Phishing remains the number one entry point for cyberattacks against Australian businesses. The Australian Cyber Security Centre (ACSC) receives thousands of phishing-related reports each year. Understanding how these attacks work is your first line of defence.
What Is Phishing?
Phishing is a social engineering attack where criminals impersonate trusted organisations (banks, the ATO, Australia Post, Microsoft) to trick employees into revealing passwords, clicking malicious links, or transferring money.
Common Phishing Types
- Email phishing: Mass emails impersonating reputable brands
- Spear phishing: Targeted attacks using personal information about the recipient
- Whaling: Targeting executives or high-value employees specifically
- Smishing: SMS-based phishing (“Your parcel is held, click here”)
- Vishing: Voice calls impersonating banks or government agencies
Red Flags to Look For
- Urgency language: “Your account will be suspended in 24 hours”
- Mismatched sender domains (e.g., [email protected])
- Unexpected requests for login credentials or payment details
- Grammar errors and unusual formatting
- Links that don’t match the displayed text (hover to check)
- Requests to bypass normal approval processes
Protection Strategies for Australian SMEs
- Enable Multi-Factor Authentication (MFA) on all accounts
- Train staff to recognise phishing with regular simulated exercises
- Implement email filtering with SPF, DKIM, and DMARC records
- Use a password manager to prevent credential reuse
- Create a clear process for verifying unexpected financial requests
- Report suspected phishing to ReportCyber (cyber.gov.au)
What to Do If You’re Targeted
If an employee clicks a phishing link: immediately change affected passwords, disconnect the compromised device from the network, notify your IT team, and if financial information was involved, contact your bank immediately. Document everything for potential reporting under the Notifiable Data Breaches (NDB) scheme.
Ozlin Info helps Australian businesses implement layered cybersecurity defences. Contact us for a security assessment.