Phishing in 2026: How to Recognise and Stop Modern Attacks
Phishing has moved beyond badly written emails to AI-written messages, QR codes, fake login pages and voice calls. Warning signs and defences that work.
Phishing remains one of the most common ways attackers get into organisations. What has changed is the quality. Spelling mistakes and strange greetings are no longer reliable signs, because attackers use AI tools to write convincing messages in any language. Defending against modern phishing takes a mix of awareness and technical controls.
Common types of phishing today
Credential phishing. An email or message links to a fake login page for Microsoft 365, Google, a bank or a courier. Anything typed is captured.
Business email compromise (BEC). Attackers impersonate a CEO, supplier or client, often from a compromised or look-alike account, and request an urgent payment or a change of bank details.
QR code phishing ("quishing"). A QR code in an email, PDF or printed notice leads to a fake page. It bypasses some email link scanning and moves the victim to a less protected phone.
MFA fatigue. After stealing a password, attackers send repeated sign-in approval requests, hoping the user taps "Approve" to stop them.
Adversary-in-the-middle pages. Advanced kits sit between the victim and the real login page, capturing both the password and the session cookie, which can bypass code-based MFA.
Voice and messaging attacks. Calls or WhatsApp messages pretending to be IT support, a bank or a manager, sometimes using cloned voices.
Warning signs that still work
- Urgency or pressure: "within 30 minutes", "your account will be closed".
- Unusual requests: changing bank details, buying gift cards, sharing codes.
- Mismatched addresses: the display name says your CEO, the address does not.
- Unexpected login prompts after clicking a link.
- Requests to move to another channel to avoid normal approvals.
- Sign-in approval requests you did not start.
The single most useful habit: verify unusual requests through a separate, known channel, such as calling the person on a number you already have.
Technical defences
Email authentication. Configure SPF, DKIM and DMARC for your domains, and move DMARC towards a reject policy. This makes it harder to spoof your domain.
Phishing-resistant MFA. Passkeys and security keys are bound to the real website, so fake pages cannot use them. Where you use authenticator apps, enable number matching to reduce MFA fatigue.
Conditional access. Block sign-ins from unexpected countries or unmanaged devices for sensitive accounts.
Link and attachment protection. Use your email provider's safe links, attachment sandboxing and external sender warnings.
DNS and web filtering. Block known malicious domains at the network level.
Payment controls. Require a second approval and a phone verification for any change of supplier bank details or large transfers.
Building a reporting culture
- Make reporting easy: a "Report phishing" button in the mail client.
- Respond quickly and thank people who report, even false alarms.
- Run short, regular awareness sessions with real recent examples.
- Use simulated phishing to teach, not to punish.
If someone clicks
- Disconnect the device from the network if malware is suspected.
- Change the password and revoke active sessions for the affected account.
- Check mailbox rules for suspicious forwarding.
- Review recent sign-ins and actions.
- Inform IT and, if payments were involved, the bank immediately.
Frequently asked questions
Are AI-written phishing emails really harder to detect? Yes. Grammar and tone are no longer reliable warning signs. Focus on context: is the request expected, is it urgent, does it ask for money, credentials or codes?
What should we do with suspicious text messages and WhatsApp messages? Treat them like email: do not click links, verify through a known number, and report them to IT. Attackers increasingly use mobile channels because they have fewer filters.
Does antivirus stop phishing? Not reliably. Many phishing attacks contain no malware at all, only a link to a fake login page. Identity protections such as phishing-resistant MFA and conditional access are more effective.
How often should we run awareness training? Short sessions every month or quarter work better than one long annual course. Use recent real examples that are relevant to your staff.
Who is most targeted? Finance, HR, executives and IT administrators, because they control payments, personal data and access. Give them extra protection such as security keys and stricter payment verification.
Key takeaways
- Modern phishing is well written; look for pressure, unusual requests and unexpected prompts instead of typos.
- Verify payment and bank detail changes through a separate known channel.
- Use DMARC, phishing-resistant MFA, conditional access and link protection.
- Encourage fast reporting and have a clear response checklist.
KHR Digital Solutions helps organisations secure email, identity and access as part of their IT infrastructure and support services.
Related articles
Password Managers for Teams: Why Your Business Needs One and How to Roll It Out
Shared passwords in spreadsheets and chats are a security risk. How team password managers work, what to look for and a smooth rollout plan.
Microsoft 365 and Google Workspace Security: 10 Settings Every Business Should Check
Most business email accounts are protected by default settings that leave gaps. Ten configuration checks that close the most common attack paths.
Passkeys Explained: Why Passwords Are Being Replaced and How to Prepare
Passkeys let people sign in with a fingerprint, face or device PIN instead of a password. What they are, why they resist phishing, and how businesses can adopt them.