The short answer
A phishing attack is a message, usually an email, text or phone call, that pretends to come from someone you trust so you will click a malicious link, open an infected attachment, hand over your login details or make a payment. Most phishing aims to steal credentials or money, or to gain a first foothold in a network.
On this page
- What is a phishing attack and how does it work?
- What are the main types of phishing attack?
- Why does phishing still work?
- How do you defend against phishing?
- How does a phishing simulation test your defences?
- How can you tell if you have been phished?
- How do I report phishing in the UK?
- Why Sovereign Secure?
A phishing attack is a message that impersonates a trusted person or organisation to trick the recipient into clicking a malicious link, opening an attachment, giving away login details or sending money. Email is the classic channel, but the same trick now arrives by text, phone call, QR code and collaboration apps. The UK government’s Cyber Security Breaches Survey has consistently found phishing the most common breach or attack that businesses identify.
What is a phishing attack and how does it work?
A phishing attack is social engineering delivered by message: the attacker borrows someone else’s identity and trust to get you to act before you think. Almost every phishing attack follows three steps:
- The lure. The attacker impersonates someone the target expects to hear from: a bank, a delivery firm, a supplier, a manager or the IT helpdesk.
- The pressure. The message creates a reason to act now, such as an unpaid invoice, a locked account, a missed parcel or an urgent request from the boss.
- The payoff. The target enters credentials on a fake login page, runs malware from an attachment, approves a sign-in or changes a supplier’s bank details.
Stolen credentials then let the attacker read email, move into other systems or phish others from a real, trusted mailbox.
Phishing is the most common of the types of social engineering attacks; our guide explains the other twelve with examples.
What are the main types of phishing attack?
The types differ mainly in channel and in how closely the attacker researches the target. Each one below has a typical example:
| Type | Channel | How it works | Typical example |
|---|---|---|---|
| Bulk phishing | The same generic lure sent to thousands of people, relying on a few clicks | “Your mailbox is full. Sign in within 24 hours to keep receiving email.” | |
| Spear phishing | Email, social media | A message tailored to one person or team using research about their role and contacts | A recruiter’s “updated job description” sent to an HR manager by name, with a malicious attachment |
| Whaling | Spear phishing aimed at senior executives, who have the authority to approve payments | A fake board pack or legal notice sent to the finance director | |
| Business email compromise | A real or spoofed business mailbox used to redirect invoices or request payments | A supplier’s hacked mailbox asks you to pay this month’s invoice to “our new bank account” | |
| Smishing | SMS and messaging apps | Texts about parcels, banks or tax refunds linking to fake sites | “We missed your parcel. Pay the small redelivery fee here.” |
| Vishing | Phone and voicemail | Callers posing as the bank, IT support or a supplier, sometimes with a cloned voice | “IT helpdesk” calls to read out a code they say will fix your account |
| Quishing | QR codes | A QR code in an email, letter or poster that leads to a credential-harvesting page | A sticker over a car park payment QR code that leads to a fake payment page |
| Clone phishing | A copy of a genuine email the target has already received, with the link or attachment swapped | A resent “shared document” notice from a real colleague’s thread, now pointing to a fake login | |
| Adversary-in-the-middle | Email, then web | A fake login page relaying to the real site, capturing the password and the signed-in session | A Microsoft 365 sign-in page that passes your MFA code through and keeps your session |
Why does phishing still work?
Because it targets habits rather than technology. People act quickly on routine-looking messages, especially from authority figures or under time pressure. Generative AI now writes fluent, well-targeted lures, so spelling mistakes are no longer a reliable sign. Our guide on how to spot phishing emails covers the signs that still hold, with five annotated examples.
How do you defend against phishing?
No single control stops phishing. The NCSC’s guidance, Phishing attacks: defending your organisation, sets out four layers so that a message missed by one is caught by the next:
| Layer | Aim | Examples |
|---|---|---|
| 1 | Make it difficult for attackers to reach your users | SPF, DKIM and DMARC, email filtering, limiting what staff details are public |
| 2 | Help users identify and report suspected phishing | Practical training, a one-click report button, a no-blame reporting culture |
| 3 | Protect your organisation from phishing that gets through | Multi-factor authentication, password managers, least privilege, patched devices, blocking known-bad sites |
| 4 | Respond quickly to incidents | Sign-in monitoring, a tested incident response plan, fast password and session resets |
Layer 3 assumes some phishing will get through, so prefer phishing-resistant sign-in such as passkeys or FIDO2 security keys, which will not work on a look-alike site.
For card payments, PCI DSS v4.0.1 makes two layers explicit: Requirement 5.4.1 (processes and automated mechanisms to detect and protect personnel against phishing) and Requirement 12.6.3.1 (phishing awareness training), both mandatory since 31 March 2025.
How does a phishing simulation test your defences?
A phishing simulation sends realistic, authorised lures to staff and measures clicks, submitted credentials and, most usefully, how many people report the message and how fast. The NCSC cautions that blaming people who click does not work, so good programmes reward reporting.
How can you tell if you have been phished?
Often you cannot tell at the moment you click, so watch for what comes next. Common signs that a phishing attack worked:
| Sign | What it can mean |
|---|---|
| Password reset or sign-in alert emails you did not request | Someone has your password or is trying to take over the account |
| Multi-factor prompts you did not start | The attacker has your password and is trying to get past the second factor |
| Sent messages, new inbox rules or forwarding you did not set up | The mailbox is in someone else’s hands, often to watch for invoices |
| Contacts asking about odd emails or texts from you | Your account is being used to phish them |
| Payments or account changes you do not recognise | Card, bank or payroll details have been used or changed |
If you clicked a link, entered a password or opened an attachment, act straight away: report it to your IT team, change the password from a trusted device and anywhere you reused it, and ask IT to sign you out of all sessions and check your mailbox rules. Then forward the original email to [email protected]. Our guide to how to spot a phishing email sets out what to do in the first hour after a click, step by step.
How do I report phishing in the UK?
- Suspicious emails: forward them to the NCSC’s Suspicious Email Reporting Service at [email protected].
- Suspicious texts: forward them free to 7726.
- Money lost or accounts hacked: contact your bank immediately, then report it to Report Fraud (England, Wales and Northern Ireland) at reportfraud.police.uk or on 0300 123 2040, or to Police Scotland on 101. Report Fraud replaced Action Fraud in December 2025.
- At work: use your organisation’s report button or process. If personal data was exposed, your organisation must report the breach to the ICO within 72 hours of becoming aware of it, unless it is unlikely to put people at risk.
Why Sovereign Secure?
Sovereign Secure runs social engineering testing, including phishing simulation, alongside web, network, cloud and red team testing. We are a PCI SSC-approved QSA company and ISO 27001 certified, so simulation reports are written with PCI DSS and ISO 27001 evidence in mind.
To measure how your staff and email controls respond to a realistic attack, see our phishing simulation service, or browse the full cyber security glossary.
Your next step
- Phishing simulationRealistic email, QR code and vishing campaigns, reported by team rather than by name.See phishing simulation
- Social engineeringPhishing, phone and on-site pretext tests that show how your staff respond.See how we test
- Scope your testChoose your channels online to scope a phishing or social engineering test.Scope your test
Last reviewed October 2026 by the Sovereign Secure assessment team.
