In short: Phishing is a message that imitates a trusted sender to get you to click a link, open an attachment or make a payment. You can spot it by its urgency, unusual requests, addresses that look similar but are different and links that don't go where they claim. In a business, simple rules work: confirm payment requests through another channel, use two-factor authentication and have a procedure for reporting straight away.
Phishing is the most common way into the online scams that target businesses. It takes no technical skill: it takes one person who trusts a message. Anyone who deals with lots of emails, orders and invoices is a natural target. Recognising the signs and having two or three fixed rules makes the difference.
What it looks like
- Fake supplier or courier: ‘your parcel cannot be delivered’, ‘unpaid invoice’, ‘update your payment details’.
- Fake bank or service: ‘suspicious sign-in to your account’, ‘confirm your identity’.
- Fake boss: a message that seems to come from the owner and asks a member of staff for an urgent bank transfer or to buy gift cards.
- Fake change of IBAN: a supplier ‘announces’ new bank details for future invoices.
- Fake security alert from Google, Microsoft or your hosting provider, with a link to ‘verify’ the account.
Signs that should stop you
- Urgency or threats. ‘Within the hour’, ‘account suspended’, ‘final notice’.
- Requests that are unusual for the way you work: a payment outside the normal procedure, a confidential ‘don't tell anyone’.
- A sender address that is similar but different. One letter changed, or a domain with a different extension. The display name can be fake: look at the real address.
- Links that don't go where they say. Hover over them and read the address at the bottom of the screen. On a phone, press and hold.
- Unexpected attachments, especially compressed archives and documents that ask you to ‘enable macros’.
- A tone or wording out of character for the real sender. Texts written with artificial intelligence are often flawless: the absence of mistakes proves nothing.
The rules that protect a business
Check through another channel
Every new payment request and every change of IBAN is confirmed with a phone call to a number you already had, never the one written in the message. This applies even if the message seems to come from the owner.
Two people for large payments
The person who sets up a payment and the person who approves it are different people. That way a single convincing message is not enough to move money.
Two-factor authentication everywhere
If a member of staff enters their password on a fake site, the second factor makes access much harder. A one-time code by SMS or app can be intercepted: passkeys and security keys resist even that. See passwords and two-factor authentication.
Domain authentication
SPF, DKIM and DMARC records make it harder to forge messages that appear to come from your domain. See SPF, DKIM and DMARC.
A procedure for reporting
An address or channel where anyone can forward a suspicious message. No blame for whoever reports it, or for whoever clicked and speaks up straight away: people who fear the consequences hide their mistakes.
If someone has clicked
- Don't enter anything. Close the page.
- If you entered details: change the password from another device and end any open sessions.
- Tell whoever manages your systems straight away.
- Check the mailbox: forwarding and deletion rules you didn't create.
- If you paid: call the bank at once to try to stop or recall the transfer and, in Italy, file a report with the Polizia Postale, the police unit for postal and online crime.
- If personal data is involved, the data controller assesses whether to notify the Garante, the Italian data protection authority: the GDPR sets 72 hours from becoming aware of the breach, except where it is unlikely to result in a risk to people.
Short, repeated training
In our experience, twenty minutes twice a year with real examples from the business is worth more than a long course taken once. Show genuine messages you have received and ask people to spot the signs. Repeat whenever a procedure changes.
Further reading: ransomware · backups · website care and maintenance
Frequently asked questions
What is phishing?
It is a scam in which a message, often an email, imitates a trusted sender such as a bank, a courier or a supplier to obtain passwords, data or payments.
What is the fake supplier scam?
A criminal hijacks or imitates a genuine exchange of messages and announces a new IBAN for invoices. The defence is to confirm every change of bank details with a phone call to a number you already know.
What should I do if I have clicked a suspicious link?
Don't enter any details. If you have entered them, change the password at once from another device and turn on two-factor authentication. Tell whoever manages your systems and check your email forwarding rules.
Where do you report online fraud in Italy?
To the Polizia Postale through its online police station (Commissariato di P.S. online) and, for cyber incidents, to CSIRT Italia, part of Italy's National Cybersecurity Agency (Agenzia per la cybersicurezza nazionale).