Phishing: How Modern Attacks Work and How to Stop Them

The advice to "look for spelling mistakes" is a decade out of date. Modern phishing emails are written by language models in flawless English, personalised from your LinkedIn profile, sent from a compromised account of someone you actually know, and linked to a login page that proxies the real one so your MFA code works for the attacker too. Phishing remains the most common initial step in breaches because it keeps evolving faster than the training designed to stop it. Here's the current playbook and what genuinely defends against it.

What phishing looks like now

• AI-written lures. Grammatically perfect, contextually plausible, generated in bulk with variations that evade filters. Security vendors have measured sharp rises in volume and quality since 2023.
• Business email compromise (BEC). No malware, no link — just a convincing request to change a supplier's bank details or approve an urgent payment, often from a genuinely compromised mailbox inside the supply chain. The FBI reports BEC losses in the billions of dollars annually, more than ransomware.
• Adversary-in-the-middle kits. The phishing page is a live proxy to the real Microsoft 365 or Google login. Password and one-time code go straight through; the attacker keeps the session cookie. Sold as a subscription service.
• QR-code phishing ("quishing"). A QR code in an email or on a poster moves the victim to their phone, where the URL is hard to inspect and corporate email filters are out of the loop.
• Smishing and vishing. Text messages about parcels, tolls and bank alerts; phone calls impersonating IT support or executives, now with cloned voices. The 2023 casino breaches began with a phone call to a help desk.
• Collaboration-tool phishing. Teams, Slack, shared-document invitations and calendar invites from external tenants, exploiting the trust people place in "internal-looking" tools.
• Consent phishing. Instead of stealing a password, the attacker gets the victim to grant a malicious OAuth app access to their mailbox. No credentials involved, and MFA doesn't apply.

Recognising it anyway

Since surface quality is no longer a signal, focus on context and consequence:

• Does the message create urgency, secrecy or fear? ("Your account will be closed", "Don't tell anyone until the deal closes.")
• Does it ask for something with consequences — a payment, a credential, bank details, an approval, installing something?
• Is the request unusual for this person, channel or time? A CFO asking for gift cards by text is a pattern, not a coincidence.
• Does the link go where it claims? On desktop, hover. On phone, don't tap — go to the site directly.
• Would you have expected this? An unexpected invoice, a delivery you didn't order, a password reset you didn't request.

The single most reliable habit: verify out of band. Call the person on a number you already have. Open the bank's app rather than the link. Ask IT through the help-desk portal, not the number in the email.

Technical defences that work

• Phishing-resistant MFA. Hardware keys and passkeys defeat proxy kits outright because the credential is bound to the real domain. This is the highest-impact control available — see Multi-Factor Authentication.
• Email authentication: SPF, DKIM and DMARC with an enforcing policy, so your domain can't be spoofed and you can reject unauthenticated mail claiming to be from partners.
• Modern email security that analyses behaviour and relationships (is this the first email from this sender? does the payment request pattern match?) rather than just scanning attachments. Link rewriting and sandboxing for the residual.
• Browser and DNS protection that blocks newly registered and lookalike domains at click time.
• Restrict OAuth app consent so users can't grant mailbox access to arbitrary third-party apps without admin approval.
• Payment controls: mandatory callback verification for any change to supplier bank details, and dual approval above a threshold. This is what stops BEC, and it's a finance process, not a security product.
• Session monitoring for tokens used from new devices or impossible locations, so a stolen session is caught even when the login looked legitimate.

Training that isn't theatre

Annual compliance videos don't change behaviour. What does: short, frequent, realistic simulations that mirror current attacks (including QR codes, Teams invites and voice calls); a one-click report button in the mail client with fast feedback when people use it; measuring reporting rate rather than click rate, because people who report quickly are the early-warning system; and a blame-free response when someone does click — the employee who admits it within minutes has just saved the organisation, and punishing them guarantees the next person stays quiet.

If you've clicked

Disconnect nothing dramatic; act fast. Report it to security immediately. Change the password for that account from a different, known-good device, and revoke active sessions. Check for new mailbox rules (attackers add forwarding and auto-delete rules to hide their activity) and new OAuth app grants. If it was a payment request, call the supposed sender and your bank. The window between compromise and damage is often hours; the difference between a near miss and an incident is how quickly someone speaks up.