What is phishing, and how do you stop it hurting your business?

Why is phishing still the biggest threat?

Because it works and it's cheap. The government's 2026 breaches survey found phishing behind 38% of businesses' breaches or attacks, and 18% of businesses were victims of a phishing-related cyber crime. Only 19% of businesses trained their staff on cyber security in the same year (DSIT, 2026).

Phishing has also got better. AI tools write fluent, well-formatted emails in any tone, so the old advice to look for spelling mistakes doesn't hold up. Attackers study LinkedIn, company websites and Companies House to learn who approves payments, who the suppliers are and when the finance director is on holiday. The question isn't whether a convincing email reaches your team, but what happens next.

What are the main types of phishing?

What does a convincing phishing attack look like?

Illustrative example (fictional). A finance administrator at a 40-person building services firm receives an email at 4.40pm on a Thursday. It's from a real supplier's email address, because the supplier's mailbox was compromised three weeks earlier. It replies inside a genuine email thread about an outstanding invoice. The message says the supplier has moved bank, attaches a letter on the supplier's letterhead with new account details, and asks for the £18,600 payment to go to the new account before their month-end close.

Everything looks right. The sender is genuine, the thread is genuine and the invoice is genuine. Only two things are off: the request to change bank details, and the time pressure. That's the pattern to train for. Our administrator follows the firm's rule, rings the supplier on the number held on file (not the one in the letter), and learns the supplier hasn't changed bank. The payment is stopped, and the supplier finds out its mailbox has been compromised.

Without the call-back rule, the money would probably be gone. Banks can reimburse some fraud losses, but businesses shouldn't rely on it.

How big a problem is invoice and payment fraud?

UK Finance recorded £41.3 million lost to invoice and mandate scams in 2025, across 2,305 cases, an average of almost £18,000 a case. CEO fraud cost a further £5.6 million. Businesses lost £75.6 million in total to authorised push payment fraud (UK Finance, 2026). These figures only include losses reported through banks, so the real total is higher.

Sectors that make large, regular payments to many suppliers are the obvious targets. The NCSC has singled out construction, where high-value stage payments and busy site teams make payment diversion attractive. Charities are targeted too, often through impersonated trustees or grant funders.

The controls that stop it are procedural as much as technical. Any change of bank details is confirmed by phone on a number you already hold. New payees need a second person to approve. Nobody, including the managing director, is allowed to bypass the process by email. And staff are told, in writing, that they'll never be blamed for delaying a payment to check it.

What staff training actually works?

This is the part of the old "three steps to keep your staff cyber secure" article that still holds, with some lessons learned since.

Simulated phishing, regularly and without shaming. Send realistic, harmless test emails every month or two. Use the results to target short follow-up training, not to name and shame. People who fear blame stop reporting.

Short, frequent training beats an annual marathon. Five-minute modules every month, tied to what's happening now (tax season, parcel scams at Christmas, payroll changes), stick better than a yearly hour-long course. An occasional lunch-and-learn helps because people can ask questions.

A clear, one-page policy. Everyone should know three things: how to report a suspicious message, how to check a payment request, and what to do if they've clicked. Make sure new starters read it in week one.

Measure the report rate, not just the click rate. A team where 60% of people report a test email within an hour is safer than one where few click but nobody reports, because real attacks are caught while they're still happening.

How do you report phishing in the UK?

Inside the business, staff should use the "Report" button in Outlook or your email security tool, so IT can pull the same email from every other mailbox. Outside the business:

• Suspicious emails: forward to the NCSC at report@phishing.gov.uk. The NCSC reviews reports and takes down scam websites.
• Suspicious texts: forward free to 7726 (it spells "SPAM" on a keypad).
• If you've lost money in Scotland: contact your bank first, then Police Scotland on 101. Scottish organisations with fewer than 20 staff can also call the Cyber and Fraud Centre – Scotland's incident response helpline free on 0800 1670 623 (weekdays 9am–5pm).
• If you've lost money in England, Wales or Northern Ireland: contact your bank, then Report Fraud on 0300 123 2040.

If someone has entered a password on a fake page, change it from a clean device straight away, sign that user out of all sessions, and check their mailbox for new forwarding rules, a common way attackers keep watching after the password changes.

Which technical controls stop phishing?

No filter catches everything, so you need several layers. Email security that scans links and attachments and flags lookalike senders. Email authentication (SPF, DKIM and DMARC) on your own domain, so criminals can't easily send email pretending to be you. Multi-factor authentication, or better still phishing-resistant passkeys, so a stolen password isn't enough; see our guide to passwords, MFA and passkeys. Endpoint detection and response, protection on every device that stops viruses and ransomware if an attachment does get opened. And Microsoft 365 alerts for new mailbox forwarding rules and sign-ins from unusual places.

How Indigo does this. Every Indigo Unified Communications managed IT client gets INKY email security, part of the Kaseya 365 stack, which scans each email and adds warning banners to suspicious ones. We enforce multi-factor authentication for every user, and our Gold and Platinum packages add security awareness training, simulated phishing and dark web monitoring for stolen staff logins. Platinum adds a dedicated security team watching your systems 24/7 (a security operations centre, RocketCyber). Our Glasgow service desk's average first response was 13 minutes in September 2026, so a "have I clicked something bad?" call gets a fast answer. Cyber security →

What to do next

1. Write the payment rule down: every bank detail change is confirmed by phone on a number you already hold, and new payees need two approvers.
2. Check MFA is on for every user on email, finance and remote access systems.
3. Add a report button to Outlook and tell staff it's always right to use it.
4. Start a simulated phishing programme with short follow-up training, and track the report rate.
5. Check your domain's DMARC record so criminals can't easily spoof your own email address.