Phishing
A social engineering attack that uses deceptive emails, messages, calls or websites to trick people into revealing credentials, paying or installing malware.
A single successful phishing message can lead to account takeover, invoice fraud or ransomware, so email authentication, MFA and a clear reporting process are among the most cost-effective controls for small businesses.
A finance assistant receives an email that appears to come from a supplier asking to change bank details for a $28,000 invoice; company policy requires a call-back to a known number, which exposes the fraud before payment.
Training alone cannot stop phishing, because well-crafted or AI-generated messages fool careful users and poor grammar is no longer a reliable sign. Some MFA methods can be bypassed by real-time proxy phishing kits.
Variants include bulk phishing, targeted spear phishing, business email compromise, SMS lures (smishing), voice calls (vishing) and QR-code lures. Defense works in layers: DMARC with SPF and DKIM to reduce spoofing, email filtering, easy user reporting, hardened devices, Multi-Factor Authentication (MFA), blocking of known malicious sites, and logging with a rehearsed Incident Response plan for messages that get through.
Systems Architecture
CISA — Recognize and Report Phishing — https://www.cisa.gov/secure-our-world/recognize-and-report-phishing; NCSC — Phishing attacks: defending your organisation — https://www.ncsc.gov.uk/guidance/phishing