How to Recognise and Avoid Phishing Attacks

Phishing is a form of social engineering. The attacker poses as someone the target trusts and asks them to reply, click a link, open an attachment or enter details into a fake site. It is the crime reported most often to the FBI's Internet Crime Complaint Center: phishing and spoofing made up 191,561 of the complaints it received in 2025, more than any other type (IC3 2025 Internet Crime Report). This article covers how to recognise a phishing message, what to do if you have acted on one, and what PCI DSS asks of organisations that handle card data.

The forms it takes

Form	What it looks like
Email phishing	A message sent to many people, made to look like it comes from a known brand or service
Spear phishing	A message aimed at one person or team, using details about them to seem genuine
Whaling	Spear phishing aimed at senior staff, who can approve payments or access
Business email compromise	A message from a real or spoofed business account asking for a payment or a change of bank details
Clone phishing	A copy of a genuine message the target has already received, with the link or attachment swapped
Smishing	Phishing by SMS or messaging app
Vishing	Phishing by phone call
Quishing	Phishing through a QR code, covered in QR code phishing and PCI DSS

Warning signs

• The sender does not match. The display name says a known company, but the address is a different domain, a free mail account, or a look-alike such as a zero in place of the letter o.
• Urgency or threat. An account about to close, a payment about to fail, a deadline in hours.
• Something to gain. A refund, a prize, a payment waiting to be claimed.
• A request for credentials, card details or a change of bank details. Services you use do not need your password by email, and a supplier's new bank account needs confirming by phone on a number you already hold.
• A link that goes somewhere else. Hovering over it, or pressing and holding on a phone, shows the real destination.
• An attachment you did not expect, especially an archive, a document asking you to enable content, or a file that runs.
• A generic greeting where the real sender would use your name.

Spelling mistakes are a weak sign either way. Some phishing messages are full of them, and a well-written message is no evidence that it is genuine.

Two examples

Both show the signs above: an urgent or tempting subject, a sender unconnected with the brand it names, and one button to press.

How the tactics work

Tactic	Example	Why it works
Urgency	"Act now or lose access to your account"	Pressure leaves less time to check
Authority	"Message from the CEO"	People tend to do what a senior person asks
Reward	"A payment is waiting for you"	The chance of gain lowers suspicion
Familiarity	A copy of a real invoice or delivery notice	It matches something the target expects

Habits that defeat it

• Check a request through a contact you already have, not one given in the message.
• Type the address of a site you know instead of following a link to log in.
• Use multi-factor authentication, and where it is offered, phishing-resistant authentication such as a security key or passkey, which will not work on a fake site.
• Use a password manager. It will not fill in a password on a domain it does not recognise.
• Keep software updated, so an attachment or page has fewer weaknesses to use.
• Report a suspicious message to your IT or security team, even if you did not act on it.

If you have acted on one

1. If you entered a password, change it at once on the real site, and anywhere else you use it.
2. Tell your IT or security team straight away. At work, that starts the incident response process.
3. If you gave card or bank details, call your bank on the number on your card.
4. Report it. In Australia that is ReportCyber; in the United States, the Internet Crime Complaint Center. Tell the organisation that was impersonated as well.
5. Watch your accounts for activity you do not recognise.

What PCI DSS asks of organisations

For an organisation that stores, processes or transmits card data, phishing defence is part of the standard:

• 5.4.1 requires processes and automated mechanisms to detect and protect personnel against phishing attacks. PCI DSS Requirement 5.4.1: protecting personnel against phishing covers it in detail.
• 12.6.3.1 requires security awareness training to cover phishing and social engineering, and 12.6.3 requires that training on hire and at least once every 12 months. The standard says 5.4.1 and 12.6.3.1 are separate: meeting one does not meet the other.
• 8.4.2 and 8.4.3 require multi-factor authentication for non-console access into the cardholder data environment and for remote access from outside the network. A phished password is not enough on its own where they apply.
• 12.10.1 requires an incident response plan, which is where a successful phishing attack goes next.

The warning signs above are the kind of content 12.6.3.1's guidance suggests: how to identify phishing, how to react to it, and where and how to report it. Staff who take card payments can practise them in Front Office Payment Security, which has a module on people who want a terminal or a login.