The phishing email used to announce itself: a prince, a lottery, a paragraph of broken English. Those messages still circulate, but they are no longer the threat that empties bank accounts. Today’s phishing is polished, personalised and patient — written in flawless prose, timed to real events in the victim’s life, and increasingly delivered by voice and video as well as by inbox.
From spray-and-pray to spear phishing
Investigators describe a two-tier industry. At the bottom, mass campaigns rent ready-made phishing kits that clone the login pages of banks and delivery firms down to the favicon. At the top, targeted “spear phishing” operations research their victims on social media, reference real colleagues and real transactions, and strike at moments of maximum pressure — a house purchase, a tax deadline, a CEO’s holiday. The Europol Internet Organised Crime Threat Assessment has tracked how these groups now run like businesses, with help desks, shift patterns and money-mule networks to move stolen funds before banks can freeze them.
Artificial intelligence has removed the last reliable tell. Grammar errors were once the giveaway; now generative tools produce perfect local idiom in any language, clone a manager’s voice from seconds of audio, and translate a scam script for a dozen markets overnight.
The defence that still works
The Federal Trade Commission’s consumer advice has barely changed, because the fundamentals still hold: slow down, verify through a separate channel, and never let a message supply the phone number or link you use to check it. A bank that “urgently” needs your password by email is not your bank. A finance director who emails new account details should expect a callback — and welcome it.
Technical defences matter too. Passkeys and hardware security keys defeat cloned login pages in a way passwords and texted codes cannot, because the credential simply will not work on the wrong website. We track enforcement actions and the biggest takedowns in our Crime reporting and across the wider News desk.
Why it keeps working
Phishing survives because it attacks people, not systems — urgency, politeness and fear of getting in trouble are features of every workplace. The scam has grown up, but its target is unchanged: the three seconds between reading a message and deciding whether to trust it. Defending those three seconds is now a core life skill.
The economics explain the evolution. A successful mass campaign needs only a handful of believers per hundred thousand messages to profit, and stolen credentials sell onward into a supply chain — access brokers, cash-out crews, laundering networks — that insulates the original sender. Law enforcement has scored real victories, dismantling phishing-as-a-service platforms used by thousands of criminals, yet the kits regenerate under new names within weeks. It is an industry with low barriers, global reach and customers who never meet.
Workplaces are adapting their culture as much as their software. The old advice — spot the suspicious email — is giving way to a norm in which any unusual request for money, credentials or secrecy is verified out loud, whatever the sender’s rank. Companies that rehearse this, with simulated phishing and no-blame reporting, measurably cut their click rates. The technology of the scam will keep improving. The countermeasure remains a pause, a second channel, and a workplace where asking “is this really you?” is professionalism, not paranoia.
