Key takeaway
Phishing is not limited to links and attachments: account compromise and false payment instructions exploit trust too. Defense needs to cover people, accounts, devices and payment processes together.
How phishing works
An attacker impersonates a familiar person or service to obtain information, account access or money, or persuade someone to open a file. Some messages are broad campaigns; targeted phishing is tailored to a person and work context. Smishing uses SMS and vishing uses voice calls; deceptive requests also arrive in messaging apps. A phishing email need not contain a link or attachment: it may request information or payment in a direct reply.
Common types and goals
The categories can overlap: one message may be both targeted and an altered copy of earlier mail. BEC is fraud involving business email, while pharming redirects users to a fake site. The table compares phishing methods and related attacks. How the attack methods differ:
| Method | Distinguishing feature | Possible goal |
|---|---|---|
| Email phishing | Broad deceptive email | Accounts, data or money |
| Spear phishing | Message tailored to a specific target | Targeted access or data |
| Whaling | Senior executives targeted | Sensitive access or approvals |
| Smishing and vishing | SMS and voice calls respectively | Disclosure or action |
| Clone phishing | Altered copy of a genuine message | Malicious destination or file |
| Business email compromise (BEC) | Impersonated or compromised business account; may lack a malicious link | Fraudulent transfer or data |
| Pharming | Site redirection; a lure click may not be needed | Account or payment disclosure |
Possible business impact
A successful attack may lead to account compromise, a fraudulent payment, disclosure of sensitive information or malware execution. Theft of customer data or intellectual property can affect trust and business relationships. Investigation and recovery take time, may interrupt services and add pressure on staff. Some incidents may also call for customer or partner notifications and contractual or legal review; impact depends on the scope and data involved.
Build protection in layers
Teach staff how to report suspicious messages and enable available email filtering, authentication and domain-protection features. Use multifactor authentication (MFA) for accounts with access to important data and choose a phishing-resistant method where available: not every MFA method is resistant. Give users only the access they need. Verify payment-detail changes through a previously known separate channel and require independent payment approval. These controls can reduce risk but cannot guarantee that every attack will be stopped; reporting and response processes are also necessary.