What Is Phishing — and How Small Businesses Get Targeted
Most cyber attacks start with a single email. Here's how phishing works, the variations to watch for, and how to stop your team from clicking.
By Muneeb Ahmed, Founder, AiVigil MSP · Updated June 2026
Phishing is when an attacker sends a fake message — usually email — designed to trick someone into revealing a password, clicking a malicious link, or making a payment. It's the most common way businesses get breached, because it targets people rather than software.
How a phishing attack works
The pattern is almost always the same: a message that looks legitimate, a sense of urgency, and a single action the attacker wants you to take. "Your password expires today — click here." "Invoice attached, please pay." "I'm in a meeting, can you buy gift cards?" The link leads to a fake login page, or the attachment installs malware, or the payment goes to the attacker.
The variations to know
- Spear phishing — a targeted message tailored to a specific person using details about your company.
- Business email compromise (BEC) — impersonating a boss, colleague or vendor to redirect a payment or steal data.
- Smishing — phishing by text message.
- Vishing — phishing by phone call.
- Whaling — going after executives, who have the most access and authority.
Red flags to teach your team
- Urgency or pressure ("act now," "final notice").
- A sender address that's slightly off from the real one.
- Links that don't match the text when you hover over them.
- Unexpected attachments or requests for credentials.
- Any request to change payment details or buy gift cards.
How to defend against phishing
No single tool stops everything, so defence is layered:
- Email security that filters known threats before they reach inboxes.
- Multi-factor authentication so a stolen password alone isn't enough. What is MFA?.
- Security-awareness training and simulated phishing so staff learn to spot the fakes.
- EDR to catch anything that does get clicked. What is EDR?.
- A simple, blame-free way for staff to report suspicious emails.
AiVigil builds all of this into managed cybersecurity. The fastest first step is a free security assessment to see how exposed your team is today.
Muneeb Ahmed
Founder, AiVigil MSP
With around 8 years of experience in IT and technology, Muneeb is the founder of AiVigil MSP — a security-first, AI-enabled managed IT provider based in Calgary serving SMBs across Canada, the US and the UK. Connect on LinkedIn.
Frequently asked questions
What is phishing?
Phishing is a fake message — usually email — designed to trick someone into revealing a password, clicking a malicious link, or making a payment. It's the most common cause of business breaches.
What is business email compromise?
BEC is a phishing attack where the attacker impersonates a boss, colleague or vendor to redirect a payment or steal sensitive data. It often involves no malware — just deception.
How can I protect my business from phishing?
Layer your defences: email security, multi-factor authentication, security-awareness training with simulated phishing, EDR on devices, and an easy way for staff to report suspicious emails.
What are the warning signs of a phishing email?
Urgency, a sender address that's slightly wrong, links that don't match their text, unexpected attachments, and any request to change payment details or buy gift cards.
How exposed is your team?
A free assessment shows how vulnerable your business is to phishing — and the quickest ways to lock it down.
Get my free assessment