Cyber criminals are getting smarter, and phishing remains one of their favourite tricks. Whether it’s through an email, text message, or even a QR code, phishing attacks are designed to catch you off guard. Here’s what you need to know to spot them and protect your workplace.

What Is Phishing?

At its core, phishing is a type of online scam that uses social engineer manipulating people into making mistakes. Attackers might send you a message that looks legitimate but actually contains a dangerous link or attachment.

If you click, you could:

• Download malware onto your device

• Be redirected to a fake site that steals your login details

• Be tricked into sharing sensitive information

And it’s not just email anymore. Phishing now shows up in text messages, social media, messaging apps, phone calls, and even QR codes. With millions of people targeted every year, the risk is real.

Smishing: Phishing by Text

Email scams are widely recognised these days, so criminals are turning to text messages. This tactic, called smishing, works because text messages all look alike, making it harder to spot the fakes.

In the UK, suspicious texts can be reported for free by forwarding them to 7726, a service run by the National Cyber Security Centre (NCSC). Since launch, more than 25,000 scams have been removed thanks to these reports.

Protecting Your Business

The best defence is awareness. A quick way to evaluate suspicious messages is to use the CASE method:

• C – Context: Were you expecting the message? Does it fit the conversation, or does it feel random?

• A – Action: Is the message asking you to click a link, open an attachment, or transfer money?

• S – Sender: Do you recognise the sender, and does the tone sound like them? If in doubt, check using trusted contact details.

• E – Emotion: Does it create urgency, fear, or pressure to act fast? That’s often a warning sign.

Key Takeaway

Phishing won’t disappear anytime soon, but staying alert is the best way to stay safe. Encourage your team to slow down, think twice, and verify before they click.

If something feels suspicious, trust your instincts — it probably is.