Phishing and the pressure tricks

How most attacks really start

When people imagine a cyber attack, they picture a genius hacker breaking through firewalls. In small and medium organisations, most attacks start far more simply: someone receives a message, believes it, and clicks, pays or shares a password. This course is about that moment, and how your whole team can handle it well.

What phishing is

Phishing is a message pretending to come from someone you trust, designed to make you do something harmful: open an attachment, click a link to a fake login page, send money or reveal information. It arrives by email, SMS, WhatsApp, social media and phone calls (sometimes called vishing).

The pressure tricks

Phishing works by pushing emotions that stop us thinking carefully:

1. Urgency. "Your account will be suspended in one hour." "Pay before 5pm or the shipment is cancelled."
2. Authority. The message claims to come from the MD, the bank, the tax authority or a regulator.
3. Fear. A threat of penalties, legal action or losing access.
4. Reward. A refund, a prize, a bonus, a job offer.
5. Curiosity. "See the photos from the party", "Salary review list attached".
6. Helpfulness. A colleague "urgently" needs a favour and cannot talk on the phone.

When a message pushes one of these buttons, slow down. That is exactly the moment to check.

The warning signs

• The sender's address does not match the organisation, or is slightly misspelled.
• A link's real address (seen by hovering, or long pressing on a phone) does not match the organisation's real website.
• An unexpected attachment, especially one that asks you to enable content or macros.
• A request to keep something secret or to skip the normal process.
• A request for passwords, one time codes or card details. No legitimate organisation asks for these by message.

The one rule

Verify through a separate channel you already trust. If the MD emails asking for an urgent transfer, call the MD on the number you already have. If the bank texts you, call the number on the back of your card. Never use contact details from the suspicious message itself.

Reporting

Every organisation should have one simple way to report a suspicious message, such as a Report Phishing button or a shared address. Reporting is never a nuisance. One report can protect the whole team.

What this means for you

You do not need technical knowledge to stop most attacks. You need to recognise pressure, pause, and verify. The rest of this module practises exactly that.