Phishing & Social Engineering Guide (2026)
Phishing is the #1 attack vector for breaches. As a remote worker, you're an especially attractive target. Learn to recognize and avoid these attacks.
7 Red Flags of a Phishing Attempt
Urgency or fear
Example: "Your account will be suspended in 24 hours!"
Legitimate companies rarely impose tight deadlines via email.
Unexpected sender
Example: Email from IT department you didn't expect
Verify through a separate channel (Slack, phone) before clicking.
Mismatched URLs
Example: Link text says 'google.com' but URL is 'g00gle-login.com'
Hover over links to see the real destination before clicking.
Generic greeting
Example: "Dear Customer" instead of your name
Legitimate services typically address you by name.
Requests for credentials
Example: "Please verify your password by clicking here"
No legitimate service asks for your password via email.
Attachments from unknown senders
Example: "Invoice attached" from unknown company
Don't open unexpected attachments. Verify with the sender first.
Too good to be true
Example: "You've won a $1,000 gift card!"
If you didn't enter a contest, you didn't win.
Types of Phishing Attacks
Email Phishing
Mass emails impersonating trusted brands. Most common form. Usually detectable by red flags above.
Spear Phishing
Targeted at specific individuals using personal information. Much harder to detect. Common in business contexts.
Smishing (SMS)
Phishing via text message. Often impersonates banks, delivery services, or government agencies.
Vishing (Voice)
Phone-based social engineering. Attacker calls impersonating tech support, your bank, or a colleague.
Business Email Compromise
Attacker compromises or impersonates an executive's email to request wire transfers or sensitive data.
Clone Phishing
Attacker copies a legitimate email you previously received and replaces links/attachments with malicious ones.
Prevention Checklist
- 1. Enable 2FA on all accounts (authenticator app, not SMS)
- 2. Use a password manager so you never type passwords on fake sites
- 3. Verify unexpected requests through a separate communication channel
- 4. Hover over links before clicking to check the real URL
- 5. Keep your browser and OS updated for latest phishing protections
- 6. Use a VPN with threat protection features (blocks known phishing domains)
- 7. Report phishing emails to your IT department and the impersonated brand
- 8. Never share passwords, 2FA codes, or recovery keys via email or chat