Phishing remains one of the most prevalent and damaging cyber threats faced by individuals and organisations in the UK. According to the National Cyber Security Centre (NCSC), phishing attacks were responsible for 45% of all reported cyber incidents in the country in 2023.  This underscores the need for increased awareness and education about phishing to safeguard personal and professional data from cybercriminals.  

What is Phishing?

Phishing is a type of cyber attack where attackers attempt to deceive individuals into providing sensitive information such as usernames, passwords, credit card numbers or other personal details.  This is typically achieved through fraudulent emails, websites, or text messages that appear to be from legitimate sources. The goal of phishing is to trick recipients into divulging their information, which can then be used for malicious purposes such as identity theft or financial fraud.  

How Do Phishing Attacks Work?

Phishing attacks usually begin with a deceptive message that appears to be from a trusted entity, such as a bank, social media platform, or well-known company. These messages often contain urgent language, prompting the recipient to take immediate action, such as clicking on a link or downloading an attachment.  The link may lead to a fake website designed to look identical to the legitimate site, where victims are asked to enter their credentials or personal information. Once the information is entered, it is captured by the attacker.  

What are Common Types of Phishing?

Phishing attacks come in various forms, each with its own unique tactics and targets:

• Email Phishing: The most common type, where attackers send fraudulent emails that appear to come from legitimate sources. These emails often contain links to fake websites or malicious attachments.
• Spear Phishing: A more targeted form of phishing where attackers focus on a specific individual or organisation. These attacks are often well-researched and personalised to increase the likelihood of success.
• Smishing (SMS Phishing): Involves sending fraudulent text messages to trick individuals into clicking on a link or providing personal information.
• Vishing (Voice Phishing): Uses phone calls to deceive victims into revealing sensitive information. The caller may pose as a bank representative, tech support, or another trusted entity.
• Clone Phishing: Involves creating a near-identical copy of a legitimate email previously sent to the victim. The cloned email includes a malicious link or attachment.

 

How Can You Identify a Phishing Attempt?

Being able to recognise phishing attempts is crucial for protecting yourself and your organisation from cyber threats. Here are some telltale signs of phishing:

• Unusual Sender Address
• Generic Greetings (e.g. “Dear Customer”)
• Sense of Urgency
• Suspicious Links or Unexpected Attachments
• Poor Grammar and Spelling

 

What Should You Do If You Suspect a Phishing Attack?

If you suspect you have received a phishing email or message, take the following steps:

1. Do not click links or download attachments. Avoid interacting with any links or attachments in the suspicious message.
2. Contact the purported sender using a known, trusted method (such as their official website or phone number) to verify the legitimacy of the message.
3. Report the phishing email to your email provider, IT department, or relevant authorities. In the UK, you can forward phishing emails to the NCSC at report@phishing.gov.uk.
4. Once reported, delete the phishing email or message from your inbox.
5. Keep a close eye on your accounts for any suspicious activity. If you believe your information has been compromised, take immediate action to secure your accounts.

 

How Can You Protect Yourself from Phishing?

Preventing phishing attacks requires a combination of awareness, vigilance and technical measures. It’s essential to stay informed about the latest phishing tactics and educate your colleagues, friends and family about the dangers of phishing. Additionally, installing and regularly updating antivirus and anti-malware software on all your devices can provide an extra layer of protection. Enabling Multi-Factor Authentication (MFA) adds another level of security by requiring additional verification steps beyond just a password.  Keeping your operating system, browsers and other software up to date with the latest security patches is also crucial. Always be skeptical of unsolicited emails and messages, especially those requesting personal information or urgent action. Consider investing in cyber security solutions to have the very best protection for your organisation, such as managed dectection and response services.   

Closing Summary

Phishing remains a significant threat in the cybersecurity landscape, but by understanding how these attacks work and recognising the warning signs, you can better protect yourself and your organisation from falling victim. Always be cautious with unsolicited communications, verify the legitimacy of requests for information and stay informed about the latest phishing tactics.