A Single Email Cost This Company $100 Million

In 2019, Toyota Boshoku Corporation — a major Toyota parts supplier — lost $37 million after employees wired funds to accounts controlled by attackers who impersonated a business partner via email. Facebook and Google collectively lost over $100 million to a Lithuanian man who sent fraudulent invoices disguised as messages from a real vendor. These weren't sophisticated zero-day exploits. They were phishing attacks. Plain and simple.

So what is a phishing attack, exactly? It's a social engineering technique where a threat actor sends a deceptive message — usually an email — designed to trick you into revealing sensitive information, clicking a malicious link, or transferring money. It remains the single most common initial attack vector in data breaches worldwide. If you work in cybersecurity, IT, or run any kind of business, understanding phishing isn't optional — it's survival.

What Is a Phishing Attack in Technical Terms?

A phishing attack is a form of social engineering that exploits human trust rather than technical vulnerabilities. The attacker crafts a message that appears to come from a legitimate source — a bank, a coworker, a SaaS vendor, even the IRS — and manipulates the recipient into taking a specific action.

That action usually falls into one of three categories:

  • Credential theft: You click a link to a fake login page and enter your username and password. The attacker now owns your account.
  • Malware delivery: You open an attachment or click a link that installs ransomware, a keylogger, or a remote access trojan on your device.
  • Financial fraud: You're tricked into wiring money, purchasing gift cards, or changing payment details for a vendor — exactly what happened to Toyota Boshoku.

According to the Verizon 2024 Data Breach Investigations Report, phishing was involved in 15% of all breaches, and it was the top initial access method alongside stolen credentials. In the FBI's IC3 2023 Internet Crime Report, phishing and its variants were the most reported cybercrime type, with nearly 300,000 complaints filed in a single year.

The 6 Types of Phishing You'll Actually Encounter

Not all phishing looks the same. Here are the variants I see most often in real-world incidents.

1. Email Phishing (Bulk Campaigns)

The classic. A threat actor sends thousands or millions of emails impersonating a trusted brand — Microsoft 365, Amazon, DocuSign. The goal is volume: even a 1% click rate on a million emails yields 10,000 victims. These emails often contain urgent language like "Your account has been suspended" or "Unusual sign-in activity detected."

2. Spear Phishing

This is targeted phishing aimed at a specific person or organization. The attacker researches you on LinkedIn, reads your company blog, and crafts a message that references real projects, real colleagues, or real events. It's dramatically more effective than bulk phishing because it feels personal and relevant.

3. Business Email Compromise (BEC)

BEC is spear phishing's most expensive cousin. The attacker either compromises or impersonates an executive's email account and requests wire transfers, W-2 forms, or sensitive data. The FBI IC3 report consistently ranks BEC as the costliest cybercrime category — losses exceeded $2.9 billion in 2023 alone.

4. Smishing (SMS Phishing)

Phishing via text message. You've probably received one: "USPS: Your package cannot be delivered. Update your address here." These exploit the fact that people trust text messages more than email and often tap links without thinking.

5. Vishing (Voice Phishing)

Phone-based phishing. An attacker calls pretending to be your bank's fraud department or an IT help desk technician. They pressure you into revealing one-time passwords, account numbers, or remote access credentials. With AI-generated voice cloning now widely accessible, vishing is getting harder to detect.

6. Quishing (QR Code Phishing)

A newer technique gaining traction in 2025 and 2026. Attackers place malicious QR codes on parking meters, restaurant menus, fake flyers, or even embed them in emails. Scanning the code takes you to a credential-harvesting page. It bypasses traditional email security filters entirely because the malicious URL is hidden in an image.

How to Spot a Phishing Attack: 7 Red Flags

I've reviewed thousands of phishing emails across incident response engagements. These are the indicators I tell every team to watch for:

  • Urgency or threats: "Act within 24 hours or your account will be closed."
  • Mismatched sender addresses: The display name says "Microsoft Support" but the email comes from [email protected].
  • Generic greetings: "Dear Customer" or "Dear User" instead of your actual name.
  • Suspicious links: Hover before you click. If the URL doesn't match the supposed sender's domain, it's a trap.
  • Unexpected attachments: Especially .zip, .html, .iso, or macro-enabled Office files.
  • Requests for credentials or payment: No legitimate company asks for your password via email. Period.
  • Too-good-to-be-true offers: "You've won a $500 gift card" — no, you haven't.

Training your employees to recognize these patterns is the single highest-ROI security investment most organizations can make. Our cybersecurity awareness training program walks teams through real-world phishing examples and teaches them to spot these red flags in seconds.

Why Phishing Works: The Psychology Behind the Click

Phishing doesn't succeed because people are stupid. It succeeds because threat actors are skilled at exploiting hardwired psychological triggers.

Authority: An email from your CEO asking for something urgent is hard to ignore. Fear: "Your account has been compromised" triggers fight-or-flight — and most people fight by clicking the link. Curiosity: "See who viewed your profile" is irresistible to many people. Time pressure: Deadlines short-circuit critical thinking.

Understanding these psychological levers is essential for building effective security awareness programs. When your employees understand why they're vulnerable, they become far better at catching themselves before they click.

What Happens After a Successful Phishing Attack?

Here's what actually happens in most cases I've investigated:

Stage 1 — Credential harvest: The victim enters their credentials on a fake login page. The attacker now has access.

Stage 2 — Account takeover: The attacker logs in, often within minutes. If multi-factor authentication isn't enabled, there's zero friction.

Stage 3 — Lateral movement: Using the compromised account, the attacker accesses shared drives, email threads, and internal systems. They may escalate privileges or move to more valuable targets.

Stage 4 — Exfiltration or deployment: Depending on the goal, the attacker steals data, deploys ransomware, sets up email forwarding rules for BEC, or establishes persistence for long-term access.

The average time from initial phishing email to full data breach? According to IBM's Cost of a Data Breach Report, breaches that started with phishing took an average of 261 days to identify and contain — and cost organizations an average of $4.88 million.

How to Defend Your Organization Against Phishing

No single tool stops phishing. You need layered defenses — a zero trust mindset applied to every message, every link, and every request.

Technical Controls

  • Email filtering and sandboxing: Block known malicious senders, scan attachments in isolated environments, and flag external emails.
  • Multi-factor authentication (MFA): Even if credentials are stolen, MFA adds a critical barrier. Use phishing-resistant MFA like FIDO2/WebAuthn where possible.
  • DNS filtering: Block access to known phishing domains at the network level.
  • DMARC, DKIM, and SPF: These email authentication protocols make it harder for attackers to spoof your domain. CISA provides excellent guidance on implementation at cisa.gov.

Human Controls

  • Phishing simulations: Regular, realistic phishing simulation campaigns are the most effective way to build muscle memory. Our phishing awareness training for organizations provides simulation tools and reporting that show exactly where your team's vulnerabilities are.
  • Reporting culture: Make it easy and safe for employees to report suspicious messages. A "Report Phish" button in the email client removes friction and builds a human sensor network.
  • Ongoing training: Annual compliance training isn't enough. Short, frequent training — monthly or quarterly — keeps awareness sharp.

Process Controls

  • Verification procedures: Any request to change payment details or wire funds must be verified through a separate channel — a phone call to a known number, not a reply to the email.
  • Least privilege access: Limit what any single compromised account can reach. Zero trust architecture assumes breach and verifies continuously.

The Bottom Line: Phishing Is a People Problem That Needs People Solutions

Technology catches a lot of phishing. But the attacks that get through — the ones that cause real damage — are the ones that exploit human judgment. Every data breach investigation I've been part of that started with phishing had the same root cause: someone made a split-second decision without the training to pause and verify.

You can't patch humans like you patch software. But you can train them. You can run phishing simulations that build reflexes. You can create a culture where reporting a suspicious email is rewarded, not punished.

That's where the real defense starts. Invest in your people, because your threat actors already are.