Phishing is a deception that impersonates a trusted person, service or supplier, by email, message, phone call, QR code or fake website, so that the victim hands over credentials, approves access, makes a payment or opens malicious content. It is social engineering: it exploits people's trust and haste, not a software flaw.
How it works
The attacker picks a believable hook: an invoice, a pending delivery or an urgent request from management. It can be a mass mailing or a targeted attack (spear phishing) using real details about the company or the person.
The end goal is usually to steal credentials with a fake sign-in page, install malicious code (including ransomware) or trigger a transfer or a change of bank details. The NCSC, the UK's cyber security agency, proposes four layers: make it difficult for attackers to reach users (for example, with DMARC, SPF and DKIM, to make it harder to spoof your domain), help people identify and report suspicious messages, protect the organisation from those that get through and respond quickly.
Example
Illustrative example, not a real case. Someone in administration receives an email that looks like it comes from a regular supplier, with a corrected invoice and a link to a portal. The portal copies the Microsoft 365 sign-in page and the person types their username and password.
If the account has no second factor, the attacker gets in, creates a forwarding rule in the mailbox and prepares a change of bank account. The useful reaction is fast: the person reports it through the agreed channel, IT resets the password, closes open sessions and checks the mailbox rules, and any change of bank details is confirmed by calling a number already on file, never the one in the email.
Limits
Neither filters nor training catch every attempt. According to the NCSC, no training package, simulations included, can teach people to spot every phishing message, and asking everyone to examine every email in depth is unrealistic because answering emails and clicking links is part of the job.
Simulations can erode trust and create legal risk: discuss them with HR, do not punish clicks and also measure how many people report. The second factor is not a guarantee either: SMS codes can be stolen through phishing and push approvals through persistence. FIDO2 keys resist better, and number matching in approvals is a sensible improvement while they cannot be used.
When to call an expert
Ask for help if someone has entered credentials on a doubtful page, if you suspect an account is controlled by someone else, if you have been asked to change bank details and cannot confirm the request, if your customers receive fake emails in your name or if there is no simple channel to report suspicious messages.
At Impulso Tecnológico we work on diagnosis, technical controls and training: we review how identity and email are protected, which controls are missing and what the team needs to know. See our cybersecurity service, the guide to building an IT security plan or tell us about your case.
Learn more
Related glossary terms: MFA, ransomware, EDR and Zero Trust.
Official sources: the NCSC guidance Phishing attacks: defending your organisation, written for medium and large organisations (for smaller ones it points to its Cyber Action Toolkit), and the CISA fact sheet Implementing Phishing-Resistant MFA.