Phishing
Also called credential phishing, spear phishing
Phishing is a cyber attack in which criminals send messages that appear to come from a trusted source, such as a bank, supplier or colleague, to trick the recipient into clicking a link, entering login details or paying. It is one of the most common ways attackers gain a first foothold in a firm.
How it works
A phishing message creates urgency or trust: a security alert, an unpaid invoice, a parcel notice or a request from a senior manager. The link leads to a fake login page that captures credentials and often one-time passcodes, or downloads malware such as ransomware. Variants include spear phishing aimed at named individuals, whaling aimed at executives, smishing by text and vishing by phone. Generative AI makes messages more convincing and harder to spot by spelling or tone.
Firms defend in layers. Email filtering, domain authentication and link scanning stop many messages before they arrive. Phishing-resistant multi-factor authentication limits the value of stolen passwords. Staff complete regular awareness training and simulated phishing tests, and a simple reporting button lets them flag suspicious messages to the security team. For customers, banks publish how they will and will not contact them, and fraud teams watch for logins and payments that follow a phishing campaign.
The rules
Requires ICT security awareness programmes and digital operational resilience training as compulsory modules in staff training schemes, for all employees and senior management.
EU financial entitiesRequires cybersecurity risk-management measures that include basic cyber hygiene practices and cybersecurity training, multi-factor authentication and incident handling.
Essential and important entities, through national lawRequires periodic, at least annual, cybersecurity awareness training for all personnel that includes social engineering and reflects risks found in the risk assessment.
Banks, insurers and other entities licensed by the New York Department of Financial ServicesCommon questions
What is the difference between phishing and spear phishing?
Phishing sends the same lure to many people. Spear phishing targets a named person or team using details about their role, suppliers or colleagues, which makes it more convincing. Whaling is spear phishing aimed at senior executives.
How does phishing lead to fraud?
Stolen credentials let criminals log into customer accounts or staff systems. From there they redirect payments, change bank details on invoices, take over accounts or install ransomware. Phishing is often the first step of business email compromise and account takeover.
Are simulated phishing tests required?
Rules require security awareness training; simulated phishing tests are a common way firms deliver and measure it. Regulators look for evidence that training works, and click and report rates from simulations provide it.
