Phishing is the most widely used method of stealing personal data, and the least technical. It does not attack a computer system, it attacks a person: it relies on haste, on fear and on the trust we place in a familiar name. That is why it works just as well against an ordinary user and against a specialist having a busy day.
How it actually works
A phishing attack almost always has the same four elements. Recognising them is enough in most cases, with no technical knowledge required.
- A borrowed identity. The message appears to come from a bank, a courier, a public authority, an online shop or even a colleague. The sender name is trivial to fake; the actual address, less so.
- A reason to hurry. The account will be blocked, the parcel returned, the payment failed, the file expires today. Urgency has one purpose: to stop you checking.
- An action requested. A link to click, a file to open, a code to confirm, a form to fill in.
- A false destination. The page you land on looks identical to the real one, but the address in the browser bar is not.
Where it arrives
Email is still the main channel, but no longer the only one:
- SMS: messages about parcels, fines or deliveries, with a shortened link
- Phone calls: someone presenting themselves as a bank employee or an official, asking you to confirm details
- Messaging apps and social networks: including from compromised accounts of people you know
- QR codes: on posters, invoices or stickers placed over the original ones
How to check a message in thirty seconds
- Read the full sender address, not the display name. The difference is often a single letter.
- Do not click the link: hover over it on a computer, or long press on a phone, to see the real address.
- Ask yourself whether that institution has any reason to request this. A bank never asks for your password or for the code sent by SMS.
- If the message looks genuine, do not use its link. Open the app yourself or type the address you know into the browser.
- Verify through another channel. A call to the official number, not the one in the message, settles it in two minutes.
If you already clicked
What matters is speed, not blame. The recommended order:
- Change the password of the affected account immediately, and of any other account where you used the same one.
- Turn on two-step authentication wherever it was not already active.
- If you entered card details, call the bank and ask for the card to be blocked. Banks have lines open around the clock for exactly this.
- Check whether new forwarding rules appeared on your email, a step attackers take often and one that usually goes unnoticed.
- Keep the original message as evidence and report the incident to the national cybersecurity authority and to the institution whose name was used.
Why this matters for organisations
In a company, a single message opened can become the way into an entire network. For that reason both the NIS 2 Directive and national legislation treat staff training as a mandatory security measure rather than an optional activity. The requirements applicable to each sector are set out in the NIS 2 Directive series.
The video recording and the slide presentation below are in Romanian.