What Is Phishing? A Plain-English Explainer for Employees

An email arrives from a supplier you have worked with for years. The logo is right, the signature matches, and the invoice is for a project you recognise. The only odd detail sits at the bottom: the bank details have changed, and could you update your records before the next payment run?

That is phishing. No virus, no hooded figure breaking through a firewall — just a convincing request designed to make you do one small thing without stopping to check. It works because it borrows trust you already have. The people who fall for it are rarely careless; they are busy, helpful, and dealing with forty other things.

Here is what phishing looks like, how to spot it, and what to do when something feels off.

What Phishing Actually Is

Phishing is any message that pretends to be from someone you trust in order to get you to act: click a link, open an attachment, send money, share a password, or approve a login prompt. The disguise is the whole point. Attackers rarely break in — they ask nicely, and you open the door.

Most of it arrives by email, but the same trick shows up in text messages, phone calls, social media messages, and QR codes stuck on posters or parking meters. The delivery method changes; the goal does not. Someone wants your credentials, your money, or access to the systems you can reach.

The Main Types You Might Run Into

• Bulk email phishing. The same message sent to thousands of inboxes, hoping a few people bite. Often a fake delivery notice, invoice, or password expiry warning.
• Spear phishing. Targeted at you specifically. The sender knows your name, your manager's name, a project you're on, or the software your team uses. More convincing, and more dangerous.
• Smishing. Phishing by text message. A parcel "awaiting redelivery", a bank alert, or a short link from a number you don't recognise.
• Vishing. A phone call. Someone claims to be from IT support and needs you to confirm your password, or a "bank fraud team" asks you to read out a code.
• Business email compromise. A message impersonating a colleague, supplier or executive that asks for a payment, a change of bank details, or gift cards. Frequently there are no links or attachments at all — just a plausible request.
• Fake login pages and approval prompts. A link that opens a near-identical copy of your email, payroll or file-sharing login to capture whatever you type. Or repeated multifactor prompts on your phone, hoping you'll tap "approve" to make them stop.

Red Flags Worth Learning by Heart

No single clue proves a message is fake, but two or three together should stop you cold.

• Urgency plus a threat. "Your account will be closed in 24 hours." Real organisations rarely do business this way.
• A request that skips the normal process. New bank details, a payment outside the usual system, an urgent purchase on a personal card.
• An address that is almost right. Read the domain, not the display name. Two addresses can look identical at a glance and lead to completely different places.
• Link text that doesn't match the destination. Hover over a link on a computer, or long-press on a phone, and read the real address before tapping.
• Unexpected attachments. Especially invoices, receipts, or compressed files that ask you to "enable content" to view them.
• A change in tone. Someone you email daily suddenly writes stiffly, or a message opens with "Dear Customer" when they always use your first name.
• Requests for secrecy. "Keep this between us until it's announced" is a way of stopping you from asking a colleague.

Two Situations That Catch Careful People

The urgent favour from a senior person. A message supposedly from your finance director asks you to buy gift cards for a client thank-you and send the codes by reply. There's no link, nothing technical, just a favour that feels rude to question. Verify it by calling the person on a number you already have — never one supplied in the message.

The late-night approval. Your phone buzzes with a login approval prompt at 11pm. You're half asleep and it might be that update you started earlier. It probably isn't. Deny it, then tell IT.

If You Think You've Clicked or Replied

Act quickly, and don't spend a minute feeling foolish. The clock matters far more than your pride.

1. Stop interacting. Don't enter more details, don't reply, and don't forward the message to colleagues to ask what they think.
2. Report it to IT or your security contact immediately, even if you're unsure. Early reports let them block the sender and reset access before anything spreads.
3. If you typed a password, change it from a different device, and change it anywhere else you reused it.
4. If you approved a login prompt or installed something, say so plainly. Sessions can be revoked and devices checked, but only if IT knows.
5. Watch for follow-up messages. Once a scammer knows your address is live, a second, better-crafted attempt often follows.
6. If money has moved, contact your finance team and your bank straight away; sometimes a transfer can be recalled within a short window.

Anything involving payments, contracts or legal consequences should be confirmed through a channel you already trust and escalated to the right team. Ask before you act. Nobody reasonable will mind, and for anything with financial or legal weight, bring in the relevant specialist rather than deciding alone.

How to Report It at Work

Reporting should take ten seconds. Use the report button in your email client if there is one, forward the message to your IT helpdesk, or raise it through the usual service desk channel. Send the original message rather than a screenshot where you can, and mention what you did: did you click, reply, or enter a password?

Every report does two things. It protects you, and it warns everyone else. One person flagging a fake invoice is often what stops it reaching the accounts team.

Make It a Habit, Not a Headache

You don't need to become a security analyst. Three habits cover most of it: slow down when a message asks for money, credentials or urgent action; verify unusual requests through a second channel you already trust; and report anything that feels slightly wrong, even if you can't explain why.

Phishing relies on people being polite, quick and reluctant to make a fuss. Being the person who asks a short question instead isn't awkward. It's the job.

Photo: caspowser / Pixabay