Phishing attacks remain one of the biggest threats in the digital world — affecting both individual users and businesses. These attacks use social engineering tricks to deceive victims into clicking on malicious links, sharing sensitive information, or installing harmful software.

Why is phishing so common? It’s technically easy to carry out, can reach a wide audience with minimal investment, is difficult to detect, and, unfortunately, often effective. But not all phishing attacks are the same. Some are sent in bulk, while others are carefully planned and personalised to target a specific person or organisation.

In this edition, we explain the difference between phishing and spear phishing, and share quick tips to help you recognise and avoid these threats.

What is Phishing?

Phishing is a type of attack where someone tries to trick you into clicking on a malicious link, opening an infected file, or providing sensitive data — such as passwords or banking details. These messages typically arrive via:

• E-mail: the most common method.
• SMS (smishing): containing disguised links.
• Phone calls (vishing): where the attacker attempts to gather information by voice.
• Social media or messaging apps: with hidden links or attachments.

These attacks are often sent in bulk with generic messages — frequently featuring spelling mistakes or unnatural language.

And What is Spear Phishing?

spear phishing is more sophisticated: instead of targeting random individuals, the attacker selects a specific target and prepares a personalised message, based on real information (such as your company’s name, job title or colleagues).

The goal? To gain your trust and trick you into taking a harmful action — like authorising a payment, installing malware or providing login credentials.

How to Protect Yourself: 8 QUICK TIPS

• Check the sender: A familiar name doesn’t mean the email is safe.
• Hover over links: Always confirm the destination before clicking.
• Be wary of urgency: “Urgent” is a common tactic to pressure you.
• Never share sensitive data via email or SMS.
• Be cautious with unexpected attachments, even from colleagues.
• Look out for spelling mistakes or unusual language.
• Enable multi-factor authentication (MFA).
• When in doubt, don’t click — confirm with the sender.

In Summary: Vigilance is Your Best Defence

Whether it’s a generic phishing attack or a highly personalised spear phishing attempt, the goal is always the same: to deceive and exploit. Staying informed, alert to warning signs, and following good practices day to day can make all the difference.

When in doubt, don’t click, don’t reply — and report it.

Your awareness protects not just your own data, but also the security of your entire organisation.