Phishing is an attack that arrives as a message — usually an email — pretending to be from someone you trust, and tries to make you click a bad link, hand over a password or pay a fake invoice. It is called phishing because the attacker dangles a lure and waits: most messages go nowhere, but one bite is all they need. It remains the most common way into a business — Verizon's 2026 Data Breach Investigations Report found 62% of breaches involve a human element, and IBM's 2026 Cost of a Data Breach Report ranked phishing the most common initial attack vector for the fourth year running.
TL;DR
- Phishing is a trust attack delivered by message — email, text (smishing), voice call (vishing) or QR code — not a technical exploit.
- The human element is behind 62% of breaches (Verizon 2026 DBIR), which is why filters alone never finish the job.
- In Australia, phishing or social engineering featured in 60% of incidents reported to the ASD's ACSC in FY2024-25.
- The practical defence is a loop: filters reduce volume, short monthly training builds reflexes, simulations rehearse them, reporting measures the trend.
What is phishing?
Phishing is a social-engineering attack: instead of breaking software, the attacker persuades a person. A message imitates a sender the target already deals with — a supplier, the IT help desk, a government agency, the CEO — and manufactures a reason to act. The action requested is always one of a few things:
- Click. A link opens a fake login page that captures your email password or MFA code.
- Open. An attachment installs malware, often ransomware or a spyware loader.
- Pay. An invoice or urgent request redirects money to the attacker — the business email compromise pattern.
- Reply. Sensitive information, staff lists or one-time codes are handed straight back.
The variants are the same attack by different channels: phishing by email, smishing by text message, vishing by phone call, and quishing by QR code. The psychology — urgency, authority, trust — is shared across all of them.
How a phishing attack actually works
- Target selection. Most phishing is broad and cheap — thousands of inboxes, one lure. A small slice is targeted (spear phishing), written after researching your people on LinkedIn or your site.
- The lure. The message borrows a trusted identity and creates pressure: an invoice due today, a package waiting, an account about to be locked, a shared document.
- The capture. The link lands on a clone of a real sign-in page, or the attachment drops malware. Credential data flows to the attacker in real time.
- The follow-through. Stolen credentials give access to the real mailbox; the mailbox enables invoice fraud, payroll diversion or data theft. The email you clicked was the entry door, not the crime itself.
Why phishing still works in 2026
- The lure quality has improved. Generative AI removed the broken English and odd formatting that used to give scams away. Messages now arrive in polished, local-sounding prose with correct branding.
- The volume asymmetry. An attacker sends millions of messages at almost no cost; a business only has to fail once. Gmail blocks more than 99.9% of spam and phishing, yet the residual is precisely the expensive, tailored kind.
- The trust chain. Attackers compromise a real supplier's mailbox and continue a real email thread. Nothing about the message looks fake, because it comes from a genuine account.
That is why no tool ends the problem. Technical email security shrinks what arrives; what gets through is decided by the person reading it.
The Australian numbers
For Australian businesses, the risk is well documented:
- $56,571 — the average self-reported cost of cybercrime per report for small business in 2024-25, up 14% year on year (ASD Annual Cyber Threat Report 2024-25).
- $80,850 — the average across all business sizes, a 50% rise in twelve months.
- $166.8 million — what Australians reported losing to payment redirection scams in 2025, up 9.3% (Scamwatch).
- 15% — of business cybercrime reports to ASD in 2024-25 were BEC fraud with a financial loss.
A single convincing email asking to 'update these bank details' can sit at the centre of a six-figure loss — and the control that stops it costs a phone call.
How to spot a phishing email
The tells that still work, even against AI-written lures:
- The sender check. Read the actual address, not the display name. Lookalike domains — an extra letter, a swapped character — fail a three-second look.
- Urgency plus consequence. Real deadlines rarely arrive by email, and real organisations do not threaten account closure within hours.
- A link that does not match. Hover before tapping: the preview address should match the brand exactly.
- An unexpected request. Invoices you were not expecting, documents you were not sent, MFA prompts you did not trigger. Unexpected is the operative word — treat it as hostile until verified.
- Breaks the process. Payment details changed, a payment skipping the usual approvals, a request to keep it quiet. Process exists for exactly this moment.
What to do if you clicked
Speed beats embarrassment. If credentials were entered: change the password, revoke active sessions, alert IT. If payment went out: call the bank immediately and ask for a recall, then report through ReportCyber. If personal information may have been exposed, Privacy Act-covered organisations must assess the incident within 30 days under the Notifiable Data Breaches scheme — the OAIC's notifiable data breaches guidance sets out when notification is required.
The culture point matters as much as the steps: in a no-blame environment, people report the click within minutes; in a fearful one, they hide it until the damage is done.
How to actually reduce phishing risk
Filtering alone leaves the human layer open — the breach data above says so. The programmes that measurably reduce click rates run the same loop:
- Short monthly training on the scams currently circulating, not one annual course. Cyber Aware's awareness training runs 120+ story-driven modules on a monthly auto-add cadence.
- Realistic phishing simulations that rehearse recognition with the invoice, MFA-prompt and document-share lures actually in use — 100+ templates, with anyone who clicks auto-enrolled in a short remediation course the same week. Teams that run the loop see an average 80% reduction in clicked links by month eight.
- Measurement that drives action. Human risk reporting turns click rates, report rates and repeat clickers into a monthly, per-person picture, so the two riskiest inboxes get help before a real attack finds them.
For businesses unsure where their weakest layer is, a security gap assessment identifies whether the next dollar belongs in tooling, training or process. And for teams comparing platforms before committing, the 2026 comparison puts the major options side by side.
FAQ
What is phishing in simple terms? A scam message that pretends to be someone you trust to steal money, passwords or data. The word comes from 'fishing' — attackers cast a lure into many inboxes and wait for a bite.
What is the difference between phishing, smishing and vishing? Only the channel: phishing arrives by email, smishing by text message and vishing by phone call. The tricks — urgency, authority, trusted branding — are identical.
How common is phishing? It is the most frequently reported cybercrime category in Australia — the ASD's ACSC recorded phishing or social engineering in 60% of reported incidents in FY2024-25 — and IBM's 2026 report ranked it the top initial attack vector for the fourth straight year.
Can email filters stop phishing? They stop the bulk. But BEC emails, spear phishing and credential-harvest pages are built to carry no detectable malware, so some always arrive. Training and verification process handle what filters miss.
What should I do if I clicked a phishing link? Change the affected password, revoke sessions, alert IT, and contact your bank if any payment was involved. Then report it — internally and to Scamwatch or ReportCyber — so others are warned.
One last thing
Phishing is not primarily a technology problem, so it does not have a purely technical fix. Filters, training, simulations and reporting each shrink the target — and the organisations that run all four monthly are the ones the statistics show winning.