Phishing is a scam that impersonates a trusted person or service to steal credentials, money, or data or to deliver malware.
For an Australian SMB, one convincing message can expose a cloud account, redirect a supplier payment or compromise customer information.
This article explains how the attack works, how to spot it, and what to do after someone clicks.
What is Phishing?
Phishing is an attack that impersonates a trusted source to steal credentials, money or data, or to deliver malware.
Phishing is a form of social engineering delivered through email, text messages, phone calls, social platforms or QR codes. The attacker usually wants you to:
- Enter login credentials on a fake website;
- Share a password, MFA code, credit card number or sensitive information;
- Open a harmful file or install software; or
- Approve a payment or change bank details.
A phishing link sends you to an attacker-controlled page or download. Spam is usually unwanted bulk communication.
Phishing is designed to trigger an action the attacker can use. That action is what turns a convincing message into a compromise.
How Does a Phishing Attack Work?
A phishing attack works by making an unsafe request look like a normal part of your day, which is why most attacks follow five steps:
- Choose the target: The attacker selects a large audience or researches a person, supplier, project or payment cycle.
- Create the impersonation: They copy branding, register a lookalike domain, spoof sender details or use a compromised account.
- Add a reason to act: The message uses urgency, authority or routine, such as an overdue invoice or expiring password.
- Capture the action: A fake page collects credentials, an attachment runs malware, or the recipient approves a transfer or MFA prompt.
- Use the result: The attacker accesses accounts, intercepts invoices, steals data or sells the access to another criminal.
However, malware is optional in a phishing attack because stolen credentials can be enough to compromise an account.
A convincing fake login page captures those credentials by making a normal sign-in request look genuine.
Attackers create that opportunity through several channels: an email, text message or QR code can lead to the page, and a phone call can request the information directly.
Types of Phishing Attacks
The main phishing types differ by channel, target or source of trust, which is why the six forms below cover broad email campaigns, tailored attacks, executive targeting, copied messages, calls and texts, and QR codes.
Email Phishing
Email phishing sends deceptive emails to steal information, deliver malware or prompt a payment.
Common lures imitate banks, delivery services, Microsoft 365, payroll systems and shared-file platforms.
Spear Phishing
Spear phishing is a phishing attack tailored to a specific person, role or business.
Attackers research details such as names, suppliers, projects or meetings, then use them to make a harmful request look familiar and credible.
Whaling
Whaling is a spear-phishing attack that targets executives and other people with valuable access or payment authority.
Attackers either send tailored messages to senior leaders or impersonate them when asking assistants, finance staff or project teams to act.
Clone Phishing
Clone phishing is a phishing attack that copies a legitimate message and replaces its link or attachment with a malicious one.
The attacker relies on the original invoice, email or shared file being familiar enough that the “updated” version does not prompt a fresh check.
Smishing and Vishing
Smishing is phishing by text message, and vishing is phishing by phone or voice call.
Attackers use a short message or conversation to pressure the recipient into paying a fee, sharing an MFA code, allowing remote access or making an urgent payment.
QR Code Phishing
QR code phishing, also called quishing, is a phishing attack that hides a malicious link inside a scannable code.
Scanning the code moves the user to a phone, where the full web address can be harder to inspect before they open a fake site or share information.
As you see, the channel changes and varies. Therefore, across every type, the same check applies: confirm who sent it, where it leads and what it asks you to do.
How to Recognise a Phishing Message
You can recognise a phishing message by checking whether the sender, link and requested action align with what you’d normally expect, or by using these checks:
| Check | Warning sign | Safe response |
|---|---|---|
| Context | You did not request the reset, invoice, shared file or delivery update. | Open the known app or portal directly. |
| Sender | The display name looks right, but the address, reply-to field or domain differs. | Compare it with a previous verified message. |
| Link or QR code | It hides the destination, uses a shortened link or opens an unfamiliar login page. | Type the official address or use a saved bookmark. |
| Sensitive request | The message asks for credentials, an MFA code, card details, files or new bank details. | Verify through a separate, trusted channel. |
| Pressure | The sender demands speed, secrecy or an exception to the normal process. | Pause and follow the approved process. |
| Attachment | The file is unexpected or asks you to enable content, install software or sign in. | Confirm it with the sender using known contact details. |
| Account prompt | You receive an MFA request or security alert for an action you did not start. | Deny it, report it and review the account directly. |
| Payment change | A supplier or executive changes payment instructions by message. | Call a previously verified number before paying. |
Use the checks in the table together, because a compromised account can make a phishing message look genuine.
Also, confirm whether the request makes sense, verify the sender through a trusted channel, and inspect where any link, attachment or payment instruction leads before you act.
Examples of Phishing Messages seen in Australia
The table below shows short excerpts from phishing messages reported to Scamwatch in Australia, including delivery, account and payment lures.
We’ve removed unsafe links and phone numbers so you can focus on the lure and what it’s trying to get you to do.
| Published message excerpt | Scamwatch example | What to do instead |
|---|---|---|
| “Someone uploaded your pictures. A whole album is uploaded.” | Flubot photo-upload SMS (2021) | Do not tap the link or install a suggested “security update”. Check the relevant photo service or device directly. |
| “Your DHL order ID1842225 will arrive soon. Track progress here.” | Flubot delivery SMS (2021) | Check the delivery only through the courier’s official website or app. |
| “A shipment from order #2020 is on the way.” | Fake PayPal invoice email (2026) | Open PayPal directly and check the account activity there. |
| “A payment authorization request was recently flagged by our monitoring system due to unusual login activity.” | Fake PayPal purchase text (2026) | Do not call a number in the message. Find support through the official website or app. |
These messages show why a familiar brand, delivery notice or payment alert cannot be trusted on appearance alone. If someone clicks or responds, the next few actions determine how far the damage spreads.
What to do if You Have Clicked a Phishing Link
If you have clicked a phishing link, act straight away:
- Report the click immediately: Close the page and do not enter anything else. Tell your IT or security contact when it happened, which device you used and what you did. Keep the original message so they can investigate it.
- Secure any account where you entered a password or approved MFA: From a trusted device, open the official service, change the password and revoke active sessions. Reset any other account that reused the password, using a unique strong password for each one rather than a variation of the old one. Review MFA methods, devices and recovery details for anything unfamiliar.
- Isolate the device if you opened or installed a file: Disconnect it from Wi-Fi and Ethernet straight away. Do not wipe the device until your security team decides whether it needs evidence for the investigation.
- Contact your bank if money, card details or bank details were involved: Call the financial institution using a verified phone number and ask it to stop or recall the transaction. Do not use a number in the suspicious message.
- Record any personal or business information you shared: Note what was disclosed, which account or system it came from and who may be affected. Your team can then begin its incident and privacy assessment.
- Help your security team contain the wider impact: They should check sign-in records, mailbox forwarding rules, inbox rules, connected applications and data access. Report relevant incidents through ReportCyber and scams through Scamwatch.
How to Prevent Phishing
Prevent phishing with five controls that stop different parts of the attack:
- MFA to protects accounts
- Email security filters messages
- Password managers expose fake domains
- Training to improve staff decisions
- Payment checks to block invoice fraud.
Multi-factor Authentication
Multi-factor authentication reduces the chance that a stolen password becomes an account takeover.
Apply it to email, cloud applications, remote access and administrator accounts, then prefer phishing-resistant options such as FIDO2 security keys and passkeys where supported.
This follows a Zero Trust approach: verify each access request instead of trusting a password alone. Email controls work earlier in the attack by reducing how many lures reach staff.
Email Filtering and Domain Authentication
Email filtering and domain authentication reduce malicious messages, harmful files and sender impersonation before they reach staff.
Configure link and attachment scanning, impersonation detection and quarantine rules. For your business domain, implement:
- SPF to identify authorised sending servers;
- DKIM to add a signature that recipients can validate; and
- DMARC to check alignment, set a handling policy and provide monitoring reports.
These controls make direct spoofing harder, but they cannot stop every lookalike domain or compromised account.
When a message gets through, a password manager provides another check at the login page.
Password Managers
Password managers reduce password reuse and give staff another warning when a login page is fake. Use your password manager to create a unique credential for each service.
If the manager doesn’t offer the saved login, check the domain before entering anything manually.
That check protects login credentials; requests for money or sensitive information still rely on staff judgement and process.
Staff Awareness Training
Staff awareness training helps your team recognise, verify and report the phishing requests they face at work.
Training helps your staff pause and verify; payment controls make sure one rushed decision can’t release funds on its own.
To turn that awareness into real‑world action, build the program around practical steps:
- Teach by role: Give finance teams invoice scenarios, administrators fake login prompts, and leaders impersonation attempts.
- Practise through the year: Use short refreshers and controlled simulations instead of relying on one annual module.
- Measure useful behaviour: Track reporting rate, time to report, repeat actions and real incident trends alongside click rate.
Build security awareness training around early, blame‑free reporting. A fast report gives your security team time to contain the account or device.
Payment Verification Processes
Payment verification processes stop a phishing email from changing where your business sends money.
So, consider to use a written process that requires your team to:
- Call a verified number: Call a supplier on a previously confirmed number before accepting new bank details.
- Use a second approver: Use a second approver for new payees, detail changes and higher‑value transfers.
- Separate duties: Separate the person changing payment details from the person releasing funds.
- Record the steps: Record the request, callback and approval.
Urgency and seniority should never override the check. ASD’s ACSC recommends callbacks and approval processes in its business email compromise prevention guidance.
Together, these controls cover the main paths from a phishing message to account compromise, malware and financial loss.
Why Phishing is a Business risk, Not Just an Email Problem
Phishing is a business risk because one deceptive message can lead to account takeover, payment fraud, ransomware or a data breach.
To illustrate, ASD’s Annual Cyber Threat Report 2024–25 recorded phishing in 60% of incidents reported to ASD’s ACSC.
Also, email compromise without financial loss accounted for 19% of self-reported business cybercrime threats, while BEC fraud with financial loss accounted for 15%.
The four outcomes below show where your business needs controls and response ownership.
Credential Theft and Account Takeover
Credential theft gives an attacker access to email, cloud services, customer systems or remote-work tools.
They can reset other passwords, read conversations, create forwarding rules and send trusted-looking messages, turning the phish into a wider cyberattack.
Once email access is established, the attacker can use that trust to target payments as well as more accounts.
Business Email Compromise and Invoice Redirection
Business email compromise uses a real or impersonated account to redirect a payment or extract information.
ASD recorded almost AU$84 million in self-reported BEC losses in FY2023–24, with an average loss above AU$55,000 for each confirmed incident.
This is why, always treat every change to bank details, payee information or transfer instructions as a new request.
Because, a callback and second approval can help your staff to pause, verify, and stop a convincing email from becoming a financial loss.
Ransomware Deployment
Stolen access can also lead to ransomware, either by delivering malware directly or giving another attacker a foothold.
Reduce that risk with patching, application control, endpoint detection, restricted privileges, logging and tested backups.
Data Breaches and Notification Obligations
Under Australia’s Notifiable Data Breaches scheme, an organisation covered by the Privacy Act must notify affected individuals and the OAIC when a phishing incident becomes an eligible data breach likely to result in serious harm.
To work out whether the incident meets that threshold, assess:
- Personal information involved: Identify what personal information the affected account or system could access.
- Attacker activity: Check whether the attacker viewed, copied, sent or otherwise accessed that information.
- Affected individuals: Identify whose information may be involved.
- Likely serious harm: Assess whether remedial action has prevented the likely risk of serious harm.
A phishing click alone does not meet this threshold. Notification is required when there has been unauthorised access to, disclosure of or loss of personal information, serious harm is likely, and remedial action has not removed that risk.
The OAIC’s Notifiable Data Breaches guidance explains the assessment process. The OAIC received 1,205 data‑breach notifications in 2025, the highest annual total since the scheme began.
What Compliance Frameworks and Cyber Insurers Expect on Phishing
Compliance frameworks, like the Essential Eight and SMB1001, expect proof that phishing controls work across your organisation, while cyber insurers look for similar proof when they assess your risk.
The Essential Eight reduces the damage after a phishing message succeeds because it focuses on technical controls.
Although phishing awareness training is not one of its eight strategies, controls such as MFA, application control and backups can limit account takeover, malware execution and recovery failure.
Because a maturity assessment tests whether those controls are implemented, keep settings and assessment records for the systems in scope. They show that the protections you rely on are in place.
SMB1001 uses that evidence for a different purpose. Because it is a tiered certification standard, your target tier sets the controls and records you need to demonstrate.
Keep evidence of MFA and email authentication. Add records for staff training, payment verification and incident reporting where they apply to your tier.
This gives customers and partners a recognised way to assess your cyber controls during onboarding or supplier qualification.
Cyber insurance considers the same controls through an underwriting lens.
When an insurer reviews your application, it may ask how your team enforces MFA, scans email, verifies payment changes, backs up data and responds to an incident.
Your answers need to match live controls, so keep screenshots of settings, training records and test results. Also note who is responsible for each control.
Although the purpose changes across these conversations, the evidence question stays the same: what control runs, who owns it and when was it last tested?
A current evidence pack helps your team respond to tenders, customer reviews and insurance renewals without a last-minute scramble.
If a lean team can’t keep records current, managed security support can take on the work.
Reduce Your Phishing Risk with RedScale
As you’d expect, phishing can delay tenders and client reviews when staff can’t recognise and report suspicious requests.
It can also divert invoice payments to fraudsters when fake supplier emails reach the finance team.
That risk grows when training becomes a yearly tick‑box exercise. One missed payment change or compromised mailbox can force an evidence rebuild under pressure.
Redscale’s cybersecurity awareness training service turns that gap into practical staff habits. Your team learns to recognise role‑specific phishing and report it before it becomes a payment or access issue.
Our managed security services also support your wider defence whenever you need ongoing control ownership and monitoring.
Book a free discussion with Redscale’s expert team and strengthen your phishing defences today.
