Understanding How Phishing Attacks Work

Understanding Phishing Attacks

Photo by Markus Winkler on Pexels

Phishing is the practice of sending fraudulent communications that appear to come from a reputable source. It is the number one way attackers gain access to small business systems. According to the FBI, phishing complaints increased by over 100% in recent years, with reported losses exceeding $4.2 billion annually.

How a Phishing Attack Actually Works

Let's walk through a real scenario. An attacker sends an email that appears to be from Microsoft 365, saying: "Your account has been suspended. Click here to verify your credentials." The email looks identical to a real Microsoft email — same logo, same formatting, even the same footer text. The only difference is the URL behind the button, which leads to a fake login page.

When the employee enters their password, the attacker captures it. Within minutes, they are logged into the employee's email account, reading confidential messages, setting up forwarding rules to monitor communications, and using the account to send phishing emails to your clients and vendors — now appearing to come from your company.

Types of Phishing You Need to Know

1. Email Phishing (Mass Campaigns)

The most common type. Attackers send thousands of emails hoping a small percentage will click. These are relatively easy to spot because they are generic — "Dear Customer" instead of your name, unusual sender addresses, or slight misspellings in the domain.

2. Spear Phishing (Targeted Attacks)

Attackers research a specific person or organization and craft a personalized message. They might reference a recent project, a colleague's name, or a vendor you work with. A spear phishing email might say: "Hi John, attached is the updated Q3 report for the Henderson account. Please review before our call Friday." This sounds legitimate because the attacker found this information on LinkedIn or your company website.

3. Business Email Compromise (BEC)

The most financially damaging type of phishing. Attackers compromise an executive's email account and use it to instruct employees to wire money or send sensitive data. Example: An email from the "CEO" to the accounting department: "I'm in a meeting and need you to wire $15,000 to this vendor for an urgent payment. Do this immediately and I'll explain later." The FBI reports BEC losses exceeding $2.4 billion per year.

4. Smishing (SMS Phishing)

Phishing via text message. "FedEx: Your package is held up. Click to confirm delivery details." The link leads to a fake page that captures credentials or installs malware. Smishing is growing rapidly because people are more likely to click links in text messages than in email.

The 7 Red Flags of Phishing

1. Urgency or threats — "Your account will be closed in 24 hours" creates panic, which overrides critical thinking
2. Unexpected attachments — Especially .zip, .exe, or .html files
3. Generic greetings — "Dear Customer" or "Dear User" instead of your name
4. Mismatched URLs — Hover over links before clicking. The display text says "Microsoft" but the actual URL is something else entirely
5. Requests for credentials or sensitive data — No legitimate vendor will ask for your password via email
6. Unusual sender domains — "microsoft-support.com" instead of "microsoft.com". One hyphen changes everything
7. Spelling and grammar errors — Professional organizations proofread. Attackers often do not

Key Takeaways

• Phishing is the number one attack vector for small businesses
• Spear phishing and BEC are the most financially damaging
• Urgency is the psychological weapon — it makes people act before thinking
• Hover over links before clicking to verify the real destination
• When in doubt, do not click — contact the sender through a known channel