It is Friday afternoon. The phone is ringing, someone is waiting for a reply and there are still a few jobs to clear before the weekend. An email arrives from what looks like a supplier, colleague, client or school contact. The message is short, polite and familiar. There is an invoice query, a shared document, a payment change, a password prompt or a request that seems to fit the working day.
The person reading it is not careless. They are not foolish. They are probably trying to be helpful.
That is exactly why phishing still works.
For years, phishing was often treated as a simple awareness problem. Spot the spelling mistake. Check the logo. Hover over the link. Look for strange wording. Some of that advice still has value, but it no longer tells the whole story. Modern phishing is not always badly written, obvious or sent by someone pretending to be a distant prince with a strange inheritance problem.
The better attacks are designed around people. They exploit the habits, pressures and trust that make workplaces function.
Most people want to do a good job. They want to respond quickly, help colleagues, keep suppliers happy and avoid holding things up. A convincing phishing email does not need to defeat someone’s intelligence. It only needs to arrive at the wrong moment, wearing the right disguise.
That might be a message that appears to come from a manager. It might be a supplier asking about an invoice. It might be a Microsoft 365 login page that looks close enough to the real thing. It might be a message from “IT support” asking someone to confirm their details. It might be a text message about a delivery, a Teams notification, a QR code, or a link shared through a compromised email account.
Attackers know that trust is a shortcut. If an email seems to come from someone we know, we are more likely to act. If the request fits a normal pattern, we are less likely to question it. If the tone sounds familiar, our guard drops. That is not weakness. It is how people get through busy working days without treating every interaction as a crime scene.
Authority is another reason phishing works. People are more likely to comply when a request appears to come from someone senior, official or responsible for a system they rely on. A message from the managing director asking for urgent help. A note from finance about a payment. A prompt from Microsoft. A request from IT. The more legitimate the authority feels, the less time people may spend checking whether it is real.
Urgency makes this worse. A message that says an account will be locked, a payment will fail, a file needs approving today or a parcel will be returned pushes people towards action. Urgency narrows attention. Instead of calmly assessing the message, the person tries to solve the problem in front of them. That is exactly what the attacker wants.
Fear plays a part too. Nobody wants to be the person who ignored an important message, missed a deadline, blocked a payment or let a client down. A good phishing email leans into that pressure. It creates just enough concern to make clicking feel like the safest option.
Then there is context. A school at the end of term. A care provider during a staffing shortage. A small business owner trying to renew insurance. A finance assistant processing invoices at month end. A parish clerk dealing with public queries. These are not abstract situations. They are real environments where people are busy, interrupted and expected to make quick decisions.
Phishing succeeds because it blends into those environments.
There is also a reason supplier and invoice scams are so common. They target normal business behaviour. Businesses receive invoices. They query payments. They update bank details. They share documents. They use cloud systems. They deal with people they may never meet in person. A criminal does not have to invent a strange story. They only have to imitate an ordinary one.
This is why blame is such a poor response. If a member of staff clicks a phishing link, the useful question is not “How could they fall for that?” The useful question is “Why was one click able to create so much risk?”
That question changes the conversation.
If a stolen password is enough to access email, the issue is not just the person who entered it. It is the lack of multi-factor authentication. If a malicious attachment can run freely, the issue is not just the person who opened it. It is the protection around the device. If a fake invoice can trigger a payment, the issue is not just the person who received it. It is the payment process. If a compromised account can sit unnoticed for days, the issue is not just the original click. It is the lack of monitoring.
Good cyber security does not pretend people will never make mistakes. It assumes people are human and builds protection around them.
That means making it harder for phishing emails to reach staff in the first place. It means using email security that checks links, attachments and impersonation attempts. It means turning on multi-factor authentication so a stolen password is not enough. It means using strong password management so people are not reusing the same password across work and personal accounts. It means protecting devices with proper endpoint security. It means keeping software patched. It means having backups that can be restored. It means monitoring for unusual behaviour in accounts and devices.
Training still matters, but it has to be done properly. Staff do not need to be frightened, tricked or made to feel stupid. They need practical examples that reflect the messages they actually receive. They need permission to pause. They need a simple way to report something suspicious. They need to know that asking “Is this real?” is a good thing, not an inconvenience.
The best security cultures are not built on blame. They are built on confidence.
In a small business, school, care setting or local organisation, that confidence matters. People should feel able to question an invoice change, double-check a payment request, report a strange email or ask for help with a login prompt. If they think they will be blamed or mocked, they may stay quiet. That silence can turn a small incident into a much bigger one.
There is another point worth making. Technical people are not immune either. Someone who understands computers can still be rushed, tired, distracted or trusting. A well-crafted phishing message can catch anyone at the wrong moment. Cyber security should never be based on the idea that clever people do not click. It should be based on the reality that criminals are deliberately designing messages to make clicking feel normal.
Artificial intelligence has made this harder. Attackers can now write cleaner emails, imitate tone more convincingly and create messages that look far less suspicious than the phishing emails many people were trained to spot years ago. Public information from websites, social media, Companies House, LinkedIn and previous data breaches can also help criminals make messages feel personal and believable.
That is why the answer is not “tell staff to be more careful” and leave it there.
Careful people still need support.
At Black Swan Cyber Security Solutions, we help organisations put that support in place. For some, that starts with a phishing and email security review. For others, it means strengthening Microsoft 365, turning on multi-factor authentication properly, improving password security, adding managed endpoint detection and response, checking backup arrangements, or giving staff awareness training that feels useful rather than intimidating.
The right approach depends on the organisation. A school, accountant, care provider, parish council, trades business and small office will not all have the same risks. But they all have people who are busy, trusted and trying to do the right thing.
That is what phishing attacks exploit.
So the goal is not to create suspicion around every email. That would make work impossible. The goal is to build a sensible safety net around normal working life.
Fewer dangerous emails getting through.
Fewer stolen passwords turning into account compromise.
Fewer payment requests being trusted without checks.
Faster reporting when something feels wrong.
Better monitoring if an account or device behaves strangely.
Clearer answers for insurers, clients and leadership teams.
Phishing still works on good people because good people are helpful, busy and human. That should not be a source of embarrassment. It should be the starting point for better protection.
The phishing emails that worry me aren’t the ones promising £10 million from a prince. They’re the ones that look exactly like the work you do every day.
If you are not sure how well your organisation would cope with a phishing email, start with a simple review. We can help you understand where the risk sits, what protection is already in place, and what needs attention first.
Your staff should not have to carry the whole burden alone.
They need clear guidance, safer systems and the confidence to stop, check and report.
That is how you reduce phishing risk without creating fear.
