Phishing

It targets the person rather than the system, which is why it survives every improvement in software security. There is no patch for a convincing email.

The mechanics are usually simple: a message that appears to come from a bank, a colleague or a supplier, a reason to act quickly, and a link to a page that looks like the real login. The credentials go straight to the attacker, and often into the real site immediately afterwards, so the victim sees a successful login and notices nothing.

The version that actually works

Mass phishing is mostly filtered now. The attacks that succeed against organisations are targeted, and they are targeted with material that is public.

Spear phishing aims at one person using details about them — their manager’s name from LinkedIn, a conference they attended, a project mentioned in a press release. Business email compromise goes further: the attacker reads a real mailbox first, learns how the finance team talks, then joins an existing payment thread with new bank details. Nothing about that message looks wrong, because almost all of it is right.

What actually helps

Phishing-resistant multi-factor authentication. Codes from an app can be relayed by an attacker in real time — the fake page asks for the code and passes it on. Hardware keys and passkeys cannot be relayed, because they check the site’s real address before responding. That distinction is the single largest improvement available.

A process for payment changes that never depends on email. If bank details can be changed by a convincing message, they will eventually be changed by one.

A culture where reporting is cheap. Most people who fall for a phish realise within minutes. Whether they say so depends entirely on what they expect to happen to them, and an hour of silence is the difference between an incident and a breach.

Training people to spot bad grammar is largely obsolete advice. The messages are well written now.