Phishing Attacks: How to Spot Them and Protect Your Organisation

Phishing is a social engineering attack in which criminals impersonate a trusted person or organisation to trick victims into clicking a malicious link, opening an attachment, handing over credentials or sending money. It remains the most common way attackers get into organisations, because it targets people rather than technology.

Types of phishing attacks

• Email phishing: mass emails pretending to be banks, delivery companies or software providers.
• Spear phishing: targeted messages that use personal details to look convincing.
• Whaling: spear phishing aimed at executives.
• Business email compromise (BEC): attackers impersonate or take over a real business mailbox to redirect payments.
• Smishing and vishing: phishing by SMS or phone call, often posing as a bank or mobile operator.
• Quishing: QR codes that lead to credential harvesting pages.
• AI-generated phishing: flawless, personalised messages and even cloned voices, which make old advice about spelling mistakes less reliable.

In Pakistan, common lures include fake government schemes and job programmes, bank and wallet SMS alerts, courier delivery notices and prize messages. Fake websites that copy official portals are especially widespread.

Red flags to look for

• Urgency or fear: "Your account will be blocked today."
• A sender address or domain that is slightly off, such as an extra letter or a different ending.
• Links whose real destination does not match the text. Hover before you click.
• Unexpected attachments, especially archives, HTML files or macro-enabled documents.
• Requests to change bank details, buy gift cards or bypass normal approval.
• Login pages reached from a link rather than typed in yourself.

Technical defences against phishing

• SPF, DKIM and DMARC: email authentication that stops attackers spoofing your domain. Move DMARC to a quarantine or reject policy once legitimate senders are configured.
• Email filtering and sandboxing that scans links and attachments before and after delivery.
• Multi-factor authentication, ideally phishing-resistant methods such as FIDO2 security keys or passkeys, so stolen passwords alone are useless.
• External email banners that warn users when a message comes from outside the organisation.
• Blocking automatic forwarding to external addresses, a favourite trick in BEC.
• Detection rules in your SIEM for suspicious inbox rules, impossible travel and unusual OAuth app consents.

If you use Microsoft 365, many of these controls are covered in my Microsoft 365 security checklist.

Awareness training that works

Annual slideshow training does little. What works is short, frequent training combined with realistic phishing simulations, immediate feedback when someone clicks, and a one-click way to report suspicious messages. Celebrate reporting, never shame clicking; people who fear punishment hide mistakes.

What to do if someone clicks

1. Report it to IT or security immediately. Minutes matter.
2. If credentials were entered, reset the password and revoke active sessions.
3. Check for new inbox rules, forwarding and MFA methods added by the attacker.
4. Isolate the device if an attachment was opened.
5. Search for the same email in other mailboxes and remove it.

These steps belong in a written playbook, as described in my incident response plan guide. Need phishing simulations, awareness training or email security hardening? Get in touch.

References and further reading

1. UK NCSC: Phishing attacks, defending your organisation
2. DMARC.org
3. FIDO Alliance: Passkeys
4. MITRE ATT&CK T1566: Phishing