Phishing is a type of scam where an attacker sends a fake email, text or message that looks like it comes from a trusted source, such as a bank, supplier or colleague, to trick the recipient into clicking a link, opening a file or handing over information.
Messages often create urgency, such as an overdue invoice, a locked account or a request from the boss. Links lead to look-alike login pages that capture passwords, or attachments install malware.
Businesses are targeted constantly, and a single click can lead to stolen credentials, fraudulent payments or ransomware. Payment-redirection scams, where a supplier's bank details are changed, are especially costly.
Defences include staff training, email filtering, multi-factor authentication and a habit of verifying unusual requests by phone using a known number. Encourage staff to report suspicious messages without fear of blame.