Phishing is social engineering in which an attacker impersonates a trusted person or organisation to obtain information, deliver malware or persuade someone to approve an action. It can arrive by email, text, phone or social media.
Warning signs
- Unexpected requests for passwords or payment.
- Urgent language that pressures you to act.
- Sender addresses that imitate a real organisation.
- Links to unfamiliar or misspelled domains.
- Unexpected attachments.
- Requests to bypass normal payment procedures.
Verify before acting
Do not use links or phone numbers in a suspicious message. Visit the official website yourself or contact the organisation through a known number. Confirm bank-detail changes using a separate trusted channel.
If you clicked
If you entered a password, change it from a trusted device and enable MFA. Contact your bank quickly if payment details were shared. Report the message to your organisation’s security team.
Build safer habits
Use a password manager, keep software updated and train staff to report suspicious messages. SPF, DKIM and DMARC can reduce some spoofing, but do not eliminate phishing.
FAQs
Can phishing look genuine?
Yes. Branding and sender names can be copied.
Should I reply?
No. Avoid links and attachments; report the message.