Phishing: the most common way in, and how to reduce it

Phishing works because it targets people, not technology. A message that looks like it comes from a bank, a supplier or a colleague asks someone to click a link, open an attachment or approve a payment.

Common patterns

• Urgent requests to change a supplier's bank details.
• Fake login pages for email or file-sharing services.
• Messages that appear to come from a senior manager asking for a quick favour.
• Attachments disguised as invoices or delivery notes.

Technical controls

• **Multi-factor authentication** on email and remote access, so a stolen password alone is not enough.
• **Email authentication** (SPF, DKIM, DMARC) on your own domain to make spoofing harder.
• **Filtering** of malicious links and attachments.

People controls

Short, regular awareness sessions work better than a single annual lecture. Make reporting easy — a single address or button — and thank people who report, even when it turns out to be harmless.

Process controls

Verify any change to payment details by calling a known number, never one in the email. Require a second approval for large or unusual payments.

See our cybersecurity services.