0–9BACK TO A–Z ↑
7726
7726 is the free UK short code you forward suspicious text messages to, so your mobile network can investigate the sender. It spells SPAM on an old phone keypad and works on the main UK networks. Forwarding the text reports it; it doesn't reply to the scammer.
GOV.UK: report suspicious emails, texts and websites →ABACK TO A–Z ↑
Account takeover
Account takeover is when a criminal gains control of someone's real account, such as their email, banking or cloud storage, and uses it as if they were them. A taken-over work mailbox is especially useful to attackers, because messages sent from it are trusted by colleagues, customers and suppliers.
Watch for: new inbox rules you didn't create, sent emails you don't recognise, and sign-in alerts from unusual places.
Clicked a phishing link? What to do next →Adversary-in-the-middle (AiTM) phishing
Adversary-in-the-middle phishing is a fake login page that secretly relays everything you type to the real site, so the attacker captures your password, your one-time code and the signed-in session at the same time. Because the real site is behind it, the page looks and behaves normally. It can defeat text-message codes and authenticator-app codes, but not passkeys or security keys, which check the real web address.
Watch for: a login page reached from a link in an email, especially when the address bar shows a domain you don't recognise.
What to do if you've entered your password →Authenticator app
An authenticator app is a phone app that generates short-lived sign-in codes, or shows approve and deny prompts, as a second step after your password. It is stronger than codes sent by text message because it can't be redirected by a SIM swap. Never read an authenticator code out to someone who calls or messages you.
BBACK TO A–Z ↑
Business email compromise (BEC)
Business email compromise is a scam in which a criminal uses a hijacked or lookalike business email account to pose as someone you trust, usually to redirect a payment or obtain sensitive data. BEC emails often contain no link or attachment at all, just a believable request, so they slip past filters that look for malicious content.
Watch for: changed bank details, unusual urgency, and requests to keep something quiet.
Business email compromise: a guide for small businesses →CBACK TO A–Z ↑
Callback phishing
Callback phishing is an email or text that persuades you to phone the attacker, usually about a fake invoice, subscription renewal or refund. On the call, the "support agent" talks you into installing remote-access software, sharing a code or making a payment. Moving to a phone call means there is no malicious link for email filters to catch.
Watch for: an unexpected charge with a phone number to "cancel" it. Look up the company's number yourself instead.
CEO fraud
CEO fraud is a scam in which a criminal pretends to be a senior leader and asks a member of staff to make an urgent payment, buy gift cards or send sensitive information. It is a form of business email compromise, and increasingly arrives as a voice note or call using a cloned voice.
Watch for: a senior person who is "in a meeting", can't talk, and needs something done quickly and quietly.
Voice clones and deepfake CEO fraud →Click rate
Click rate is the percentage of people who clicked the link in a phishing simulation. It is useful for spotting which lures catch people out, but it varies with how hard each test is, so it works best alongside report rate rather than as a target on its own.
What to measure in a phishing simulation →Clone phishing
Clone phishing is when an attacker copies a genuine email you have already received and resends it with the link or attachment swapped for a malicious one. Because you recognise the message, you are less likely to look closely.
Watch for: "resending" or "updated link" versions of emails you have already dealt with.
Types of phishing explained →Credential harvesting
Credential harvesting is collecting people's usernames and passwords, usually through fake login pages linked from phishing emails. Stolen work passwords are then used to read email, send further phishing from a trusted account, or sold on to other criminals.
Watch for: any login page you reached from a link rather than by typing the address or using a bookmark.
Entered your password on a fake page? Start here →Cyber Essentials
Cyber Essentials is a UK government-backed certification scheme that shows an organisation has five basic technical security controls in place. The controls are firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials Plus adds independent technical testing. Staff awareness training is not one of the five controls, though it supports several of them.
Cyber Essentials and staff training →DBACK TO A–Z ↑
Deepfake
A deepfake is audio, video or an image created or altered with AI to make it look or sound like a real person said or did something they didn't. In business scams, deepfakes are used to impersonate leaders, suppliers or colleagues on calls and voice notes to approve payments or requests.
Watch for: a familiar voice or face making an unusual request, especially about money, codes or secrecy. Verify on a number you already have.
Voice clones and deepfake CEO fraud →Display-name spoofing
Display-name spoofing is when an email shows a trusted person's name, such as your managing director's, while the actual sending address belongs to someone else. Many email apps, especially on phones, show only the display name, so the real address is easy to miss.
Watch for: a familiar name with a personal webmail address or an unfamiliar domain behind it.
DKIM
DKIM (DomainKeys Identified Mail) is an email authentication method that adds a digital signature to outgoing messages so receiving servers can check they really came from the sender's domain and weren't altered in transit. The public key used to check the signature is published in the domain's DNS records.
DMARC
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receiving mail servers what to do with email that claims to come from your domain but fails SPF or DKIM checks. The policy can be to monitor (none), send to spam (quarantine) or block (reject), and DMARC reports show you who is sending email using your domain. It stops exact spoofing of your domain but not lookalike domains.
Domain spoofing
Domain spoofing is forging an email so it appears to come from a real organisation's exact domain, such as an address at your own company. SPF, DKIM and DMARC make exact spoofing much harder, which is why attackers often switch to lookalike domains instead.
GBACK TO A–Z ↑
Gift card scam
A gift card scam is a request, usually from someone pretending to be a boss or colleague, to buy gift cards and send them the codes. Gift card codes are as good as cash and almost impossible to trace or recover, which is why scammers ask for them. No genuine employer or organisation asks for payment in gift card codes.
Watch for: "I need a favour, can you pick up some gift cards for a client? I'll pay you back."
Common lures and their red flags →HBACK TO A–Z ↑
Homograph attack
A homograph attack uses characters from other alphabets that look identical to normal letters to build a web address that appears genuine. For example, a Cyrillic "а" looks the same as a Latin "a" on screen, so two addresses can look identical but lead to different sites. Using bookmarks and a password manager helps, because neither will be fooled.
Human risk score
A human risk score is a measure of how likely a person or team is to fall for a social engineering attack, based on how they behave in training and simulations. Typical inputs are assessment results, simulation clicks and how often someone reports suspicious messages. Used well, it shows where to focus training rather than who to blame.
How Lureproof reports human risk →IBACK TO A–Z ↑
Invoice fraud
Invoice fraud is a scam in which criminals send a fake invoice, or alter a real one, so that a business pays money into the criminals' bank account. It often follows a compromised supplier mailbox, so the email can come from a genuine address and refer to real orders.
Watch for: an email saying a supplier has "changed banks". Always confirm new bank details by phone, using a number you already have.
Invoice fraud and payment diversion →LBACK TO A–Z ↑
Lookalike domain
A lookalike domain is a web or email domain registered to closely resemble a real one, such as hartley-supp1ies.example instead of hartley-supplies.example. Tricks include swapped or doubled letters, extra words like "-secure" or "-invoices", different endings (.co instead of .co.uk) and characters from other alphabets.
Watch for: read the domain from right to left: the part just before the ending (.com, .co.uk) is who really owns it.
Red flags that still work in the AI era →MBACK TO A–Z ↑
Malware
Malware is any software designed to harm a device or its user, such as by stealing data, spying on activity or locking files. Viruses, spyware, keyloggers and ransomware are all types of malware. It often arrives through email attachments, fake downloads or links to compromised websites.
Watch for: unexpected attachments, files that ask you to "enable content" or "enable editing", and download prompts from sites you didn't mean to visit.
MFA (multi-factor authentication)
Multi-factor authentication (MFA) is a sign-in process that needs two or more different types of proof, such as your password plus a code, an app approval or a fingerprint. Two-factor authentication (2FA) is MFA with exactly two steps. It blocks most attacks that rely on a stolen password, but codes and approvals can still be phished, so never share them.
MFA fatigue
MFA fatigue is an attack in which someone who already has your password triggers sign-in approval requests over and over, hoping you tap Approve to make them stop. It is also called push bombing or MFA bombing, and attackers sometimes add a call or message pretending to be IT support. Number matching, where you type a number shown on the login screen, makes it much harder.
Watch for: approval prompts you didn't trigger. Deny them, change your password and tell IT.
NBACK TO A–Z ↑
NCSC (National Cyber Security Centre)
The National Cyber Security Centre (NCSC) is the UK's technical authority for cyber security and part of GCHQ. It publishes free guidance for individuals and small organisations, runs the Suspicious Email Reporting Service and oversees the Cyber Essentials scheme.
NCSC: Cyber Essentials overview →OBACK TO A–Z ↑
OAuth consent phishing
OAuth consent phishing tricks you into granting a malicious app permission to access your account, using the genuine "allow access" screen of your email or cloud provider. No password is stolen, so changing it doesn't remove the access. The app has to be revoked in your account's connected apps or by an admin.
Watch for: an unfamiliar app asking to "read, send and delete" your email or "access your files".
PBACK TO A–Z ↑
Passkey
A passkey is a password replacement that signs you in using a cryptographic key stored on your device, unlocked with your fingerprint, face or device PIN. Passkeys only work on the real website they were created for, so a fake login page can't capture or use them. That makes them one of the strongest defences against phishing.
Password manager
A password manager is an app that creates, stores and fills in strong, unique passwords for each of your accounts. It also helps against phishing: it fills in a password only on the exact site it was saved for, so if it doesn't offer to fill on a login page, check the address carefully.
Payment diversion
Payment diversion is a fraud in which criminals persuade a business or person to send a legitimate payment to a different bank account that the criminals control. It is the end goal of most invoice fraud and business email compromise, and it is common in property purchases, building work and supplier payments.
Watch for: any change to bank details sent by email, however genuine the sender looks.
How to stop payment diversion →Phishing
Phishing is a fraudulent message, usually an email, that tries to trick people into clicking a link, opening an attachment, sharing details or making a payment. It is the umbrella term for scams that use messages to manipulate people, including spear phishing, smishing, vishing and quishing.
Watch for: urgency, an unexpected request, a sender address that doesn't match, and links that go somewhere other than they claim.
Types of phishing explained →Phishing simulation
A phishing simulation is a safe, realistic practice phishing email sent to staff by their own organisation to teach them to recognise and report real scams. Anyone who clicks sees a short explanation of the red flags instead of a real attack. Good simulations are fair, never used for discipline and measured by how many people report, not just who clicks.
Phishing simulation for small businesses →Pretexting
Pretexting is a social engineering technique in which an attacker invents a believable story, or pretext, to persuade someone to share information or take an action. Common pretexts are a new supplier contact, an auditor, IT support or a senior colleague who is travelling. The story often builds over several messages or calls before the real request arrives.
Watch for: a plausible stranger whose story explains away every check you try to make.
Free security awareness training →QBACK TO A–Z ↑
Quishing
Quishing is phishing that hides a malicious link inside a QR code. The code hides where the link goes, and scanning it moves you to your phone, away from your work computer's protections. QR codes appear in emails, PDFs, letters and stickers placed over genuine codes on parking meters or posters.
Watch for: QR codes in emails asking you to sign in, re-verify an account or pay.
How quishing works and how to spot it →RBACK TO A–Z ↑
Ransomware
Ransomware is malware that encrypts an organisation's files or systems and demands payment to unlock them. Many ransomware gangs also steal data first and threaten to publish it. Phishing emails and stolen passwords are common ways in, which is why offline backups and quick reporting matter.
Red flag
A red flag is a warning sign in a message or call that suggests it might be a scam. Common red flags are urgency, secrecy, an unexpected request for money, codes or logins, a sender address that doesn't match the name, and a link or QR code that goes somewhere unexpected. One red flag is reason enough to verify before acting.
Common lures and their red flags →Report rate
Report rate is the percentage of people who reported a phishing simulation, or a real suspicious message, using the organisation's report button or address. It is often a better measure of a security culture than click rate, because early reports let IT warn everyone and stop a real attack spreading.
What to measure in a phishing simulation →SBACK TO A–Z ↑
Security awareness training
Security awareness training is training that teaches staff to recognise and respond to cyber threats such as phishing, scams and social engineering. Short, regular, hands-on practice tends to build habits better than a long annual course.
Security awareness training for small businesses →SERS (Suspicious Email Reporting Service)
The Suspicious Email Reporting Service (SERS) is the NCSC's free service for reporting scam emails in the UK: you forward the email to report@phishing.gov.uk. The NCSC investigates reported emails and can take down the scam websites they link to. Reporting doesn't replace telling your own IT team.
How to report a phishing email →Session hijacking (token theft)
Session hijacking is when an attacker steals the token or cookie that keeps you signed in to a website, letting them use your account without needing your password or MFA. Tokens are stolen through adversary-in-the-middle phishing pages or malware on a device. Signing out of all sessions and resetting the password cuts the attacker off.
Clicked a phishing link? What to do next →SIM swap
A SIM swap is a fraud in which a criminal persuades a mobile network to move your phone number onto a SIM card they control. They then receive your calls and texts, including sign-in and banking codes. Sudden loss of mobile signal for no clear reason can be a warning sign.
Smishing
Smishing is phishing by text message or messaging app. Phones show less of the sender and the link, and people tend to act on texts quickly. In the UK you can forward suspicious texts to 7726 for free.
Watch for: parcel redelivery fees, bank "security alerts" and messages from a "new number" claiming to be a family member.
Types of phishing explained →Spear phishing
Spear phishing is phishing aimed at a specific person or small group, using details about them to make the message believable. Attackers find names, roles, suppliers and projects on company websites and social media. AI has made writing personal messages at scale much cheaper.
Spear phishing vs phishing →SPF
SPF (Sender Policy Framework) is a DNS record that lists which mail servers are allowed to send email for a domain. Receiving servers check it to help spot forged senders. On its own it doesn't stop display-name spoofing or lookalike domains, so it works best together with DKIM and DMARC.
TBACK TO A–Z ↑
Tech support scam
A tech support scam is a fake warning, pop-up or phone call claiming your computer has a problem, designed to get you to give a "technician" remote access or pay for a bogus fix. Genuine software companies don't cold-call to say your device is infected.
Watch for: pop-ups with a phone number to call, and callers asking you to install remote-access software.
Typosquatting
Typosquatting is registering domain names that are common misspellings of real ones, to catch people who mistype an address or don't read it closely. Typosquatted domains are used for fake login pages, malware downloads and lookalike email addresses.
VBACK TO A–Z ↑
Vishing
Vishing is phishing by phone call or voicemail, where the attacker talks you into sharing information, a code or a payment. Callers often pose as a bank's fraud team, IT support or a supplier, and AI voice cloning means they can now sound like someone you know.
Watch for: a caller who asks for a code, a password or a payment. Hang up and call back on a number you already have.
Types of phishing explained →Voice cloning
Voice cloning is using AI to copy a real person's voice from a short recording so it can say anything the attacker types. Clips from videos, podcasts or voicemail greetings can be enough. Scammers use cloned voices in calls and voice notes to impersonate bosses, colleagues and family members.
Watch for: a familiar voice with an urgent, unusual request. Agree a verification question or call back on a known number.
Voice clones and deepfake CEO fraud →WBACK TO A–Z ↑
Whaling
Whaling is spear phishing aimed at senior people, such as owners, directors or finance leads, who can approve payments or reach sensitive information. Whaling emails often pose as legal notices, regulators, board matters or confidential deals.
Types of phishing explained →
Social engineering
Social engineering is manipulating people into giving away information, access or money, rather than hacking computers directly. It works by exploiting trust, helpfulness, fear and urgency. Phishing, pretexting, vishing and tailgating into a building are all forms of social engineering.
Watch for: pressure to act now, flattery, appeals to authority, and requests to skip a normal process.
Free security awareness training →