expensive phishing rarely involves malware. In business email compromise, an attacker poses as your CEO, a supplier, or a partner and simply asks to move money or change the bank details on an invoice. There is nothing for antivirus to catch, because the only payload is a convincing request.
The defense is a process, not a product: any request to move money or change payment details is confirmed on a second channel, a phone call to a known number, never by replying to the email. That single rule stops most BEC losses.
How to spot a phishing attempt
Most phishing gives itself away if you slow down:
- The sender name looks right but the actual address or domain does not.
- It creates urgency or a threat to make you act without thinking.
- It asks for a password, a payment, or an unexpected attachment.
- Links do not match where they claim to go (hover before you click).
- The tone or request is slightly off for the person it claims to be from.
When something feels wrong, the safe move is to stop and verify through a channel you already trust.
How to prevent phishing
No single control stops phishing, but a few together make it hard to profit from:
- Multi-factor authentication so a stolen password is not enough. Phishing-resistant methods (passkeys or hardware keys) also defeat the real-time proxy attacks that steal one-time codes.
- Email authentication (SPF, DKIM, and DMARC) so attackers cannot spoof your own domain.
- Your provider's advanced anti-phishing, which is often turned down by default.
- Training and simulations so people recognise the signs, and a one-click report button.
- A second-channel rule for any request to move money.
Because attackers phish their way to something bigger, a penetration test that includes a phishing simulation shows what a successful click would actually reach.
References
- [1]Phishing (Technique T1566)(MITRE ATT&CK)
- [2]Avoiding Social Engineering and Phishing Attacks(CISA)
- [3]Data Breach Investigations Report(Verizon)
Phishing is a people problem with a technical backstop. Train the people, turn on the backstops (MFA and email authentication), and verify anything that moves money.