# Phishing: What It Is, Why It Works, and How to Spot It *Category: Cyber Awareness · Author: Cyber Data Services Team · Published: 2026-08-20 · https://cyberdataservices.uk/blogs/phishing-what-it-is-how-to-spot-it* > Phishing succeeds because it targets people, not systems. One convincing email, text or call can be all it takes. Here are the common types, the warning signs, and how to reduce the risk to your business. **Phishing remains one of the most common and damaging cyber threats facing UK businesses, and it succeeds because it targets people rather than systems.** One convincing email, text message or phone call is often all it takes to cause serious disruption. Criminals rely on deception, not technical brilliance. By posing as trusted organisations, suppliers or even colleagues, they create a false sense of legitimacy that makes people act quickly without questioning what they are seeing. ## What Is Phishing? Phishing is a cyber attack where a criminal impersonates a legitimate person or organisation to trick someone into doing something they normally would not: clicking a malicious link, opening an infected attachment, or handing over sensitive information such as login credentials or payment details. These messages are built to look genuine and often copy the branding, tone and formatting of well-known companies, so they blend into everyday communications. A single successful attempt can lead to a data breach, a ransomware infection or significant financial loss. ## Common Types of Phishing Not all phishing looks the same. These are the forms we see most often affecting UK businesses: - **Email phishing:** the classic version. Fake emails that appear to come from banks, software providers, delivery firms or internal staff, pushing you to act urgently. - **Spear phishing:** targeted attacks aimed at specific individuals, often senior or finance staff. These are personalised, which makes them much harder to spot. - **Smishing:** phishing by SMS, often claiming you have missed a delivery, owe a fee, or need to verify an account. - **Vishing:** phishing over the phone, where attackers pose as IT support, your bank or a company director to pressure staff into giving up information. ## Warning Signs That Something Is Not Right Phishing is getting more sophisticated, but most attempts still leave clues. Messages frequently manufacture urgency, warning that an account will be suspended or that immediate action is required. That pressure is deliberate, designed to stop you slowing down and thinking. Watch for: - Urgent language, such as "act now", "your account will be locked" or "immediate action required" - Unexpected attachments or links, especially ones you were not expecting - Email addresses that do not quite match the sender's name - Poor spelling or odd phrasing, though this is less reliable now - Requests for passwords, payment details or MFA codes, which is a major red flag If something feels off, it usually is. ## Why Phishing Keeps Working Phishing exploits everyday behaviour. People are busy, distracted and trying to be helpful, and criminals design their attacks around familiar scenarios: unpaid invoices, missed deliveries, urgent requests from a manager. Rather than breaking through technical defences, they bypass them by manipulating people. That is why phishing is not just an IT problem. It is a business risk that touches every department. It is also the entry point for many larger incidents, including the follow-on scams people face [after a data breach](https://cyberdataservices.uk/blogs/protect-yourself-after-cyber-attack). ## Reducing the Risk to Your Business No single measure stops phishing completely, but a layered approach cuts your exposure sharply. Staff awareness does much of the heavy lifting, because people who know what to look for are far less likely to fall for an attack. Technology such as email filtering, endpoint protection and multi-factor authentication adds further layers and limits the damage if credentials are ever compromised. Just as important is a culture where employees feel able to report suspicious messages without fear of blame. Early reporting often stops one phishing email becoming a company-wide incident. We help businesses close this gap with practical [security awareness training](https://cyberdataservices.uk/training-services) and structured [phishing simulation programmes](https://cyberdataservices.uk/playbooks/phishing-simulation-programme), backed by the technical controls covered in our [security improvement service](https://cyberdataservices.uk/improving-services). ## Final Thoughts Phishing is not going away. As AI makes messages more convincing and personalised, they are getting harder to detect. But businesses that combine the right technology with ongoing education and clear internal processes are far better prepared to defend themselves. Understanding phishing and recognising the warning signs can be the difference between a minor inconvenience and a major security incident. Reviewing your protections now can save considerable cost and disruption later. [Get in touch](https://cyberdataservices.uk/contact) to review how well your people and systems would stand up to a modern phishing attack. ## Frequently asked questions ### What are the main types of phishing? The main types are email phishing, spear phishing (targeted at specific people), smishing (by text message) and vishing (by phone call). All rely on impersonating a trusted source to make someone act quickly without checking. ### What are the warning signs of a phishing message? Common signs include manufactured urgency, unexpected links or attachments, sender addresses that do not match the name, and any request for passwords, payment details or MFA codes. If a message feels off, treat it with caution. ### How can I stop my staff falling for phishing? Combine regular awareness training and phishing simulations with technical controls such as email filtering, endpoint protection and multi-factor authentication. Create a blame-free culture so staff report suspicious messages early, before one click becomes an incident. --- Source: https://cyberdataservices.uk · Cyber Data Services (trading name of Tom Sykes Ltd, company no. 06947397), part of the Stiperstone Group. General information only, not specific security or legal advice. For guidance on your own systems, contact info@cyberdata.services or 01952 972 404.