Phishing: how to recognise it and how to defend

Phishing is a fraudulent message meant to make you enter a password, open an attachment or send money. You can best recognise it by the pressure to hurry, a sender address that does not fit, and a link that leads somewhere other than the text promises. It is not a marginal problem. According to NÚKIB, nine in ten respondents of its survey met phishing in 2025, and more than a third of firms never tested their people against it.

No single step stops phishing. What helps is a resistant second factor that does not pass on a fake page, a firm rule for changing an account number, and a colleague who is not afraid to report a message. We show what the scams look like, what to do after a click and what a company of twenty does.

What phishing is and what the attacker wants

According to CISA, the attacker poses as a trustworthy source, such as a colleague, an acquaintance or a company, to coax a password out of you. They may pose as a superior or as someone from IT. The goal is usually one of three: to get the password, to get malware onto the computer through an attachment or a link, or to push you into a payment.

The message does not have to arrive by e-mail. CISA lists SMS and chats on Slack, Teams, Signal, WhatsApp and Messenger, and also phone calls where the attacker spoofs the caller's number.

How to recognise phishing

The signs follow what NÚKIB advises. When two or more come together, be alert:

• Pressure and haste. NÚKIB: attackers like to put users under time pressure and push for quick completion of the task. A typical line: "Your account will be blocked within 24 hours."
• An address that does not fit. An unusual domain is suspicious, such as .ru instead of .cz. Attackers also swap letters, for example "i" for "l".
• A link that leads elsewhere. Hover the mouse over the link, do not click. The target shows at the bottom left. If it does not match the text, do not click.
• Familiar graphics. NÚKIB points out that attackers rely on a logo and a look you know. A logo proves nothing.
• An unexpected attachment or macros. An invoice you did not expect, or a document that asks you to enable macros. CISA recommends that firms block macros by default.
• A request for data or a payment. Verify it through a different channel from the one it came by: call the number from the official website, not the number in the message.

Types of phishing

• Mass phishing: the same message sent to thousands of people. Impersonal, it works on numbers.
• Targeted phishing: a message written for a specific person, with details about the company. CISA mentions attackers who pose as a superior or as someone from IT.
• BEC (business e-mail compromise): the attacker poses as the managing director or a supplier and asks for a change of account number or an urgent payment. According to the FBI, 2025 brought 24,768 complaints and losses of over 3 billion dollars in the USA.
• Smishing and vishing: the same by SMS or phone. NÚKIB advises verifying a message through another channel and not sending sensitive data by SMS.

What BEC looks like in practice is shown by a case from the FBI IC3 annual report for 2025. A buyer of a property received an e-mail from the firm handling the transfer ("title company") with instructions to send over 1.3 million dollars to a fraudulent account. A US FBI team had the account blocked through the banks. The case is from the USA, but the principle is the same: an account number changes and the e-mail looks like any other.

Someone clicked. What now?

Above all, quickly and without panic. NÚKIB advises: if you opened the link, fill in nothing and log in nowhere, and then follow the IT rules in your company. We add three steps from our own experience, not from a rule:

1. Did you enter a password? Change it from a different computer than the one you clicked on, and everywhere you use the same one.
2. Write to IT right away. CISA stresses that it is important to report even that you opened a suspicious link or attachment.
3. Was it a payment? Call the bank and ask it to stop it. The sooner, the better the chance, as the case above shows.

Do not punish the person who clicked and admitted it. A hushed-up incident is worse than a reported one, and CISA writes that reporting suspicious messages is among the most efficient ways to protect firms. If the company falls under Act No. 264/2025 Coll., which we cover on the NIS2 page, it has to report an incident within the set deadlines.

How a company defends systematically

An individual will always make a mistake. A company therefore builds layers, where one catches what another lets through:

• A strong second factor. CISA warns that MFA without FIDO and PKI keys is vulnerable to phishing: a code from SMS or from an app can be typed into a fake page. It therefore advises resistant MFA for administrators.
• Training and testing. CISA advises small firms to hold training once a year and to check that people understood it. NÚKIB advises testing habits with practice phishing.
• A Report button. CISA advises using the button built into Outlook and cloud mail. Every reported message helps mail providers spot new campaigns.
• Protecting your domain. CISA wants DMARC, SPF and DKIM and a "reject" policy for outgoing messages, so that fraudsters find it harder to sign e-mails in the firm's name.
• Filters and DNS. Block known malicious addresses and macros by default.
• A test from outside. A penetration test shows where an attacker would get after the first click. Phishing is also one of six routes by which, according to CISA, ransomware gets in.

What a company of 20 does

This is our proposal based on the sources listed, not a rule:

1. Turn on resistant MFA first for e-mail, administrators and the people who approve payments.
2. Introduce one rule: a change of a supplier's account number is confirmed by a second person by phone, on a number you already know.
3. Set up DMARC, SPF and DKIM on your domain, and ask your mail administrator whether the policy is "reject".
4. Run a short training session once a year and a practice phishing from time to time. Treat the result as an indicator, not as a list of culprits.
5. Tell people whom to report a suspicious message to and how, and to do so even after a click.

Sources

• NÚKIB, press release on the 2025 annual report, 21 Aug 2026: https://nukib.gov.cz/cs/infoservis/aktuality/2453-nukib-vydal-zpravu-o-stavu-kyberneticke-bezpecnosti-cr-za-rok-2025-incidentu-ubylo-sofistikovanost-utocniku-roste/
• NÚKIB, Dávej kyber 26: Social engineering: https://osveta.nukib.gov.cz/mod/page/view.php?id=4707
• CISA, NSA, FBI, MS-ISAC, Phishing Guidance: Stopping the Attack Cycle at Phase One, 18 Oct 2023: https://www.cisa.gov/sites/default/files/2023-10/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf
• FBI, 2025 IC3 Annual Report: https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
• Act No. 264/2025 Coll., section 16: https://www.zakonyprolidi.cz/cs/2025-264