Sales Loves Marketing

What is Phishing?

Phishing is a scam in which an attacker poses as a trusted person or organisation, usually by email, text message or phone, to trick people into clicking a harmful link, opening an infected attachment or handing over passwords, money or other sensitive information.

By Sales Loves Marketing teamOriginally written by Joran HofmanUpdated

Phishing is a scam that pretends to come from someone you trust, such as your bank, a supplier or your own CEO, to get you to click a harmful link, open an infected file or hand over passwords or money. It usually arrives by email, but text messages, social media and phone calls are common too.

What are the types of phishing?

  • Bulk phishing: the same message sent to huge lists, for example a fake "your account has been locked" email.
  • Spear phishing: a message tailored to one person or company, using details about the employees or the business to look convincing.
  • Whaling: spear phishing aimed at senior people, such as board members or finance directors, who can approve payments or reach valuable data.
  • Smishing: phishing by SMS or text message.
  • Vishing: phishing by voice call.

How do you recognise a phishing message?

The US Cybersecurity and Infrastructure Security Agency (CISA) lists these warning signs:

  • urgent or emotional language, often threatening consequences if you don't act fast;
  • requests for personal or financial information;
  • shortened or unfamiliar links;
  • sender addresses or links that are slightly off, such as a misspelt domain.

CISA also warns that good grammar is no longer a safe sign, because AI tools can write flawless messages. If a message might be real, contact the company or person through details you find yourself, not the ones in the message.

Why are sales and marketing teams targets?

Sales and marketing staff open mail from strangers all day. They handle invoices, ad accounts, shared inboxes and customer lists. Fake ad platform warnings, fake invoices and fake "proposal" attachments are easy to send to them.

How do marketers protect customers from brand spoofing?

Attackers also send phishing that pretends to come from your company. That hurts your customers, your reputation and your email deliverability. Protect your sending domains:

  • Set up SPF and DKIM for every service that sends mail as your domain.
  • Publish a DMARC policy and move it towards quarantine or reject. The UK National Cyber Security Centre (NCSC) recommends these anti-spoofing controls.
  • Meet mailbox provider rules. Since 1 February 2024, Gmail requires bulk senders (over 5,000 messages a day to personal Gmail accounts) to use SPF, DKIM and DMARC, and to offer one-click unsubscribe on marketing mail.
  • Consider BIMI, which lets supporting email clients show your logo, but only on mail that passes DMARC.
  • Never ask customers for passwords or payment details by email. Say so in your onboarding emails, so phishing stands out.

How should a company defend its own team?

The NCSC recommends several layers rather than relying on staff alone:

  1. Make it hard for phishing to reach people, with filtering and anti-spoofing.
  2. Help people spot and report suspicious messages.
  3. Limit the damage when a click happens, with up-to-date devices and multi-factor authentication.
  4. Respond quickly, with logging and an incident plan.

The NCSC also advises against blaming staff who click. People who fear blame report late, and fast reporting is what limits the damage.

Frequently asked questions

What are the main types of phishing?

Bulk email phishing sent to as many people as possible, spear phishing aimed at a specific person or company, whaling aimed at senior leaders, smishing by text message and vishing by voice call. All of them pretend to come from someone the victim trusts.

How can a company stop attackers from spoofing its email domain?

Set up SPF, DKIM and DMARC for every domain you send from. DMARC tells receiving mail servers what to do with messages that fail authentication, and a policy of quarantine or reject stops most direct spoofing of your domain. The UK's National Cyber Security Centre recommends these anti-spoofing controls.

What should you do if you clicked a phishing link?

Report it straight away to your IT or security team, change any password you entered and turn on multi-factor authentication. The NCSC advises companies not to blame staff who click, because fear of blame stops people from reporting quickly.