Of all the ways a business can have a bad day, an email is rarely the first thing that comes to mind. Yet it remains the most common entry point for cyber criminals targeting Australian businesses, and the reason is simple: email relies on trust, and trust is exactly what phishing exploits.
We work with small and medium businesses across web design, infrastructure, and security, and phishing is the one threat almost every client has encountered in some form, whether they realised it at the time or not. The good news is that phishing isn’t sophisticated in the way Hollywood portrays hacking. It’s sophisticated in the way it manipulates people, which means the defence is largely about awareness rather than expensive tools.
Here’s what phishing actually looks like in 2026, and how to build habits that catch it before it causes damage.
What Phishing Actually Is, and Why It Still Works
At its core, phishing is a con. Someone pretends to be a person, business, or system you trust, hoping you’ll hand over information, click a link, or take an action you wouldn’t otherwise take. The “fishing” metaphor is apt: cast enough lines, and something eventually bites.
What makes phishing persistent is that it doesn’t target software vulnerabilities. It targets human ones. Curiosity, urgency, fear of getting in trouble, or simply being busy and not reading carefully. A well-crafted phishing email doesn’t need to break through a firewall. It just needs one person, on one day, to click without thinking.
This is also why phishing keeps evolving. As spam filters and security software improve, the emails themselves get more convincing, more personalised, and harder to distinguish from the real thing. The arms race isn’t between hackers and software anymore. It’s increasingly between hackers and human attention spans.
The Most Common Forms Phishing Takes Today
Phishing isn’t a single tactic. It’s a family of approaches, each designed to exploit a slightly different angle of trust.
Email phishing remains the classic version, a message designed to look like it’s from a bank, supplier, government department, or colleague, asking you to click a link, verify details, or open an attachment.
Spear phishing is the more targeted cousin. Rather than blasting thousands of generic emails, attackers research a specific person or business and craft something tailored, referencing real names, real projects, or real suppliers to make the request feel legitimate.
Business Email Compromise sits at the more damaging end. This is where an attacker either spoofs or actually gains access to a real email account, then uses it to request payments, redirect invoices, or extract sensitive information from people who have no reason to be suspicious, because the email genuinely looks like it’s coming from someone they work with.
There’s also a newer pattern worth knowing about: social engineering techniques that trick users into running malicious commands themselves, often disguised as a fix for a fake error message on a website. These campaigns have been linked to compromised WordPress sites, a reminder that phishing doesn’t always arrive by email. Sometimes it’s waiting on a webpage that looks completely normal until it isn’t.
The Warning Signs Worth Training Your Eye to Catch
Most phishing attempts share a handful of traits, even when the disguise is good. Training yourself and your team to notice these doesn’t require technical knowledge, just a habit of pausing before acting.
A sense of urgency that feels disproportionate to the request, “act now or your account will be suspended” style language
Email addresses that look almost right but not quite, an extra letter, a different domain ending, or a display name that doesn’t match the actual address
Requests to change payment details, bank accounts, or contact information, especially when they arrive only by email
Links that, when hovered over, point somewhere different from what the text suggests
Generic greetings on messages that claim to be personal or urgent
Attachments you weren’t expecting, particularly from senders you do recognise
None of these signs alone is proof of phishing. Legitimate emails sometimes look slightly off too. But when two or three of these line up, that’s the moment to slow down rather than click through.
What Happens After Someone Clicks
Understanding what’s at stake helps explain why phishing gets taken so seriously. The consequences usually fall into one of a few categories, and they tend to compound.
Credential theft is the most immediate outcome. A fake login page captures a username and password, which the attacker then uses to access real accounts, email, cloud storage, accounting software, anything connected to those credentials.
Malware delivery is the second common path. An attachment or link installs something on the device, ranging from software that quietly monitors activity to ransomware that locks files until a payment is made.
Financial loss often follows from either of the above, particularly when Business Email Compromise is involved. A fraudulent invoice gets paid, a payroll redirect goes through, or a transfer happens before anyone notices something’s wrong.
The disruption rarely ends with the initial incident either. Recovering access, resetting credentials across multiple systems, and reassuring customers or suppliers who may have received suspicious messages from a compromised account all take time that a small business often doesn’t have spare.
Building a Workplace That Catches Phishing Early
Technology helps, but the most effective phishing defence is a workplace culture where checking before clicking is normal, not paranoid.
Verification habits matter most here. If an email asks for a payment, a password reset, or sensitive information, a quick phone call to confirm, using a number you already have on file rather than one provided in the email, closes most phishing attempts immediately. This single habit alone stops the majority of Business Email Compromise attempts before they go anywhere.
Reporting culture matters just as much. Staff should feel comfortable flagging a suspicious email without worrying it makes them look careless. The person who reports a phishing attempt early is doing the business a favour, even if the email turns out to be harmless.
Layered protection also plays a role, spam filtering, updated software, and endpoint protection all reduce how many phishing attempts even reach an inbox in the first place. But even the best filtering won’t stop everything, which is why the human habits matter as much as the technical ones.
These habits work best when they’re written down somewhere staff can refer back to, rather than living only as tribal knowledge passed between colleagues.
Where Phishing Fits Into the Bigger Security Picture
Phishing rarely operates in isolation. It’s often the opening move in a longer chain, an attacker gets a foothold through a phishing email, then uses that access to move further into a business’s systems, sometimes weeks or months later.
This is part of why government cyber security guidance increasingly recommends an “assume compromise” mindset, focusing not just on keeping threats out but on detecting and containing them quickly if they get in. A single compromised login, caught early, is a minor inconvenience. The same login, undetected for weeks, can become something far more serious.
One of the simplest, highest-impact defences against this chain reaction is making sure a stolen password alone isn’t enough to get an attacker in the door. A broader defence strategy for any business usually starts with exactly this kind of layered thinking, where no single point of failure can bring everything down.
Staying One Step Ahead of the Inbox
Phishing isn’t going away, and it doesn’t need to. What changes the outcome is whether a business has built the habits and small checks that turn a convincing email into a non-event rather than a costly one.
As a digital agency working across web design, infrastructure, and security for Australian small and medium businesses, we see phishing attempts land in inboxes every week, and the businesses that come through unscathed are rarely the ones with the most expensive tools. They’re the ones where someone paused, checked, and asked a question before clicking. Building that kind of layered defence doesn’t happen overnight, but it starts with exactly the habits covered here, and adding a second layer of verification to your logins is one of the most effective next steps any business can take.
