Phishing and social engineering: how to recognise and defend against them

Phishing and social engineering attacks exploit trust, urgency and routine. They may look like a supplier invoice, a Microsoft 365 login page, a CEO request or a support message. The goal is usually to steal credentials, trigger a payment or install malware.

Common warning signs

Look for unexpected urgency, unusual sender addresses, links that do not match the claimed destination, spelling inconsistencies, unexpected attachments and requests to bypass normal procedures.

Social engineering beyond email

Attackers also use phone calls, messaging apps, fake support portals and deepfake-style impersonation. The channel changes, but the technique is the same: create pressure and reduce verification.

Simple defence: high-risk requests should always be verified through a second trusted channel, especially payments, credential resets and access changes.

Technical controls

Email security, DNS filtering, browser protection, attachment sandboxing and MFA reduce exposure. Reporting buttons and alert workflows help the security team react quickly.

Training that works

Short, regular exercises are more effective than annual lectures. Use real examples, explain the attacker logic and make reporting suspicious messages easy and safe.

HostCitadel