How phishing works

Phishing is one of the oldest tricks on the internet, and still one of the most successful. It's behind a large share of business email compromise, stolen passwords and ransomware attacks in Australia. The reason is simple: it targets people, not technology.

Pretending to be someone you trust

A phishing message pretends to come from someone you'd normally trust: your bank, a supplier, the ATO, Microsoft, Australia Post, even your own boss. Logos, signatures and formatting are easy to copy, so it can look completely genuine.

Creating urgency

Then it pushes you to act fast.

• "Your account will be closed today."
• "This invoice is overdue."
• "I need this done in the next hour."

Urgency is the point. When you're rushed, you're less likely to stop and check.

Asking for one thing

Almost every phishing message wants you to do one of three things.

• Click a link
• Open an attachment
• Enter your password

That link usually leads to a fake login page that looks exactly like the real Microsoft 365, Google or bank page. Type your details and they go straight to the attacker, who can then read your email, send invoices from your account or move deeper into your systems.

How to spot it

The best defence is to slow down. Before you click:

• Check the sender's real address, not just the display name. "Microsoft Support" from a random Gmail address isn't Microsoft.
• Hover over links to see where they really go before clicking.
• Be wary of unexpected attachments, especially invoices, zip files or "shared documents".
• Watch for changed bank details. A supplier emailing new account details is a classic scam.
• If something feels off, contact the person another way: call a number you already have, not one in the email.

Technology helps too

People shouldn't be the only line of defence. Good email filtering stops many phishing messages before they ever reach an inbox. Multi-factor authentication (MFA) means a stolen password alone isn't enough to get in. And regular, short security awareness training helps your team catch the ones that slip through.

The bottom line

Phishing works because it's convincing and it's fast. Pausing for ten seconds to check the sender and the link stops most of it. Combine that habit with good filtering and MFA, and you've closed one of the biggest doors attackers use.

Want to test your setup? Check out our useful free tools at nexcentric.com.au/tools, or ask Nexcentric about email security and phishing training for your team.