How phishing works
A phishing message imitates a trusted sender, such as a bank, supplier, colleague or cloud service, and creates urgency. It asks the recipient to click a link to a fake login page, open a malicious attachment or approve a payment. Stolen credentials are then used to access accounts.
Variants include spear phishing, whaling aimed at executives, smishing by text and vishing by phone. Modern kits can relay logins in real time to capture session tokens, defeating basic multi-factor authentication. Attackers adapt wording to current events, so lures change quickly.
Why it matters for Canadian organizations
Phishing is a leading cause of account compromise and business email fraud in Canada. The Canadian Centre for Cyber Security and the Canadian Anti-Fraud Centre regularly warn about it, and a successful attack can lead to a reportable breach under PIPEDA or Law 25.
Small and mid-sized organizations are targeted as often as large ones, since attackers rely on volume. Staff awareness is therefore a core control, alongside technical protections that stop many messages before they arrive. Some campaigns target mobile devices, where link destinations are harder to inspect.
How to defend against it
Combine technology and training. Deploy email filtering with link and attachment sandboxing, enforce SPF, DKIM and DMARC, and use phishing-resistant multi-factor authentication. Make it easy for staff to report suspicious messages with one click.
Run regular awareness training and simulated phishing campaigns, and rehearse what to do after a click: reset credentials, revoke sessions and alert the security team. Fast reporting often limits damage far more than perfect prevention. Reward reporting rather than blaming people who click. Measure improvement through report rates, not only click rates.
Frequently asked questions
What is the difference between phishing and spear phishing?
Phishing is sent to many recipients using generic lures. Spear phishing targets a specific person or organization using personal details to look credible, making it harder to detect. Spear phishing is more convincing because of its research.
What should I do if I clicked a phishing link?
Disconnect if you entered credentials or opened a file, change the affected passwords from a clean device, tell your IT or security team immediately, and watch for unusual account activity. Speed matters. Acting immediately limits what an attacker can do with stolen access.
How can I recognize a phishing email?
Look for urgent requests, unexpected attachments, mismatched sender addresses or link destinations, poor wording and requests for credentials or payments. When unsure, verify through a separate trusted channel. If in doubt, contact the supposed sender through a known number or address.
Related service: Phishing simulation