What is phishing?

Phishing is a scam where criminals send emails, texts or messages pretending to be someone you trust, like your bank, a supplier or a coworker. The goal is to get you to click a harmful link, open an infected attachment, or hand over passwords or payment details. Pausing to verify unexpected, urgent requests stops most attempts.

Phishing is the most familiar online scam for a reason: it's cheap to send and it only needs one person to fall for it. A few habits and a couple of settings make your business a much harder target.

How does phishing work?

A phishing message borrows someone else's identity. It might look like a shipping notice, a Microsoft sign-in alert, an invoice from a regular supplier, or a quick request from your manager. It usually pushes you to act fast.

The link leads to a convincing fake login page, or the attachment installs malware. Either way, the criminal ends up with your password, your payment details, or a foothold on your computer.

CISA lists the common signs of a phishing message:

• It uses urgent or emotional language, especially threats of consequences for not acting now.
• It asks for personal or financial information.
• It contains shortened links that hide where they lead.
• The sender's address or a link is slightly off, like a misspelled company name.

Why does phishing matter for small businesses?

Small businesses are exposed in two directions. Your team receives phishing emails, and one stolen email password can unlock invoices, customer records and other accounts. Criminals can also send phishing emails pretending to be your business, aimed at your customers. That damages trust you've spent years building.

Phishing is also the usual first step in bigger problems, including business email compromise and ransomware.

How do I protect my business from phishing?

• Turn on multifactor authentication for email and other key accounts, so a stolen password alone isn't enough.
• Agree on a rule: any request to pay, change bank details or share logins gets confirmed by phone, using a number you already have.
• Set up DMARC so it's harder for scammers to send email using your exact domain. Our guide to stopping email spoofing explains how.
• Show your team how to report suspicious messages, and thank them when they do.

Our free website security scan checks your email protection settings and whether your domain appears on the Phishing.Database blocklist, which can be a sign your site was compromised and used to host phishing pages.

Phishing vs spam

Spam is unwanted junk, like ads you didn't sign up for. Phishing is deliberate deception designed to steal something. If a message asks you to log in, pay, or download something unexpected, treat it as possible phishing and verify it another way.