To be forewarned is to be forearmed!
Learn to outsmart Phishing traps
Frequently asked questions about phishing
Are smishing (SMS) and vishing (phone) as dangerous as email phishing?
Yes, and they can be more effective, precisely because people expect them less.
Smishing (SMS): SMS have an open rate above 90%, compared to 20 to 30% for emails. Messages typically imitate a delivery alert (postal service, DHL), a banking warning, or a government message. The link redirects to a fake login page. On mobile, the URL is often truncated and difficult to verify.
Vishing (voice): the attacker calls their victim directly, posing as IT support, a bank, or Microsoft. Real-time pressure and the human voice bypass the usual defenses. AI-generated voice deepfakes can now imitate the voice of a known colleague or manager.
The golden rule in both cases: never provide sensitive information following an unsolicited message or call — call the organization back directly via a known official number.
Smishing (SMS): SMS have an open rate above 90%, compared to 20 to 30% for emails. Messages typically imitate a delivery alert (postal service, DHL), a banking warning, or a government message. The link redirects to a fake login page. On mobile, the URL is often truncated and difficult to verify.
Vishing (voice): the attacker calls their victim directly, posing as IT support, a bank, or Microsoft. Real-time pressure and the human voice bypass the usual defenses. AI-generated voice deepfakes can now imitate the voice of a known colleague or manager.
The golden rule in both cases: never provide sensitive information following an unsolicited message or call — call the organization back directly via a known official number.
Does MFA (multi-factor authentication) really protect against phishing?
Yes, in the vast majority of cases. Even if an attacker obtains your password via a phishing page, they cannot log in without the second factor (SMS code, authenticator app, physical key). MFA blocks 99.9% of automated account attacks (Microsoft 2024). The only exception is real-time phishing (MITM / Adversary-in-the-Middle attack) which intercepts the MFA code in the same instant — this vector remains marginal for SMEs. The recommendation: enable MFA on all professional accounts without exception.
How do you effectively train teams against phishing?
Theoretical training alone is not enough: studies show that employees forget 70% of training content within the week following the session (Ebbinghaus, replicated in numerous e-learning studies). The most effective approach combines simulation and corrective training: send real simulated phishing campaigns (via PhishTrainer), identify employees who click, then automatically redirect them to targeted training (Bexxo Academy). This method reduces the click rate by 60 to 70% in six months (Proofpoint 2024). Regular simulations (4 to 6 per year) maintain the level of vigilance over time.
How do you recognize a phishing email?
The main warning signs are: a sender address slightly different from the original (e.g. support@rnazonl.com instead of @amazon.com), a sense of urgency or threat pushing you to act quickly, a request for your password or banking information, a link URL that does not match the expected site (hover before clicking), spelling or formatting errors. Warning: AI-generated emails are now perfectly written — grammar alone is no longer enough to detect them.
How is artificial intelligence transforming phishing attacks?
Generative AI has radically changed the phishing threat since 2023. Three major developments:
- Perfectly written emails — gone are the spelling mistakes that used to help detect phishing. LLMs generate flawless emails in perfect English, adapted to the tone of the targeted company. AI-generated emails have a click rate four times higher than manually crafted ones (APWG / Keepnet 2025).
- Personalization at scale — AI can analyze a target's LinkedIn profile, public posts, and company website to create an ultra-realistic spear phishing in seconds. What used to take a human attacker hours now takes seconds.
- Voice and video deepfakes — vishing calls imitating a manager's voice, or entire video conferences with deepfake avatars, have already been used to trigger fraudulent bank transfers (documented cases in 2024 in Hong Kong: 25 million USD lost).
What are the different forms of phishing to know about?
There are 6 main forms of phishing:
- Classic phishing — mass emails imitating a bank, a delivery service, or a government agency. More than 3.4 billion fraudulent emails sent every day (Forbes 2024). Often recognizable by errors and artificial urgency.
- Spear phishing — targeted attack on a specific person, with real information (manager's name, ongoing project). Accounts for 66% of confirmed breaches (Verizon DBIR 2024).
- Whaling — variant of spear phishing specifically targeting executives and managers, to access finances or strategic decisions.
- Smishing — phishing via SMS. Typically imitates a banking alert, a parcel delivery, or a public service. SMS open rates exceed 90% — this vector is growing rapidly.
- Vishing — voice phishing by phone. The fraudster impersonates IT support, a bank, or a government agency to extract information or trigger immediate action.
- BEC (Business Email Compromise / CEO fraud) — identity impersonation of a manager or partner to order a bank transfer or obtain sensitive data. The primary source of financial losses related to cybercrime: 2.9 billion USD in 2023 (FBI IC3 2024).
What is phishing?
Phishing is an online fraud technique that involves sending emails, SMS, or messages that imitate legitimate communications (bank, government agency, employer) to trick the victim into revealing confidential information — passwords, banking details, professional credentials. Phishing is the most widely used attack vector: 91% of cyberattacks start with a fraudulent email (Proofpoint 2024).
What is spear phishing and why is it more dangerous?
Spear phishing is a targeted variant of classic phishing: instead of sending millions of generic emails, attackers personalize the attack using real information about the victim (manager's name, ongoing project, supplier name). This targeting makes the email far more credible. Spear phishing accounts for 66% of confirmed data breaches (Verizon DBIR 2024). With AI, attackers can now generate these personalized emails at scale — the cost of a targeted attack has dropped considerably.
What should I do if I clicked on a phishing link?
Act immediately: (1) disconnect from the company network (Wi-Fi, cable); (2) report the incident to your IT department or security officer without delay — by phone, not by email; (3) change your password from another secure device; (4) do not delete the suspicious email, it is needed for forensic analysis; (5) enable MFA if not already done. The faster you act, the more the damage can be limited.
Yes, and they can be more effective, precisely because people expect them less.
Smishing (SMS): SMS have an open rate above 90%, compared to 20 to 30% for emails. Messages typically imitate a delivery alert (postal service, DHL), a banking warning, or a government message. The link redirects to a fake login page. On mobile, the URL is often truncated and difficult to verify.
Vishing (voice): the attacker calls their victim directly, posing as IT support, a bank, or Microsoft. Real-time pressure and the human voice bypass the usual defenses. AI-generated voice deepfakes can now imitate the voice of a known colleague or manager.
The golden rule in both cases: never provide sensitive information following an unsolicited message or call — call the organization back directly via a known official number.
Smishing (SMS): SMS have an open rate above 90%, compared to 20 to 30% for emails. Messages typically imitate a delivery alert (postal service, DHL), a banking warning, or a government message. The link redirects to a fake login page. On mobile, the URL is often truncated and difficult to verify.
Vishing (voice): the attacker calls their victim directly, posing as IT support, a bank, or Microsoft. Real-time pressure and the human voice bypass the usual defenses. AI-generated voice deepfakes can now imitate the voice of a known colleague or manager.
The golden rule in both cases: never provide sensitive information following an unsolicited message or call — call the organization back directly via a known official number.
Yes, in the vast majority of cases. Even if an attacker obtains your password via a phishing page, they cannot log in without the second factor (SMS code, authenticator app, physical key). MFA blocks 99.9% of automated account attacks (Microsoft 2024). The only exception is real-time phishing (MITM / Adversary-in-the-Middle attack) which intercepts the MFA code in the same instant — this vector remains marginal for SMEs. The recommendation: enable MFA on all professional accounts without exception.
Theoretical training alone is not enough: studies show that employees forget 70% of training content within the week following the session (Ebbinghaus, replicated in numerous e-learning studies). The most effective approach combines simulation and corrective training: send real simulated phishing campaigns (via PhishTrainer), identify employees who click, then automatically redirect them to targeted training (Bexxo Academy). This method reduces the click rate by 60 to 70% in six months (Proofpoint 2024). Regular simulations (4 to 6 per year) maintain the level of vigilance over time.
The main warning signs are: a sender address slightly different from the original (e.g. support@rnazonl.com instead of @amazon.com), a sense of urgency or threat pushing you to act quickly, a request for your password or banking information, a link URL that does not match the expected site (hover before clicking), spelling or formatting errors. Warning: AI-generated emails are now perfectly written — grammar alone is no longer enough to detect them.
Generative AI has radically changed the phishing threat since 2023. Three major developments:
- Perfectly written emails — gone are the spelling mistakes that used to help detect phishing. LLMs generate flawless emails in perfect English, adapted to the tone of the targeted company. AI-generated emails have a click rate four times higher than manually crafted ones (APWG / Keepnet 2025).
- Personalization at scale — AI can analyze a target's LinkedIn profile, public posts, and company website to create an ultra-realistic spear phishing in seconds. What used to take a human attacker hours now takes seconds.
- Voice and video deepfakes — vishing calls imitating a manager's voice, or entire video conferences with deepfake avatars, have already been used to trigger fraudulent bank transfers (documented cases in 2024 in Hong Kong: 25 million USD lost).
There are 6 main forms of phishing:
- Classic phishing — mass emails imitating a bank, a delivery service, or a government agency. More than 3.4 billion fraudulent emails sent every day (Forbes 2024). Often recognizable by errors and artificial urgency.
- Spear phishing — targeted attack on a specific person, with real information (manager's name, ongoing project). Accounts for 66% of confirmed breaches (Verizon DBIR 2024).
- Whaling — variant of spear phishing specifically targeting executives and managers, to access finances or strategic decisions.
- Smishing — phishing via SMS. Typically imitates a banking alert, a parcel delivery, or a public service. SMS open rates exceed 90% — this vector is growing rapidly.
- Vishing — voice phishing by phone. The fraudster impersonates IT support, a bank, or a government agency to extract information or trigger immediate action.
- BEC (Business Email Compromise / CEO fraud) — identity impersonation of a manager or partner to order a bank transfer or obtain sensitive data. The primary source of financial losses related to cybercrime: 2.9 billion USD in 2023 (FBI IC3 2024).
Phishing is an online fraud technique that involves sending emails, SMS, or messages that imitate legitimate communications (bank, government agency, employer) to trick the victim into revealing confidential information — passwords, banking details, professional credentials. Phishing is the most widely used attack vector: 91% of cyberattacks start with a fraudulent email (Proofpoint 2024).
Spear phishing is a targeted variant of classic phishing: instead of sending millions of generic emails, attackers personalize the attack using real information about the victim (manager's name, ongoing project, supplier name). This targeting makes the email far more credible. Spear phishing accounts for 66% of confirmed data breaches (Verizon DBIR 2024). With AI, attackers can now generate these personalized emails at scale — the cost of a targeted attack has dropped considerably.
Act immediately: (1) disconnect from the company network (Wi-Fi, cable); (2) report the incident to your IT department or security officer without delay — by phone, not by email; (3) change your password from another secure device; (4) do not delete the suspicious email, it is needed for forensic analysis; (5) enable MFA if not already done. The faster you act, the more the damage can be limited.
Train your teams
Train your teams with PhishTrainer.
With PhishTrainer, transform your employees into the first line of defense against phishing. Simulate, raise awareness, and secure your company for the long term with realistic and engaging phishing campaigns.
See the demonstration