What is phishing?

Act quickly and report it rather than waiting to see what happens. If credentials were entered, change that password immediately and change it anywhere else the same password was used. Sign out all active sessions, because an attacker may already hold a valid session token that a password change alone does not revoke. Check mailbox rules for newly created forwarding or deletion rules, a standard attacker step after email compromise. Review recent sign-in activity for unfamiliar locations. Notify IT or your security provider even if nothing appears wrong, since containment is far easier in the first hour than the first week.

Business email compromise usually involves no malware and often no malicious link, which is why technical filters frequently miss it. The attacker either compromises a genuine mailbox or spoofs a familiar sender, observes real conversations, and then intervenes at a plausible moment — typically to redirect an invoice payment or change payroll bank details. Because the message is contextually accurate and may come from a legitimate address, it defeats detection based on suspicious content. The defence is procedural: verify any payment or bank detail change by phoning a known number, never a number supplied in the message.

No. Filtering removes the large majority of bulk phishing and known malicious infrastructure, and modern services also detect impersonation patterns and anomalous sender behaviour. What it cannot reliably stop is a well-crafted message sent from a genuinely compromised business account with no attachment and no link, or a targeted message using a newly registered domain not yet on any reputation list. Filtering should be understood as the layer that reduces volume so that staff attention is available for the small number of sophisticated messages that reach the inbox.

MFA prevents most credential phishing from succeeding, because a stolen password alone no longer grants access. It does not make phishing impossible. Attacker-in-the-middle phishing kits proxy the real login page and capture the one-time code alongside the password, then use both within their short validity window. Session token theft bypasses authentication altogether. Phishing-resistant methods — passkeys and FIDO2 security keys — defeat the relay technique because the credential is cryptographically bound to the legitimate domain and cannot be replayed elsewhere.

Their value depends on how they are run. Simulations that measure report rate as the primary metric, deliver short targeted training immediately after a click, and keep individual results confidential tend to improve behaviour measurably over six to twelve months. Simulations designed to catch people out — fake bonus announcements, fake redundancy notices — generate resentment and suppress reporting, which is counterproductive. The behaviour worth building is fast reporting of anything suspicious, and that is best encouraged by recognising reports rather than penalising clicks.

Phishing consistently ranks as the most frequently identified attack type in UK breach surveys, and the Cyber Security Breaches Survey has repeatedly found it affecting the large majority of businesses that report any breach or attack. For small organisations it is usually the entry point rather than the objective: stolen credentials lead to mailbox access, mailbox access leads to invoice fraud or onward phishing of contacts, and in some cases to ransomware deployment. Its persistence reflects low cost to the attacker and reliance on human judgement rather than a technical vulnerability.