Phishing has evolved far beyond the badly-spelled “Nigerian prince” emails of the early 2000s. Today, threat actors use generative AI to craft grammatically perfect, contextually accurate messages that mimic colleagues, vendors, and executives with frightening precision.

The New Phishing Playbook

Modern phishing campaigns often combine multiple channels. An attacker might first call a target — using a cloned voice of their manager — then follow up with an email, and finally send a WhatsApp message for urgency. This multi-channel approach bypasses the “just check the sender email” advice most users have heard.

Three Red Flags That Still Work

• Pressure and urgency — Legitimate systems rarely demand you act within 10 minutes or face account loss.
• Unexpected credential requests — Your bank, Microsoft, or Google will never email you asking to re-enter your password via a link.
• Mismatched URLs — Hover before you click. The display text and the actual destination should match and belong to the real company domain.

What Organisations Should Do

Technical controls matter but human resilience matters more. Regular simulated phishing exercises, combined with immediate, blame-free feedback, train users to pause before acting on suspicious messages. Pair this with DMARC email authentication and you significantly reduce successful attacks.

The goal is not to make users afraid of email — it is to make them confident about when to verify.

If you receive a suspicious message, report it through your organisation’s official channel rather than investigating it yourself. That simple habit is one of the most valuable security behaviours you can build.