Phishing is a social engineering attack where criminals impersonate trusted entities — banks, employers, government agencies, well-known brands — to trick people into revealing sensitive information (passwords, credit card numbers, MFA codes) or performing harmful actions (clicking malicious links, opening infected attachments, transferring money). Most phishing arrives via email, but variants exist for SMS (smishing), phone (vishing), QR codes (quishing), and social media. Phishing remains the #1 initial access vector for cyberattacks worldwide — Verizon DBIR 2025 attributes 36% of breaches to phishing or social engineering.

Seven common variants: (1) **Email phishing** — generic mass campaigns impersonating banks, shipping companies, government, (2) **Spear phishing** — personalised attack on a specific individual (executive, finance staff), (3) **Whaling** — spear phishing targeting C-level executives, often with fake legal/M&A pretexts, (4) **BEC (Business Email Compromise)** — attacker compromises or impersonates an executive's email and orders fake wire transfers (FBI: $50B in losses 2014-2024), (5) **Smishing** — SMS phishing (fake parcel notifications, banking alerts, BLIK fraud in Poland), (6) **Vishing** — phone-based phishing (fake bank/IT support, often in coordination with email/SMS), (7) **Quishing** — QR-code phishing emerging since 2023, evades email scanners that don't render QR codes.

Seven warning signs: (1) **Urgency or threat** — 'your account will be closed in 24h', 'pay now to avoid arrest', (2) **Sender address mismatch** — display name says 'PayPal' but email is from `paypa1.com` or a typo domain, (3) **Generic greeting** — 'Dear Customer' instead of your name, (4) **Suspicious links** — hover before click, look for shortened URLs, IP addresses, or unusual top-level domains (.xyz, .top, .ru), (5) **Unexpected attachments** — especially Office documents asking to enable macros, ZIP files, or `.exe`/`.lnk`/`.iso`, (6) **Requests for credentials, MFA codes, or money** through email/SMS — legitimate organisations never ask, (7) **Spelling and grammar errors** — though AI-generated phishing in 2024-2026 has eliminated this signal for sophisticated attacks. When in doubt, contact the organisation through an independent channel.

Layered defence: (1) **Phishing-resistant MFA** — FIDO2 hardware keys, passkeys, certificate-based authentication; SMS-OTP and TOTP can be phished via real-time relay (Evilginx, Modlishka), (2) **Email security gateway** with sandbox detonation and impersonation detection (Defender for Office 365, Proofpoint, Mimecast), (3) **DMARC, DKIM, SPF** properly configured to prevent domain spoofing of your own organisation, (4) **EDR/XDR** to catch malware that slips past email filters, (5) **Awareness training** with monthly phishing simulations and click-rate metrics — top performers reduce click rates from 30% to under 5%, (6) **Reporting button** in email client (one-click 'Report Phishing'), feeding back into SOC and email gateway, (7) **Zero Trust network access** so a compromised account can't reach sensitive systems without further authentication, (8) **Out-of-band confirmation for financial transactions** (always call the second person on a different number to verify wire transfer requests).

Act in the first 30 minutes: (1) **Disconnect from the network** if you ran a downloaded file, (2) **Do not enter credentials** if a fake login page is open — close the tab, (3) **Change passwords from a clean device** (not the suspect computer) for affected accounts; prioritise email, banking, work SSO, (4) **Enable MFA** on every important account if not already, (5) **Report to IT/security team** immediately — they can revoke sessions, check for anomalous logins, scan the device, (6) **Contact the bank** if you entered card or banking credentials — block the card, watch for fraud, (7) **For corporate environments**: report to incident@... mailbox, file with internal IR system, notify your manager. The faster the report, the smaller the blast radius — most successful phishing breaches turn out to have been clicked hours before any reporting.

BEC is the most damaging form of phishing, focused on tricking organisations into wire transfers or sensitive data disclosure. Two variants: (1) **Email account compromise** — attacker actually controls a real executive's mailbox via phishing or password reuse, monitors email patterns, then sends fraudulent wire transfer requests, (2) **CEO impersonation** — attacker spoofs or look-alikes the CEO's email (`[email protected]` instead of `company.com`) and pressures finance staff. Average BEC loss per incident in 2025 is $137,000; FBI IC3 reports $2.9B+ in BEC losses for 2024 alone. Defences: domain locking, DMARC enforcement, mandatory out-of-band verification for any wire transfer over a threshold (e.g., $10K), executive security training, AI-based email anomaly detection.

Yes — AI has lowered the bar for sophisticated phishing significantly. (1) **Generative AI** (ChatGPT, Claude, Gemini) writes grammatically perfect phishing in any language, eliminating the 'broken English' signal that used to flag many attacks. (2) **Voice cloning** (ElevenLabs and similar) creates realistic vishing using 30 seconds of public audio of an executive. (3) **Deepfake video** is being used in BEC — a 2024 Hong Kong case saw a finance worker transfer $25M after a deepfake video conference impersonating the CFO. (4) **Automated personalisation** scrapes LinkedIn and corporate websites at scale, enabling spear phishing for the price of mass phishing. Defences: behaviour-based detection (anomalous patterns, not language), out-of-band confirmation as universal control, executive-specific awareness training, voice/video verification protocols.