What Is Phishing: How Employees Can Spot It and What to Do After a Click

In short:

• Phishing is a scam in which the attacker pretends to be someone you trust in order to get a password, money or access to the computer.
• The most dangerous emails in businesses are not "prizes" but fake Microsoft 365 sign-ins, invoices and requests to change a bank account.
• Spelling mistakes are no longer a reliable sign - scams are written smoothly. Look at the address, the link and the request.
• If you have clicked, say so immediately. The first minutes decide how much damage there will be.

What is phishing

Phishing is a type of scam in which the attacker pretends to be a well-known company, an institution or a colleague to make you do something: enter a password, open a file, pay or give access.

It most often arrives by email, but not only:

• email - fake invoices, shared documents, "a problem with your account";
• SMS and messaging apps - "your parcel is waiting", "your card is blocked";
• a phone call - "from technical support" or "from the bank";
• a QR code - in an email or on paper, leading to a fake sign-in page.

The goal is almost always one of three: your password, the company's money or access to the computer through malware or a remote access program.

The most common phishing emails in businesses

The bank account change emails usually turn out to be the most expensive: they look like a continuation of a real conversation, and the money is rarely recovered.

8 signs of a phishing email

1. The sender's address does not match the name. It shows "Microsoft" or a colleague's name, but the address is unknown or personal (for example Gmail).
2. The domain looks similar but is not the same. For example an extra letter, a hyphen or a different ending - easy to miss on a phone.
3. Urgency or a threat. "Within 24 hours", "your account will be closed", "the director is waiting".
4. The link goes somewhere else. Hover the mouse over it (without clicking) and look at the real address at the bottom of the browser or the mail app.
5. An unexpected attachment. Especially archives, .html files or documents that ask you to "Enable content".
6. A sign-in page after a link in an email. Microsoft, the bank or the courier rarely ask for a password through a link in an email. Open the site yourself.
7. A request to change a bank account or for an unusual payment. Always check by phone, on a number you already have - not the number in the email.
8. Something is not as usual. A colleague who never writes like that, or a supplier who is suddenly in a hurry. Trust the feeling and ask.

Note: spelling mistakes are no longer a reliable sign. Scams are increasingly written smoothly, without errors, and copy real emails.

What to do if you have already clicked

The most important rule for employees: say so immediately. The mistake is not clicking but keeping quiet. The sooner IT knows, the less damage.

• If you entered your password - change it immediately (from another, secure device) and tell IT. If you use the same password elsewhere, change it there too.
• If you opened a file - disconnect the computer from the network (the cable or Wi-Fi) and call IT. Do not delete anything and do not try to "clean" it yourself.
• If you paid or gave card details - call the bank immediately. With a transfer, hours matter.
• If you approved a sign-in request you did not make - report it immediately so the access can be cut off.
• Keep the email and forward it to IT as an attachment - it shows where it came from.

And the IT team should:

• change the password and end all active sessions of the account;
• check for rules that secretly forward or delete mail;
• check the computer with EDR and isolate it if needed;
• see whether the same email has reached other employees;
• review the sign-ins to the account and what was accessed.

What the business should do in advance

Careful employees are the first line of defence, but nobody is immune to a mistake on a busy day. That is why protection has to work even when someone clicks:

• Two-factor authentication (MFA) on email and all systems - a stolen password alone is not enough. See why businesses use MFA.
• Configured email protection - SPF, DKIM and DMARC for your domain and a filter for suspicious emails and links. See how to secure a company email.
• EDR instead of a plain antivirus - it stops suspicious behaviour, not only known viruses. See EDR vs traditional antivirus.
• A payment rule - every change of bank account is confirmed by phone, on a known number, by a second person.
• One clear way to report - an address or a person to whom employees forward suspicious emails without hesitating.
• Backups that can be restored - in case phishing leads to ransomware. See ransomware protection for business.

How we do it

For the businesses we support, we set up protection so that one mistake does not become an incident: two-factor authentication, SPF, DKIM and DMARC, email filtering and EDR on computers and servers. Employees forward suspicious emails to us and we tell them whether they are dangerous.

When someone clicks, we react immediately: we change the password, end the sessions, check the mailbox for hidden rules and the computer for traces of an attack. See information security for business.

Frequently asked questions

What is phishing in plain words?

A scam in which someone pretends to be a well-known company, an institution or a colleague to make you give a password, money or access to the computer.

What is a phishing email?

An email that looks real - from Microsoft, the bank, a supplier or a colleague - but aims to make you click a link, open a file or pay.

How can I check a link without opening it?

Hover the mouse over it and look at the address that appears. On a phone, press and hold the link. If the address is not that of the company the email claims to be from, do not click.

What should I do if I entered my password?

Change it immediately from another device and tell IT so they can end the active sessions. If you use the same password elsewhere, change it there too.

Does antivirus help against phishing?

Partly. Antivirus can stop an infected file, but it does not stop an employee who enters their own password on a fake page. That is why two-factor authentication and email protection are needed.

Should I report it if I did not click?

Yes. If an email reached you, it has probably reached your colleagues too. A report helps stop it for everyone.

Let's talk about your needs, and we will propose the best solution and price.