🔍 General Questions

1. What is phishing?

Phishing is a type of cyber attack where criminals impersonate a trusted entity (e.g., a bank, HMRC, or a colleague) to trick victims into revealing sensitive information (e.g., passwords, bank details) or downloading malware. (Source: NCSC – Phishing Guidance)

2. What is social engineering?

Social engineering is a broader term that includes phishing but also in-person manipulation, pretexting (fabricating a scenario to gain trust), baiting (e.g., malicious USB drops), and tailgating (unauthorised physical access). It exploits human psychology rather than technical vulnerabilities. (Source: MITRE – Social Engineering)

🎣 Phishing-Specific Questions

3. How can I spot a phishing email?

Look for these red flags:

✅ Suspicious sender address (e.g., [email protected] instead of @amazon.co.uk).

✅ Generic greetings (e.g., “Dear Valued Customer” instead of your name).

✅ Urgency or threats (e.g., “Your account will be closed in 24 hours!”).

✅ Mismatched links (hover over links to check the real URL).

✅ Poor spelling/grammar (though AI-generated emails may be flawless).

✅ Unexpected attachments (e.g., invoices from unknown suppliers). (Source: NCSC – How to Recognise Phishing)

4. What is smishing?

Smishing (SMS phishing) is a phishing attack conducted via text message. Examples include:

• Fake “Royal Mail parcel delay” messages.
• “HMRC tax refund” scams.
• Bank alerts asking you to “verify” your account. (Source: Ofcom – Smishing Scams Report 2025)

5. What is vishing?

Vishing (voice phishing) is a scam conducted over the phone. Attackers may:

• Impersonate your bank and ask for your PIN or online banking password.
• Use AI voice cloning to mimic a family member or colleague in distress.
• Claim to be from HMRC and demand immediate payment for “unpaid taxes.” (Source: Which? – How to Spot a Scam Call)

6. What is a zero-click phishing attack?

A zero-click attack is a type of phishing that does not require the victim to click on a link or download an attachment. Instead, it exploits vulnerabilities in email clients or operating systems to automatically execute malicious code when the email is opened or even just previewed. (Source: NCSC – Zero-Click Attacks)

7. What is Business Email Compromise (BEC)?

BEC (or CEO fraud) is a sophisticated phishing attack where criminals impersonate a senior executive (e.g., CEO, CFO) to trick employees into transferring money or sharing sensitive data.

• Example: An email from the “CEO” asking the finance team to urgently transfer £50,000 to a new supplier.
• Impact: UK businesses lost £50,000 on average per BEC attack in 2025 (Action Fraud, 2026).

8. What is a deepfake phishing attack?

A deepfake phishing attack uses AI-generated audio or video to impersonate a trusted individual (e.g., a CEO, colleague, or family member). These attacks are highly convincing and often used in:

• Vishing calls (e.g., a fake “grandchild” asking for emergency money).
• Video conferences (e.g., a deepfake “CEO” requesting confidential data). (Source: World Economic Forum – Deepfake Threats 2026)

📊 UK-Specific Questions

💡 Technical & Advanced Questions

23. What is DMARC, and how does it help prevent phishing?

DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email security protocol that:

• Prevents email spoofing (e.g., fake emails from [email protected]).
• Tells receiving servers what to do with emails that fail authentication (e.g., reject, quarantine, or allow).
• Provides reports on who is sending emails on your behalf.

Why it matters:

• Stops attackers from impersonating your domain in phishing emails.
• Required by UK GDPR

24. How can I check if a website is legitimate before entering my details?

Follow these steps to verify a website’s authenticity:

✅ Check the URL:

• Look for HTTPS (not HTTP) and a padlock icon in the address bar.
• Misspellings (e.g., amaz0n.co.uk instead of amazon.co.uk) are red flags.
• Use Google’s Safe Browsing Tool (transparencyreport.google.com/safe-browsing/search) to check if the site is flagged as malicious.

✅ Look for trust signals:

• Legitimate contact information (e.g., a real UK address, phone number).
• Customer reviews (check Trustpilot or Google Reviews for complaints).
• Payment methods (scam sites often only accept cryptocurrency or bank transfers).

✅ Use verification tools:

• VirusTotal – Scans URLs for malware.
• Who.is – Checks domain registration details (e.g., how long it’s been active).
• Get Safe Online’s Website Checker.

✅ Avoid logging in via links:

• Manually type the URL of the real website (e.g., barclays.co.uk) instead of clicking a link in an email.

(Source: NCSC – Report a Fake Website)

25. What is a phishing simulation, and why should businesses use it?

A phishing simulation is a controlled test where businesses send fake phishing emails to employees to:

✅ Measure vulnerability (e.g., how many employees click on malicious links).

✅ Train staff to recognise and report phishing attempts.

✅ Improve security awareness through real-world examples.

Why it’s essential:

• UK businesses that run simulations reduce click rates by 50–70% (KnowBe4, 2026).
• Compliance: Some industries (e.g., finance, healthcare) require regular testing under UK GDPR and cybersecurity regulations.
• Cost-effective: Prevents real breaches, which cost UK SMEs £50,000+ on average (IBM Cost of a Data Breach Report 2026).

How to get started:

• Use free tools like NCSC’s Phishing Test or paid platforms (e.g., KnowBe4, Proofpoint, Mimecast).

(Source: NCSC – Phishing Simulations)

🚨 Incident Response Questions

26. What should a business do immediately after a phishing attack?

Step-by-step incident response plan:

1. Isolate affected systems:
   • Disconnect compromised devices from the network.
   • Reset passwords for all affected accounts.
2. Contain the breach:
   • Block malicious IPs/domains at the firewall.
   • Revoke access for compromised credentials.
3. Assess the damage:
   • Identify what data was accessed/stolen (e.g., customer records, financial data).
   • Check for malware (run scans on all devices).
4. Report the incident:
   • Internal: Notify IT, legal, and PR teams.
   • External:
     • ICO (if personal data is breached) – within 72 hours (ICO Breach Reporting).
     • Action Fraud (www.actionfraud.police.uk) for cybercrime.
     • NCSC (for severe attacks) via ncsc.gov.uk/report.
5. Communicate:
   • Inform affected individuals (if their data was exposed).
   • Be transparent (e.g., public statement if necessary).
6. Recover & Improve:
   • Restore from backups (ensure they’re clean and recent).
   • Patch vulnerabilities that allowed the attack.
   • Conduct a post-incident review to prevent future attacks.

(Source: NCSC – Incident Management Guidance)

27. How can I tell if my computer has malware from a phishing attack?

Signs of malware infection:

🚨 Slow performance (e.g., frequent crashes, high CPU usage).

🚨 Unusual pop-ups or ads (even on trusted sites).

🚨 Unexpected toolbars or browser extensions.

🚨 Files or programs you don’t recognise (check Task Manager or Activity Monitor).

🚨 Unauthorised access (e.g., your webcam/microphone turning on unexpectedly).

🚨 Ransomware messages (e.g., “Your files are encrypted. Pay £X to unlock.”).

What to do:

1. Disconnect from the internet (to prevent malware from spreading).
2. Run a full scan with trusted antivirus software (e.g., Windows Defender, Malwarebytes, Bitdefender).
3. Check for suspicious processes in Task Manager (Windows) or Activity Monitor (Mac).
4. Restore from a clean backup if malware is detected.
5. Reset passwords for all accounts accessed on the infected device.

(Source: NCSC – Malware Guidance)

28. What is ransomware, and how is it related to phishing?

Ransomware is a type of malware that encrypts your files and demands a ransom payment (usually in cryptocurrency) to restore access.

How phishing leads to ransomware:

• Attackers send a phishing email with a malicious attachment (e.g., a fake invoice) or a link to a compromised website.
• If the victim opens the attachment or clicks the link, the ransomware downloads and encrypts files.
• UK Example: “The death of one person has been linked to a ransomware attack on NHS blood services at London hospitals and GP surgeries last June (BBC News, 2025).

What to do if hit by ransomware:

❌ Do NOT pay the ransom (the NCSC advises against it—NCSC Ransomware Guidance).

✅ Isolate the infected device (disconnect from the network).

✅ Report to Action Fraud and the NCSC.

✅ Restore from backups (if available).

(Source: NCSC – Ransomware Guidance)

📱 Mobile & Social Media Questions

29. How can I stay safe from phishing on my phone?

Mobile phishing (smishing, vishing, app scams) is rising. Protect yourself by:

✅ Never clicking links in texts/emails from unknown senders.

✅ Downloading apps only from official stores (Google Play, Apple App Store).

✅ Checking app permissions (e.g., why does a flashlight app need access to your contacts?).

✅ Using a mobile security app (e.g., Bitdefender, Norton, or Malwarebytes).

✅ Enabling MFA for mobile banking and email accounts.

✅ Reporting scam texts to 7726 (free UK service).

(Source: Ofcom – Mobile Scams Report 2025)

30. How do scammers use social media for phishing?

Common social media phishing tactics: 🎣 Fake job offers (e.g., “Work from home, £500/day!” – leads to a fake login page).

🎣 Impersonation of friends/family (e.g., a hacked Facebook account asking for “emergency money”).

🎣 Fake giveaways or competitions (e.g., “Click here to claim your free iPhone!”).

🎣 Romance scams (e.g., “Pig butchering” – building trust before asking for investments).

🎣 Fake customer support accounts (e.g., a Twitter account posing as “Barclays Help” to steal login details).

How to stay safe:

✅ Verify accounts (look for blue ticks on Twitter/Instagram, but be cautious—these can be faked).

✅ Never share personal details in DMs or public posts.

✅ Use strong, unique passwords for social media accounts.

✅ Enable MFA on all social platforms.

✅ Report fake accounts to the platform (e.g., Facebook’s Report a Fake Account).

(Source: Action Fraud – News)

💰 Financial & Legal Questions

31. Can I get my money back if I fall for a phishing scam?

It depends on the situation:

✅ Bank transfer scams (e.g., fake invoice, CEO fraud):

• Report to your bank immediately (some offer chargeback for fraudulent transactions).
• UK banks may refund you if you didn’t authorise the payment (under the Payment Services Regulations 2017).
• If you authorised the transfer, recovery is less likely, but some banks may still help.

✅ Credit/debit card fraud:

• You’re legally protected under Section 75 of the Consumer Credit Act (for credit cards) or chargeback rights(for debit cards).
• Act fast: Report within 13 months (credit card) or 120 days (debit card).

✅ Cryptocurrency scams:

• Almost impossible to recover (transactions are irreversible).
• Report to Action Fraud (www.actionfraud.police.uk).

(Source: FCA – Protect yourself from scams)

32. What are my rights under UK GDPR if my data is stolen in a phishing attack?

Under UK GDPR and the Data Protection Act 2018, you have the right to:

✅ Be informed if your personal data is breached (organisations must notify you without undue delay).

✅ Access your data (via a Subject Access Request (SAR)).

✅ Request deletion or correction of your data if it’s inaccurate or no longer needed.

✅ Complain to the ICO if an organisation fails to protect your data (ICO Complaints).

✅ Claim compensation if you suffer damage (e.g., financial loss, distress) due to a breach.

(Source: ICO – Your Data Protection Rights)

33. Can a business be fined for falling for a phishing attack?

Yes. If a phishing attack leads to a data breach and the business failed to implement adequate security measures, the ICO can impose fines under UK GDPR:

• Up to £8.7 million or 4% of global turnover (whichever is higher) for serious violations (e.g., lack of MFA, no staff training).
• Example: In 2025, the ICO fined a UK retail chain £500,000 after a phishing attack exposed customer payment details due to poor email security (ICO, 2026).

(Source: ICO – Fines and Penalties)

👨‍💻 Technical Questions

34. How do attackers create fake login pages for phishing?

Attackers use phishing kits (pre-made templates) to create fake login pages that mimic real websites (e.g., Microsoft 365, PayPal). Common methods:

1. Domain spoofing (e.g., paypa1-login.com).
2. HTTPS spoofing (using free SSL certificates to add a padlock icon).
3. JavaScript-based forms that capture credentials and send them to the attacker.
4. Man-in-the-middle (MITM) attacks (intercepting data between the user and the real site).

How to spot a fake login page:

• Check the URL (hover over links to see the real destination).
• Look for poor design (e.g., blurry logos, misaligned text).
• Use a password manager (it will not autofill on fake sites).

(Source: Proofpoint – Phishing Awareness Kit)

35. What is credential stuffing, and how is it related to phishing?

Credential stuffing is when attackers use stolen username/password combinations (from past breaches) to gain access to other accounts where users have reused passwords.

How it connects to phishing:

• Phishing attacks harvest credentials (e.g., via fake login pages).
• Attackers then automate login attempts on other sites (e.g., banking, email, social media).
• UK Example: In 2025, a major UK bank reported that 30% of account takeovers were due to credential stuffing from previous phishing breaches (NCSC, 2026).

How to protect yourself:

✅ Use a password manager to generate and store unique passwords.

✅ Enable MFA on all accounts.

✅ Check if your credentials have been leaked on Have I Been Pwned.

(Source: NCSC – Credential Stuffing)

🔮 Future of Phishing

36. How will AI change phishing attacks in the future?

AI is supercharging phishing attacks in several ways:

🤖 Hyper-personalised emails (e.g., AI analyses your social media, emails, and online activity to craft tailored scams).

🎭 Deepfake voice/video (e.g., AI-generated calls from “your CEO” or “a family member” in distress).

📊 Automated social engineering (e.g., chatbots engaging victims in long-term conversations to build trust).

📧 Bypassing spam filters (e.g., AI-generated emails that mimic legitimate writing styles to evade detection).

UK Example: In 2026, a UK law firm lost £1.5 million after an employee was tricked by an AI-generated voice callfrom their “managing partner” (CrowdStrike, 2026).

How to defend against AI phishing:

✅ Assume no message is safe—verify every request (even if it seems legitimate).

✅ Use AI-powered email security (e.g., Darktrace, Abnormal Security) to detect anomalies.

✅ Train employees on AI threats (e.g., deepfake awareness).

(Source: World Economic Forum – AI and Cybersecurity 2026)

37. What is the future of phishing prevention?

Emerging technologies and strategies to combat phishing:

🛡️ AI-driven threat detection (e.g., machine learning to spot anomalies in email patterns).

🔑 Passwordless authentication (e.g., biometrics, hardware tokens) to eliminate credential-based attacks.

🌐 Block chain-based identity verification (e.g., decentralised digital identities to prevent spoofing).

📡 Zero Trust Architecture (e.g., continuous verification of users and devices).

🤖 Automated phishing response (e.g., AI that instantly blocks and reports phishing emails).

UK Example: The NCSC is testing AI tools to automatically detect and neutralise phishing campaigns before they reach users (NCSC, 2026).

(Source: Forrester – The Future of Cybersecurity 2026)

📌 Final Tips: Quick Checklist

For Individuals:

•  Verify before trusting (check URLs, sender addresses, and contact details).
•  Never share passwords or MFA codes (even with “IT support”).
•  Enable MFA on all accounts (use app-based or hardware tokens).
•  Use a password manager (e.g., Bitwarden, 1Password).
•  Report phishing emails to [email protected].
•  Monitor accounts for suspicious activity.

For Businesses:

•  Conduct regular phishing simulations (monthly is ideal).
•  Enforce MFA and Zero Trust across all systems.
•  Train employees on the latest threats (e.g., AI deepfakes, vishing).
•  Use email filtering and DNS protection (e.g., Microsoft Defender, CrowdStrike).
•  Backup data using the 3-2-1 rule.
•  Develop an incident response plan (use NCSC’s template).