What is phishing?

Phishing in plain English

The term phishing is a play on the word “fishing”: the scammers cast out bait and wait to see who bites. The bait is a message that looks genuine – such as a shipping confirmation from a parcel service, a security alert from your bank, a request to renew an expired password, or an urgent request from senior management.

You can think of phishing as a con artist at your front door posing as a technician from the local utility company. He seems friendly, shows an ID, and is in a hurry. Anyone who believes him lets him in. Phishing works the same way, only digitally – and the scammers knock on a great many doors at once.

Phishing is a form of social engineering. The attacks don’t target technical vulnerabilities but human traits such as helpfulness, curiosity, or respect for authority. Our Security Awareness & Phishing Simulation page shows how you can prepare your team specifically for this.

How phishing works

Most phishing attacks follow the same pattern:

1. Prepare the bait: The scammers choose a believable topic and a well-known sender. Logos, signatures, and sender names are easy to fake.
2. Build pressure: The message creates time pressure or worry – “Your account will be locked today” or “The payment has to go out by noon.” People under pressure check less carefully.
3. Prompt action: A link leads to a deceptively real login page, an attachment contains malware, or the message asks for a bank transfer or a callback.
4. Cash in: With stolen credentials, the scammers sign in to email accounts or cloud services. From there, they send more phishing emails, read confidential data, or download more malware – often the first step toward a ransomware attack.

There are many variants. In spear phishing, the message is tailored to a specific person, often using details from social networks or the company website. In CEO fraud, scammers pose as senior management and demand an urgent bank transfer. If the scam runs via text message or messenger apps, it’s called smishing; over the phone, it’s vishing; and with manipulated QR codes, it’s quishing.

Modern phishing sites can even intercept the one-time codes of multi-factor authentication – that is, signing in with a password plus a second factor, such as a code on your smartphone. To do this, they secretly place themselves between the victim and the real login page. That’s why passkeys and security keys based on the FIDO2 standard are considered particularly secure: they are bound to the genuine website and won’t work on a fake one.

A practical example

A fictional but typical scenario: On a Friday afternoon, an email arrives in the accounting department of a wholesaler – apparently from a long-standing supplier. The supplier says it has switched banks and asks for the outstanding invoice to be paid into the new account. The email looks genuine: the right contact person, the correct letterhead, a reference to an actual order. The reason: the scammers had previously taken over the supplier’s mailbox through phishing and had been reading along for weeks.

The employee in charge becomes suspicious because the new bank account is abroad. She calls the supplier – using the number from her company’s own records, not the one in the email. The scam is exposed before any money changes hands. This exact behavior – pause, verify through a second channel, report – is what phishing simulations train.

Why does this matter for businesses?

For years, phishing has been one of the most common ways attackers get into organizations. The consequences range from hijacked accounts and payment fraud to encrypted systems. If personal data falls into the wrong hands, a reporting obligation may arise: under Art. 33 GDPR, the data protection supervisory authority must then be notified without undue delay and, where feasible, within 72 hours.

Technical filters catch many phishing emails, but never all of them. That’s why it comes down to people who recognize and report suspicious messages. Lawmakers see it the same way: the European NIS2 Directive explicitly lists cybersecurity training as part of risk management and requires the management bodies of covered companies to take part in training themselves.

How to protect your organization

• Train and practice regularly: Short, recurring training sessions and realistic phishing simulations make the right response a habit.
• Foster a reporting culture: Set up a simple reporting channel. Anyone who has clicked on a link should be able to report it right away – without fear of consequences.
• Secure sign-ins: Protect email, cloud services, and remote access with multi-factor authentication – using phishing-resistant methods wherever possible.
• Verify payments: Always confirm changed bank details and urgent payment instructions by phone, using a known number. For larger amounts, the four-eyes principle (two-person approval) helps.
• Set up email protection: Spam and malware filters, along with the SPF, DKIM, and DMARC standards, make it harder for scammers to spoof your sender addresses.
• Know the warning signs: Time pressure, unusual requests, small deviations in the sender address, and links whose destination doesn’t match the supposed sender are typical red flags. Hover over a link before you click, and sign in to important services only via saved bookmarks.

How Rootsektor can help

With Security Awareness & Phishing Simulation, we train your team in a hands-on way: with realistic campaigns, training on-site or online, and an anonymized evaluation that doesn’t single anyone out. Our Social Engineering & Physical Testing shows whether a determined attacker could actually reach their goal via email, phone, or the reception desk. If someone has already entered credentials on a fake page or opened a malicious attachment, our Incident Response & Forensics team helps you contain and investigate the incident. In an acute incident, you can reach us at +49 2932 465265-0 – outside business hours (Mon–Fri, 8:00 a.m.–5:00 p.m. CET/CEST), the same number is our 24/7 emergency hotline.