Phishing Awareness

What Is Phishing?

Phishing is when attackers pretend to be someone you trust to trick you into:

• Clicking a malicious link
• Opening an infected attachment
• Giving away sensitive information (passwords, bank details)
• Transferring money

The name comes from "fishing" — attackers cast out bait and wait for someone to bite.

Why It Works

Phishing exploits human psychology, not technical vulnerabilities. Attackers know:

• You're busy and scan emails quickly
• You trust messages that look official
• Urgency makes you act without thinking
• Authority (CEO, IT, bank) triggers compliance

The Red Flags

1. Urgency and pressure

❌ "Your account will be suspended in 24 hours" ❌ "Immediate action required" ❌ "You must respond today or lose access"

Real companies rarely demand immediate action via email. This is the #1 manipulation tactic.

2. Sender address doesn't match

The display name might say "Microsoft Support" but the actual email is:

• support@micros0ft-help.com (zero instead of 'o')
• microsoft.support@gmail.com (wrong domain)
• help@microsoft.security-update.net (subdomain trick)

Always check the actual email address, not just the display name.

3. Generic greetings

❌ "Dear Customer" ❌ "Dear User" ❌ "Dear Account Holder"

Legitimate companies usually know your name.

4. Spelling and grammar errors

While AI has made phishing emails much better, many still contain:

• Awkward phrasing
• Spelling mistakes
• Unusual formatting

5. Suspicious links

Hover over links (don't click!) to see where they actually go:

• Link text says www.bank.com but goes to www.bank-secure-login.xyz
• Shortened URLs like bit.ly/xyz123
• IP addresses instead of domain names

6. Unexpected attachments

• Invoice you weren't expecting
• "Shipping confirmation" for an order you didn't place
• "Important document" from someone you don't know

Real Example: CEO Fraud

A finance employee receives this email:

From: James Wilson (CEO) james.wilson@company-secure.com

Subject: Urgent wire transfer needed

Hi Sarah,

I need you to process an urgent wire transfer of £45,000 to a new supplier. This is time-sensitive and confidential — please don't discuss with others.

I'm in meetings all day, so just proceed with the transfer and I'll send confirmation later.

Thanks, James

The red flags:

• Urgency ("time-sensitive")
• Secrecy ("don't discuss with others")
• Unavailability ("I'm in meetings")
• Slightly wrong email domain
• Unusual request (CEO doesn't normally request transfers)

What actually happened: This is a real attack pattern called Business Email Compromise (BEC). In 2023, BEC caused £2.1 billion in losses in the UK alone.

What Good Looks Like

Legitimate business emails typically:

• Come from correct company domains
• Don't create artificial urgency
• Allow you to verify through normal channels
• Don't ask you to bypass security procedures
• Include proper signatures and contact information

How to Verify Suspicious Emails

You've received an email that seems off. Here's what to do.

Step 1: Check the Sender Address

Click on the sender name to reveal the actual email address.

Legitimate:

• noreply@amazon.co.uk
• support@microsoft.com
• alerts@hsbc.co.uk

Suspicious:

• amazon-support@gmail.com
• microsoft.security@mail.com
• hsbc.alerts@secure-banking.net

Step 2: Hover Over Links (Don't Click!)

On desktop: Hover your mouse over any link. Your browser shows the actual URL in the bottom-left corner.

On mobile: Press and hold the link (don't tap). The URL preview will appear.

What to look for:

✓ The domain matches the company (e.g., paypal.com, not paypal-secure.com)

✓ The URL uses HTTPS (but this alone doesn't mean it's safe)

✓ No strange characters or numbers replacing letters

Common tricks:

• paypa1.com (number 1 instead of letter l)
• arnazon.com (rn looks like m)
• microsoft-support.attacker.com (Microsoft is a subdomain, attacker.com is the real domain)

Step 3: Verify Through Official Channels

If an email claims to be from your bank, IT department, or a supplier:

❌ Don't reply to the email or use contact details in the email

✓ Do go directly to the official website (type it yourself)

✓ Do call using a number you already have or find on the official site

✓ Do ask a colleague if they received similar emails

What to Do with Suspicious Emails

If you're unsure:

1. Don't click any links
2. Don't open any attachments
3. Forward to your IT security team
4. Delete the email

If you're certain it's phishing:

1. Report it (most email clients have a "Report phishing" button)
2. Forward to IT security
3. Delete it

If you accidentally clicked:

1. Disconnect from the network immediately
2. Don't enter any information
3. Report to IT security straight away
4. Change any passwords you may have entered

Business Email Compromise (BEC)

BEC is phishing's sophisticated cousin. Instead of mass emails, attackers:

• Research your company
• Learn employee names and roles
• Study your communication patterns
• Send highly targeted, believable emails

Common BEC Scenarios

1. CEO Fraud Attacker impersonates CEO, requests urgent wire transfer.

2. Vendor Impersonation "Your regular supplier's bank details have changed."

3. IT Impersonation "IT here — we need your password to fix an urgent issue."

4. HR Impersonation "Please update your direct deposit information in this form."

Real Example: Ubiquiti Networks (2015)

Attackers impersonated employees and used BEC to request wire transfers. Finance team processed the requests believing they were legitimate.

Cost: $46.7 million

What went wrong:

• No verification protocol for large transfers
• Email requests treated as sufficient authorization
• Finance team didn't verify via phone call

Prevention:

• Verbal verification for all financial requests
• Multi-person approval for large transfers
• "If in doubt, call it out" culture

The Golden Rule

Never trust email alone for sensitive requests.

Any request involving:

• Money transfers
• Password sharing
• Personal information
• Changes to bank details
• Access to systems

...should be verified through a different channel (phone call, in-person, company messaging system) using contact details you already have — not from the email.

Phishing Isn't Just Email

Attackers use every communication channel available. Here's what to watch for.

Vishing (Voice Phishing)

Attackers call you, pretending to be:

• IT support
• Your bank
• HMRC/tax authorities
• Microsoft/tech support
• Company executives

Common vishing scripts:

❌ "This is Microsoft support. We've detected a virus on your computer."

❌ "This is HMRC. You have an unpaid tax bill and a warrant will be issued unless you pay now."

❌ "Hi, this is IT. We're updating our systems and need you to verify your password."

Reality check:

• Microsoft doesn't call about viruses
• HMRC doesn't demand immediate phone payments
• IT never needs your password (they can reset it)

What to Do During a Suspicious Call

1. Don't give information — Pause before answering questions
2. Get their details — Ask for name, department, reference number
3. Hang up and call back — Use a number you know is legitimate
4. Wait 5 minutes — Attackers sometimes stay on the line

Example verification:

"Thanks for calling. Let me verify this is legitimate. I'll hang up and call our IT helpdesk directly."

If they object to verification, they're not legitimate.

Smishing (SMS Phishing)

Text messages pretending to be:

• Delivery companies (Royal Mail, DPD, Evri)
• Banks
• Government services

Common smishing texts:

❌ "Royal Mail: Your package could not be delivered. Pay £1.99 redelivery fee: [link]"

❌ "HSBC: Suspicious activity on your account. Verify now: [link]"

❌ "HMRC: You are owed a tax refund of £286.40. Claim here: [link]"

The tells:

• Unexpected (you weren't waiting for a delivery)
• Urgency
• Request to click link
• Generic — doesn't mention specific order or account

What to do:

• Don't click links in texts
• If it claims to be from a company, go to their official website or app directly
• Report smishing by forwarding to 7726 (UK)

Physical Impersonation & Tailgating

Not all attacks are digital. Social engineers also:

• Tailgate (follow someone through secure doors)
• Impersonate delivery drivers, contractors, IT support
• Shoulder surf (watch you type passwords)

Scenario: Someone in a high-vis jacket with a clipboard asks you to hold the door open to deliver a package.

What to consider:

• Do you know this person?
• Were you expecting a delivery?
• Should they use the main reception?

What to say:

"Let me direct you to reception — they'll sign you in and show you where to go."

It's not rude to follow security procedures. That's literally why they exist.

The Universal Verification Protocol

No matter the channel (email, phone, text, in-person), the same rules apply:

1. Pause — Don't react immediately to urgency
2. Verify separately — Use contact details you already trust
3. Question authority — Even "the CEO" should go through proper channels
4. Trust your instincts — If something feels off, it probably is
5. Report — Even if you're unsure, let security team know

Why This Matters

In 2023:

• 91% of cyberattacks started with phishing
• BEC cost UK businesses £2.1 billion
• Average cost of a successful phishing attack: £84,000

The attackers are professional. But so are you.

Every time you pause, verify, and report — you're protecting yourself, your colleagues, and your organization.