What Is Phishing?
Phishing is a type of cyber attack where criminals impersonate trusted entities to trick you into revealing sensitive information, such as passwords, bank details, or personal data.
These attacks most commonly arrive via email, but they can also come through text messages (smishing), phone calls (vishing), or even social media.
According to the UK National Cyber Security Centre, phishing is involved in the vast majority of cyber incidents affecting businesses. Understanding how these attacks work is your first line of defence.
Common Signs of a Phishing Email
Learning to spot phishing emails can save your business from a costly breach. Watch for these red flags:
Urgency or threats - Messages claiming your account will be suspended, or demanding immediate action
Unfamiliar sender addresses - The display name might look legitimate, but check the actual email address carefully
Spelling and grammar errors - While not always present, many phishing emails contain obvious mistakes
Suspicious links - Hover over links before clicking to see where they actually lead
Unexpected attachments - Be wary of files you were not expecting, especially .exe, .zip, or macro-enabled documents
Requests for sensitive information - Legitimate organisations will never ask for passwords or payment details via email
Types of Phishing Attacks
Phishing attacks come in several forms:
Spear phishing - Targeted attacks aimed at specific individuals, often using personal information to appear more convincing
Whaling - Attacks targeting senior executives or decision-makers with access to sensitive data or financial systems
Clone phishing - Attackers duplicate a legitimate email you previously received, replacing links or attachments with malicious ones
Business email compromise (BEC) - Attackers impersonate a colleague or supplier to trick you into making payments or sharing data
What to Do If You Suspect a Phishing Email
Do not click any links or open any attachments
Report it to your IT team or managed service provider immediately
Forward it to the NCSC at report@phishing.gov.uk
Delete it from your inbox after reporting
If you clicked a link, change your password immediately and notify your IT team
Protecting Your Business
Prevention is always better than cure. Here are practical steps to protect your organisation:
Implement email filtering and anti-phishing tools
Enable multi-factor authentication on all accounts
Conduct regular security awareness training for all staff
Run simulated phishing tests to identify vulnerable users
Keep all software and systems up to date with the latest patches