Recognising phishing: understand social engineering and prevent attacks

Social engineering targets decisions under pressure

An urgent transfer request from a supposed executive in a meeting exploits authority, fear, helpfulness or time pressure rather than a software flaw. Generative tools can reduce language mistakes and scale personalised messages. Technical protection alone does not remove these pressures.

Inspect the domain after the @ sign, not just the display name: an address such as support@amazon-security-alert.com is not proof of an Amazon sender. Preview a link's real destination without opening it. An unexpected 'your account will be blocked in 24 hours' message should be checked through the official site or a separately obtained contact number.

Reused passwords can turn one stolen login into several compromised accounts. Use a password manager, enable two-factor authentication and never send passwords by email or chat. When in doubt, verify independently instead of using contact details in the suspicious message.

Phishing exploits processes and expectations

Modern attacks can be fluent and mention genuine roles, suppliers or projects. Do not rely on spelling mistakes. Consider the sender domain, actual link destination, unexpected attachments, request context and requested action, especially login, payment, approval or bank-detail changes.

Time pressure and authority are used to bypass normal checks. Require a second independent channel for critical actions. Confirm a changed bank account using a known phone number, not a number supplied in the same email.

People need a safe reporting route

Awareness works when staff can report concerns quickly without fear. A phishing button, clear hotline or known chat channel shortens the time to analysis. Preserve the original message with headers; a screenshot loses technical evidence.

Simulations should test learning goals rather than embarrass individuals. Measure reporting rate, reporting delay and recurring patterns. Short role-specific exercises for finance, assistants and IT are more useful than relying solely on a generic annual video.

After a click, respond quickly

If credentials may have been entered, revoke sessions, change the password, inspect MFA methods and forwarding rules, and preserve relevant logs. If a file was executed, isolate the device and follow the incident process. Uncoordinated deletion can destroy evidence.

Phishing-resistant authentication, restricted macros, email authentication, secure browsers and payment approvals reduce consequences. No single control is sufficient; combine technology, process and a culture of prompt reporting.