Phishing

What phishing means in practice

The version that costs small businesses real money is rarely the obvious one. It is an email that appears to come from a supplier, quoting a genuine invoice number, asking for bank details to be updated. Frequently it comes from the supplier's actual mailbox, because that mailbox was compromised first.

Technology helps but does not solve it, because the message is asking a person to do something they are authorised to do. The controls that work are procedural: verify any change of bank details by ringing a number you already held, never one from the email, and make it normal for staff to check without feeling foolish. A business where people are embarrassed to ask is a business that pays the invoice.