Fake login pages
Credential phishing
An email that looks like Microsoft 365, Google, your bank or a delivery company leads to a copy of a real sign-in page. Whatever you type goes straight to the attacker.
Signals
- Sender domain with a small typo or extra word
- Urgency: expiring passwords, locked accounts
- A link that doesn't match the brand's real domain
The habit that beats it
Never sign in from a link in an email. Open the app or type the address yourself. Use a password manager: it won't autofill on a fake domain.
EXAMPLE · EMAILYour mailbox is 98% full. Messages will be rejected after 18:00. Upgrade storage: outlook-storage-upgrade.example
Business email compromise (BEC)
CEO fraud
Someone pretends to be your CEO, director or a senior partner and asks for an urgent payment, gift cards or sensitive data. Often no link or attachment at all, so filters miss it.
Signals
- Unusual request from someone senior
- Secrecy and urgency (“I'm in a meeting”, “keep it between us”)
- Personal email address or a reply-to that differs from the sender
The habit that beats it
Agree on a rule: any payment or data request by email is verified by phone or in person, using a known number. No exceptions for seniority.
EXAMPLE · EMAILI need you to handle a confidential acquisition payment today. Our lawyer will contact you. Don't discuss this with anyone yet.
Supplier impersonation
Invoice & payment diversion
A real or lookalike supplier announces new bank details. Sometimes the supplier's own mailbox has been hacked, so the email looks completely genuine and continues a real thread.
Signals
- Any change of IBAN or bank details
- Pressure to pay before the usual date
- Slightly different domain (e.g. .co instead of .com)
The habit that beats it
Verify every bank-detail change with a phone call to a number from your records, not from the email. Require two people to approve new payees.
EXAMPLE · EMAILDue to an audit, our previous account is temporarily frozen. Please send this month's payment to the new IBAN attached.
SMS & WhatsApp phishing
Smishing
Text messages about parcels, fines, tax refunds or bank alerts, with a short link. Phones show less of the link, and people trust texts more than email.
Signals
- A small payment to release a parcel or avoid a fine
- Messages from unknown mobile numbers
- Shortened or unusual links
The habit that beats it
Delivery companies and government agencies rarely ask for payment by SMS. Check the official app or website directly.
EXAMPLE · SMSGjoba juaj e trafikut nuk është paguar. Paguani sot për të shmangur dyfishimin: gjoba-online.example
QR-code phishing
Quishing
A QR code in an email, a PDF, or a sticker on a parking meter or restaurant table leads to a fake payment or login page. Scanning bypasses email link filters entirely.
Signals
- QR codes in emails asking you to “re-authenticate”
- Stickers placed on top of other codes
- A login or payment page right after scanning
The habit that beats it
Treat a QR code like a link: preview the address before opening. Never log in to work accounts from a scanned code.
EXAMPLE · EMAILMicrosoft Authenticator update required. Scan the QR code below with your phone to keep access to your account.
Push bombing
MFA fatigue
The attacker already has your password and triggers sign-in approvals again and again, often late at night, sometimes followed by a call or chat from fake “IT” asking you to approve.
Signals
- Approval requests you didn't start
- Many prompts in a row
- Someone asking you to approve or read out a code
The habit that beats it
Never approve a prompt you didn't start. Deny it, change your password, and report it to IT. It means your password is already known.
EXAMPLE · PUSHApprove sign-in? Location: Unknown · App: Office 365 (repeated 14 times)
Voice phishing, AI voice cloning
Vishing & deepfakes
A phone call or voice note from your “bank”, “IT support”, or a cloned voice of a manager. AI can now copy a voice from a few seconds of public audio, and even fake video calls.
Signals
- Caller pushes you to act during the call
- Requests for codes, passwords or remote access
- A familiar voice asking for something unusual
The habit that beats it
Hang up and call back on a known number. Agree on a verification question or code word for urgent requests within your team.
EXAMPLE · CALL“This is Microsoft support. Your computer is sending virus alerts. I need you to install a tool so I can fix it.”
Malware, ransomware
Malicious attachments
Files disguised as invoices, CVs, delivery notes or court documents that install malware when opened, often the first step of a ransomware attack.
Signals
- Unexpected attachments, especially zip, iso, html or Office files asking to “enable content”
- Password-protected archives (to dodge scanners)
- A generic greeting
The habit that beats it
Don't enable macros or editing on unexpected documents. When in doubt, ask the sender through another channel, or report it.
EXAMPLE · EMAILPlease find attached your court summons. Password: 2026. Failure to respond within 3 days will result in legal action.
Examples are fictional illustrations of common patterns. Domains use the reserved .example suffix.
