Phishing

Phishing messages often impersonate banks, tax authorities, delivery companies, technology firms or employers. They typically create a sense of urgency, such as warning that an account will be closed, a payment has failed or a parcel cannot be delivered, and include a link to a fake website or an attachment containing malicious software.

Variants include smishing, which uses text messages; vishing, which uses phone calls; and spear phishing, which targets specific individuals or organisations with personalised messages. Business email compromise involves impersonating executives or suppliers to trick staff into transferring money.

For example, a person might receive a text message appearing to be from their bank, saying suspicious activity has been detected and asking them to log in through a link. The link leads to a fake site that captures their login details.

Protection includes being cautious of unexpected messages, checking sender details, avoiding clicking links and contacting organisations through official channels. Two-factor authentication helps limit damage. Banks generally say they will never ask customers to share full passwords or one-time codes. Generative AI has made phishing messages more convincing.