Understanding and Responding to Phishing Attacks
Phishing attacks are behind the majority of data breaches and financial fraud. This guide explains exactly how they work and how to recognise them before they succeed.
Why Phishing Is So Effective
Phishing attacks, attempts to deceive people into revealing sensitive information or taking harmful actions through fraudulent communications, are responsible for the majority of successful cyberattacks on both individuals and organisations. They persist and succeed despite widespread awareness of them because they have evolved significantly beyond the obvious, badly-spelled emails of early internet fraud.
Modern phishing is often technically sophisticated, psychologically well-calibrated, and delivered through legitimate-looking communications that can fool careful, technically aware people. Understanding specifically how phishing works, including the psychological mechanisms it exploits, is more useful than general advice to be careful of suspicious emails.
The Mechanics of Phishing
Phishing attacks work by exploiting a combination of technical elements (convincing impersonation of legitimate services) and psychological elements (urgency, authority, fear, curiosity). The most effective attacks combine both: they look sufficiently authentic to pass a quick visual check, and they create sufficient pressure to override the pause that a more careful inspection might provide.
Email phishing typically involves an email that appears to be from a trusted organisation (your bank, HMRC, a well-known retailer, a service provider) containing a link to a site that looks identical to the real one. Entering your credentials on this site sends them directly to the attacker. The email may reference a real event (a delivery that is actually on its way) or fabricate urgency (your account has been compromised, action required immediately).
SMS phishing (smishing) follows the same pattern via text message. Voice phishing (vishing) uses phone calls, increasingly using AI-generated voices that closely replicate the voices of institutions or individuals. QR code phishing uses QR codes to direct people to malicious sites, exploiting the fact that QR codes are harder to inspect than a visible URL.
Spear Phishing: The Personalised Attack
Standard phishing sends the same communication to a large number of people, relying on a small percentage being caught. Spear phishing is targeted at a specific individual using information gathered about them, typically from social media and data breaches, to make the communication more convincing.
A spear phishing email might reference your specific bank, a recent purchase, your employer, or your name and role in an organisation. It may appear to come from a specific person you know (whose email address has been compromised or convincingly spoofed). These attacks are significantly more effective than generic phishing and are used primarily against higher-value targets, including individuals at organisations where their access could yield significant information.
Recognising Phishing: What to Look For
Legitimate organisations will not ask you to provide sensitive information (passwords, PINs, full card numbers) via email, text, or unsolicited phone call. Any communication that requests this is a red flag regardless of how convincing it looks.
Check the sender's actual email address (not just the display name): fraudulent emails often use addresses that look similar to legitimate ones (support@bank-security.com rather than support@bank.com) or use legitimate-looking display names with completely unrelated actual addresses. Hover over links before clicking to see the actual destination URL: if it does not match what you would expect, do not click.
Urgency and pressure are deliberate features of phishing: the emphasis on acting immediately is designed to prevent the pause in which you might question the communication. Treat any communication that creates urgency around account access, payments, or personal information with proportionate scepticism.
If you receive a communication claiming to be from your bank or another organisation you use, contact that organisation directly using contact details from their official website (not from the communication you received) to verify whether the communication is genuine.
If You Have Clicked
If you have clicked a phishing link and entered credentials: change your password immediately on the actual service (accessed directly, not through the same link), and on any other service where you use the same password. Contact your bank immediately if financial information was entered. Enable two-factor authentication on any affected accounts. Report the phishing attempt to the organisation being impersonated and to Action Fraud (0300 123 2040).
If you have clicked a link but not entered any information, the risk is significantly lower, though some phishing links can install malware simply through the visit. Run a security scan on the device using reputable security software.
Protective Measures
Two-factor authentication (2FA) on all important accounts is the single most effective protective measure. Even if an attacker obtains your password, they cannot access the account without also having access to your second factor (typically your phone). Enable 2FA on your email account, banking, and any other account with significant information or financial exposure.
Use a password manager to create and store unique, strong passwords for each account. This prevents a compromised password from one site being used to access others. Keep your devices and applications updated, as updates frequently address security vulnerabilities that attackers exploit. And register with Have I Been Pwned (haveibeenpwned.com) to be notified if your email address appears in a known data breach.