Phishing messages try to persuade people to reveal information, send money, or open harmful links and attachments. They can arrive by email, text message, social media, or phone, and they often imitate a person or organization you already trust.
How phishing attacks work
Some campaigns reach many recipients. Others target a specific employee, executive, or business relationship using information from public websites, social media, or earlier breaches. A convincing message may request an urgent payment, ask you to sign in, or claim that an account needs attention.
A fake sign-in page can closely resemble a familiar service. Treat an unexpected request as something to verify, even when the message uses accurate names, polished writing, or a recognizable logo.
In this video, we review a phishing email that imitates a Microsoft Office 365 account notice.
Common approaches
Business email compromise: An attacker impersonates an executive, supplier, or colleague to request a payment or a change to bank details. Confirm changes using a phone number or contact method you already know.
Imitation sign-in pages: A message sends you to a page that copies a bank, Microsoft 365, or another service. Open the service from a trusted bookmark or type its known address instead of following an unexpected message link.
Misleading links and websites: Check the complete domain, not just a familiar name somewhere in the address. HTTPS encrypts the connection; it does not prove that a website is legitimate. Phishing websites can use HTTPS too.
What your team can do
- Pause when a message creates urgency or asks for credentials, confidential information, or a payment.
- Verify the request through a separate, trusted channel. Use a known number or open the organization's website independently.
- Report suspicious messages using your organization's reporting process, then delete them. Avoid replying or opening their links and attachments.
- Use multifactor authentication where available and keep devices and software updated. These protections support careful verification; they do not make every request safe.
- Train staff to recognize unexpected requests. Correct spelling and professional design do not establish that a message is genuine.
Read the FBI's guidance on phishing sites that use HTTPS and NIST's phishing guidance.
Related guide
Request our guide Getting to Grips with Email Security, or contact Ignite for help reviewing your organization's email security.