Phishing

What it means

Phishing is a fraudulent message, most often an email, text or chat message, that poses as a trusted sender such as a bank, supplier, courier or the tax office. The aim is to get the recipient to click a link, enter a password, open an infected attachment or send money.

Phishing is the most widespread form of social engineering. It attacks people rather than technology, exploiting their trust, haste or fear. The targeted version, known as spear phishing, uses real names, projects and invoices and is therefore much harder to spot.

The most dangerous scam for companies is the invoice and changed bank details fraud. The attacker poses as a known supplier or director and asks for payment to a new account. With an instant payment the money is gone within seconds.

How it works in practice

The first line of defence is technical email configuration. We recommend that companies implement SPF, DKIM and DMARC, which make it harder to spoof their domain, and turn on two-factor authentication for email, banking and the accounting system.

Staff should neither memorise nor write down passwords but keep them in a password manager. It also fills in a password only on the correct domain, so it fails on a fake site, which is a useful warning sign.

In our work with clients the rule is: a change to a supplier’s bank account or an unusual payment request is always verified by phone on a number we already have, not one from the email. We recommend writing the same procedure into internal payment rules.

What to watch out for

Clicking a phishing link can be the start of a bigger attack, such as ransomware that encrypts the company’s data. Anyone who clicks should report it immediately, not hide it. A quick response, changed passwords and disconnecting the device greatly reduce the damage.

If personal data leak in an attack, the company may have to report the incident to the supervisory authority under GDPR and inform the people affected. Cyber insurance may cover part of the costs but usually requires basic security measures to be in place.