Phishing Attacks How Cybercriminals Trick Victims and How to Stay Safe
A single convincing message can be enough to expose a password, drain a bank account, or give criminals access to a business system. That is why phishing remains one of the most persistent cyber threats facing individuals, freelancers, employees, and small businesses.
Phishing works because it targets people, not just technology. A criminal does not need to break through a firewall if they can persuade someone to click a link, open an attachment, approve a payment, or enter login details on a fake website.
For Astrid IT Lab, the message is simple: awareness is one of the strongest defences. When people understand how these scams look, feel, and operate, they are much harder to fool.
This guide explains how phishing works, why it is so common, the warning signs to watch for, and the practical steps that reduce risk.
What phishing is and why it works
Phishing is a type of cyber attack where criminals pretend to be someone trustworthy to trick people into sharing sensitive information or taking unsafe action.
The attacker may impersonate:
A bank
A delivery company
A cloud storage provider
A senior manager
A government service
A payment platform
A supplier or customer
A helpdesk or IT support team
The goal is usually to steal something valuable. That might be a password, bank card details, a one-time security code, confidential files, or access to an email account.
Phishing Attacks often succeed because they create pressure. The message may claim that an account will be closed, a payment has failed, a parcel is waiting, or urgent approval is needed. The victim feels rushed and reacts before checking properly.
A common phishing email might say:
“Your account has been temporarily suspended. Confirm your details within 24 hours to avoid losing access.”
The link then leads to a fake login page that looks similar to the real service. Once the victim enters their username and password, the attacker captures the details.
Phishing does not always rely on poor spelling or obvious scams. Many modern attempts are polished, well formatted, and convincing. Criminals study real emails from well-known brands, copy their style, and use wording that sounds familiar.
The best defence is to slow the moment down. If a message asks for sensitive information, money, login details, or urgent action, treat it as something to verify, not something to obey.
Why phishing remains one of the most common cyber threats
Phishing continues to grow because it is relatively cheap, easy to send at scale, and effective. Attackers can send thousands of messages at once, then focus on the people who respond. They do not need every target to fall for the scam. A small number of successful responses can be enough.
Small businesses are often at risk because they may not have a dedicated security team. A bookkeeper, founder, contractor, or receptionist may handle payments, customer emails, supplier invoices, and cloud accounts from the same inbox. That makes one compromised account more damaging.
Individuals are also frequent targets. Personal email accounts often contain password reset links, identity documents, travel information, bank alerts, and years of private conversations. If an attacker gets into a personal inbox, they may use it to reset passwords for other services.
Phishing is common because it takes advantage of normal human behaviour:
People are busy.
People trust familiar brands.
People want to solve problems quickly.
People respond to authority.
People worry about missing deliveries, payments, or deadlines.
People may not know how to check whether a message is genuine.
Criminals also adapt quickly. When more people began using online banking, phishing messages copied banks. As cloud storage and remote work became common, attackers copied file-sharing alerts, video meeting invites, and password reset emails. When text messages became widely used for deliveries and banking, phishing moved into SMS as well.
The methods change, but the pattern remains the same. The attacker creates trust, urgency, or fear, then asks the victim to act.
The main ways cybercriminals trick victims
Phishing can arrive through many channels. Email is still the most recognised form, but fake websites, text messages, phone calls, and messaging apps are now common.
Deceptive emails that look legitimate
Email phishing often copies the appearance of a trusted organisation. The sender may use a display name that looks familiar, while the actual email address is slightly different.
For example, a message may appear to come from “Microsoft Support”, but the sender address might be from a free email account or a misspelt domain. The email may ask the reader to “verify account activity” or “review an attached document”.
Common email phishing themes include:
Password expiry notices
Failed payment alerts
Fake invoices
Delivery problems
Shared document notifications
Security warnings
Tax or refund messages
Account suspension threats
Some emails include attachments that contain malware. Others contain links to fake websites. Some simply ask the recipient to reply with information.
A practical example:
A freelancer receives an email that appears to be from a new client. The message says the project brief is attached and asks for a quick review. The attachment is actually malicious, or the link asks the freelancer to sign in with their email account. If they enter their details, the attacker may gain access to their inbox and client history.
Fake websites that steal login details
Many phishing messages lead to fake websites. These sites often mimic real login pages for banks, email providers, cloud storage tools, or payment services.
The page may look convincing at first. It may use similar colours, layout, and wording. The web address is usually the giveaway.
A fake web address might include:
Extra words before or after the brand name
Misspellings
Strange endings
Long strings of random characters
Hyphens used to imitate an official domain
For example, a fake website might use a domain that looks close to a real service but is not the same. On a small phone screen, this can be harder to spot.
A useful habit is to avoid logging in from links in unexpected messages. Open a new browser tab and type the known website address yourself, or use a trusted bookmark.
Text message scams and mobile phishing
Text message phishing is often called smishing. These messages are short, direct, and designed to create instant action.
Common examples include:
“Your parcel could not be delivered. Pay a small redelivery fee.”
“Your bank has detected suspicious activity. Secure your account now.”
“You have an unpaid toll or tax bill.”
“Your mobile account will be suspended unless you verify your details.”
These scams work well because people often read texts quickly and tap links without thinking. On mobile screens, it is also harder to inspect web addresses.
A real-world scenario:
Someone receives a text saying a parcel is waiting and a small fee is required. They are expecting a delivery, so the message feels plausible. The link opens a fake delivery website that asks for card details. The criminal now has payment information and may attempt further fraud.
A safer approach is to close the message and check directly through the official delivery company website or app. Never use the link in the text if the message was unexpected.
Social engineering that manipulates trust
Social engineering is the human side of phishing. Instead of relying only on fake links, criminals manipulate emotions and relationships.
They may pretend to be:
A manager needing urgent help
A supplier chasing payment
A customer requesting a change
An IT technician asking for access
A colleague sharing a file
A family member in distress
Business email compromise is a common example. An attacker may gain access to a real email account or create a similar-looking address. They then send a message directing staff to change bank details for a supplier or approve an urgent payment.
A typical message might say:
“I am in meetings all afternoon. Please pay this invoice today and do not delay. I will explain later.”
The pressure is the trick. The attacker wants the recipient to skip the normal approval process.
Small businesses can reduce this risk with simple rules. Any request to change bank details, send money, buy gift cards, or share passwords should be verified through another channel. Call the known contact number, not the number in the suspicious email.
Common phishing tactics to recognise
Phishing messages are not all identical, but many use the same patterns. Learning these patterns makes it easier to spot trouble before damage is done.
Urgency and fear
Attackers often use deadlines to stop people thinking clearly.
Watch for phrases such as:
“Act now”
“Your account will be closed”
“Immediate action required”
“Payment overdue”
“Security breach detected”
“Final warning”
Urgency does not always mean a message is fake, but it does mean the message deserves extra care.
Unexpected links or attachments
A link or attachment that arrives without context should raise concern, especially if it asks for a login.
Be careful with:
Invoices you were not expecting
Shared documents from unknown senders
Compressed files
Password-protected attachments
Links that hide their destination behind buttons
Files claiming to be receipts, statements, or scans
If a message says “see attached”, but gives no clear reason or context, pause before opening it.
Slight changes in sender addresses
Criminals often use email addresses that look close to the real thing. A single changed letter can be enough to mislead a busy reader.
Check for:
Misspelt domain names
Unusual email endings
Free email accounts used for business requests
Display names that do not match the email address
Supplier names with extra words or characters
On many devices, the display name appears first and hides the real address. Tap or hover over the sender name to inspect it.
Requests for sensitive information
Legitimate organisations rarely ask for passwords, full card details, or security codes by email or text. Be suspicious if a message asks for:
Passwords
Multi-factor authentication codes
PINs
Full bank card numbers
Passport or identity documents
Payroll details
Remote access to a device
Bank account changes
If the request involves money, identity, or access, verify it through a trusted channel.
Messages that feel slightly wrong
Sometimes the warning sign is not one single error. It is the overall feeling.
A message may feel wrong because:
The tone is unusual for the sender.
The request is out of character.
The timing is odd.
The grammar is strange.
The signature is missing or unfamiliar.
The branding looks slightly off.
The sender avoids normal procedures.
Trust that instinct. It is better to check one genuine message than to ignore one dangerous one.
Real-world scenarios that show how phishing happens
Phishing is easier to recognise when it is placed in everyday situations. The following examples are fictional, but they reflect common patterns seen in real incidents.
The fake invoice sent to a small business
A small business receives an invoice from what appears to be a known supplier. The email says payment details have changed and asks accounts to use the new bank account.
The invoice looks normal. The logo is familiar. The amount is similar to previous payments. The only change is the bank account.
The safer response:
Do not reply to the email to confirm.
Call the supplier using a known phone number.
Ask whether the bank details changed.
Require approval from a second person before updating payment details.
Keep a record of the verification.
A simple phone call can prevent a serious loss.
The cloud document that steals a password
An employee receives a message saying a document has been shared with them. The link opens a page that looks like a well-known cloud login. They enter their email and password.
The page then says the password was incorrect, or it redirects to the real service. The victim may assume it was a harmless error, but the attacker now has their credentials.
The safer response:
Do not sign in through unexpected document links.
Open the cloud service directly from a trusted bookmark.
Check whether the document appears there.
Report the message to IT or the service provider.
Change the password if details were entered.
This is where multi-factor authentication can make a major difference. Even if a password is stolen, a second verification step can block many login attempts.
The fake boss asking for gift cards
An employee receives an email that appears to come from a senior manager. The message says the manager is busy and needs several gift cards bought urgently for a client. The employee is asked to send photos of the codes.
This scam is common because it avoids bank transfers and can be completed quickly.
The safer response:
Check the sender address.
Contact the manager through a known number or messaging channel.
Follow company spending rules.
Refuse requests that ask for secrecy or bypass normal approval.
Report the message internally.
Any request that combines urgency, secrecy, and money should be treated as high risk.
Warning signs that should make you pause
Phishing often depends on speed. A short pause can break the attack. Before clicking, replying, or paying, look for these warning signs.
Warning sign | What it may mean | Safer action |
The message creates panic | The sender wants a quick reaction | Stop and verify through another channel |
The email address looks odd | The sender may be impersonating someone | Inspect the full address carefully |
The link does not match the real website | The page may be fake | Type the website address yourself |
The request involves passwords or codes | The attacker may be stealing access | Do not share security details |
The message asks for secrecy | Normal checks are being bypassed | Speak to a manager or trusted contact |
The attachment is unexpected | It may contain malware | Confirm with the sender before opening |
Bank details have changed | Payment fraud may be attempted | Call the supplier on a known number |
One warning sign is enough to slow down. Several warning signs together should be treated as suspicious.
Practical prevention measures for individuals
Phishing cannot be removed completely, but strong habits reduce the risk significantly.
Use strong, unique passwords
Reusing passwords is dangerous. If one site is breached, criminals may try the same password on email, banking, shopping, and business accounts.
Good password habits include:
Use a different password for every important account.
Make passwords long rather than clever.
Avoid names, birthdays, pets, favourite teams, or common phrases.
Use a reputable password manager to store passwords securely.
Change passwords immediately if an account may be compromised.
A strong password is easier to manage when you do not have to remember every one. A password manager can create and store long unique passwords, so one stolen password does not open every account.
Turn on multi-factor authentication
Multi-factor authentication, often called MFA, adds a second step when signing in. This may involve an app notification, a code, a security key, or biometric approval.
MFA is not perfect, but it gives strong protection against stolen passwords. Prioritise it for:
Email accounts
Banking and payment services
Cloud storage
Business software
Social media accounts
Admin accounts
Password managers
Where possible, use an authentication app or security key rather than SMS codes. Text messages are better than no MFA, but app-based methods are usually safer.
Verify before you click
A simple verification habit prevents many scams.
Before clicking a link:
Ask whether you expected the message.
Check the sender address.
Hover over the link on a computer to preview the destination.
On mobile, press and hold carefully to inspect the link, without opening it.
Look for spelling issues in the web address.
Open the service directly instead of using the link.
If a bank, delivery company, or government service contacts you, go to the official website yourself. Do not rely on the link in the message.
Keep devices and apps updated
Updates often fix security weaknesses. Delaying updates gives attackers more opportunity.
Keep these updated:
Operating systems
Web browsers
Email apps
Mobile apps
Antivirus or built-in security tools
Router firmware where practical
Enable automatic updates where possible. This is one of the simplest security improvements for non-technical users.
Report suspicious messages
Reporting helps protect others. It also gives organisations a chance to block similar attacks.
In the UK, suspicious emails can be forwarded to the National Cyber Security Centre at `report@phishing.gov.uk`. Suspicious texts can often be forwarded to `7726`, which spells SPAM on a phone keypad.
You can also report phishing inside many email platforms using the built-in “report phishing” or “report junk” option.
If login details or payment information have already been entered, act quickly:
Change the password from a trusted device.
Turn on MFA if it is not already active.
Contact the bank or payment provider if money or card details are involved.
Review recent account activity.
Tell your employer or IT provider if a work account was involved.
Warn contacts if your email account may have sent scam messages.
Fast action can limit the damage.
Practical prevention measures for small businesses
Small businesses do not need a large security department to reduce phishing risk. Clear rules, training, and basic technical controls make a real difference.
Create simple verification rules for payments
Payment-related phishing can be costly. Every business should have clear rules for:
New supplier payments
Changes to bank details
Refund requests
Urgent transfers
Gift card purchases
Payroll changes
A useful rule is to verify any financial change through a second channel. If the request arrives by email, confirm by phone using a saved number. If the request arrives by phone, confirm through an existing verified contact.
Do not use contact details supplied in the suspicious message.
Train employees with realistic examples
Security awareness works best when it uses plain language and realistic situations. Staff do not need to become cybersecurity experts. They need to recognise risk and know what to do next.
Training should cover:
How to inspect sender addresses
How to check links
How fake login pages work
How invoice fraud happens
Why passwords must not be reused
When to report suspicious messages
Why no one should share MFA codes
Short, regular reminders are often more effective than one long annual session. Use real examples, remove personal details, and explain what made each message suspicious.
Make reporting easy and blame-free
People may hide mistakes if they fear punishment. That gives attackers more time.
A safer culture is clear and practical:
Report suspicious messages quickly.
Report accidental clicks immediately.
Do not blame people for honest mistakes.
Thank staff who raise concerns.
Share lessons without embarrassing anyone.
A fast report can stop an attack spreading to others.
Limit access where possible
Not every account needs full access to every system. If an account is compromised, limited access reduces the damage.
Small businesses should review:
Who can approve payments
Who has admin access
Who can access customer records
Which accounts can reset passwords
Which former staff or contractors still have access
Remove accounts that are no longer needed. Use separate admin accounts where appropriate. Keep shared accounts to a minimum because they make it harder to trace activity and manage passwords safely.
Protect business email accounts
Email is often the main target because it connects to almost everything else. A compromised inbox can be used to reset passwords, impersonate staff, contact customers, and intercept invoices.
Protect email accounts by:
Enforcing MFA
Using strong unique passwords
Disabling automatic forwarding unless required
Reviewing sign-in activity where available
Setting alerts for suspicious access
Training staff to spot fake login pages
Using business-grade email filtering where possible
If a business can only improve one area, email security is a sensible place to start.
What to do if you think you have been phished
The right response depends on what happened. The key is to act quickly and calmly.
If you clicked a link but entered nothing
Close the page. Do not download anything. If a file downloaded automatically, do not open it. Delete it or ask a trusted IT professional to check the device.
It is also sensible to run a security scan and report the message.
If you entered a password
Change the password immediately from the official website or app. If you reused that password anywhere else, change it there as well.
Then:
Turn on MFA.
Sign out of other sessions if the service offers that option.
Check recovery email addresses and phone numbers.
Review recent account activity.
Watch for password reset emails you did not request.
If it was a work account, report it to the business owner, manager, or IT provider straight away.
If you entered bank or card details
Contact your bank or card provider immediately using the number on the back of your card or from the official website. Explain what happened and follow their guidance.
Also check recent transactions and keep records of messages, links, and payments connected to the scam.
If you opened an attachment
Disconnect from the internet if the device begins acting strangely, then seek technical support. Do not ignore warning signs such as unexpected pop-ups, unknown apps, disabled security tools, or unusual account activity.
If the device is used for business, report the incident before using shared systems again.
If your email account was taken over
A compromised email account can affect many other accounts.
Take these steps:
Change the password.
Enable MFA.
Review forwarding rules.
Check sent items for scam messages.
Remove unknown recovery options.
Warn key contacts if suspicious emails were sent.
Review linked accounts for password resets.
If you cannot regain access, follow the provider’s account recovery process and inform any affected contacts through another channel.
A simple phishing safety checklist
Use this checklist when a message asks you to click, pay, sign in, download, or share information.
Stop before acting
Urgency is a common trick. Take a moment to assess the request.
Check the sender
Look at the full email address or phone number, not just the display name.
Inspect the link
Make sure the web address matches the genuine service.
Avoid logging in from unexpected links
Visit the official website directly.
Never share passwords or MFA codes
Legitimate support teams should not ask for them.
Verify money requests
Confirm payment changes through a trusted contact method.
Use unique passwords
A password manager can help create and store them.
Turn on MFA
Prioritise email, banking, cloud storage, and business systems.
Report suspicious activity
Quick reporting protects you and others.
Conclusion
Phishing succeeds because it looks familiar, feels urgent, and catches people at busy moments. The message may arrive as an email, text, fake website, phone call, or shared document, but the aim is usually the same: steal information, money, or access.
The strongest protection is a mix of awareness and simple habits. Use strong unique passwords. Turn on multi-factor authentication. Verify unexpected requests through trusted channels. Train employees with realistic examples. Report suspicious activity quickly, even if no harm seems to have been done.
Cybercriminals rely on speed and trust. Slowing down, checking carefully, and following clear security rules can stop many attacks before they cause damage.
Comments