Make It Harder to Fool You: Recognize Phishing and Scams

You’ve likely heard the classic advice for spotting a scam email: watch out for poor grammar, double-check suspicious sender addresses, and never click links promising free gift cards.

While those basics still hold true, phishing has moved far beyond the days of obvious typos and simple spam.

Today, threat actors leverage artificial intelligence, deepfakes, and sophisticated social engineering to craft hyper-realistic attacks. Rather than relying solely on malicious attachments, modern cybercriminals manipulate trusted workplace interactions — impersonating IT support, trusted vendors, or high-level executives via voice, video, and collaboration tools.

For IT organizations, the stakes are particularly high. A single compromised account or trusted system can potentially expose customer environments, sensitive data, and downstream organizations. In fact, according to Google’s M-Trends 2026 report, the high-tech sector accounted for 17% of Mandiant's incident response investigations in 2025, making it the most frequently targeted industry in its dataset. Voice phishing (vishing) also emerged as the second-most commonly observed initial infection vector, accounting for 11% of incidents where an initial entry method could be identified.

For Cybersecurity Awareness Month 2026, we're going beyond the traditional advice of spotting suspicious emails to explore how modern phishing works, where attackers are succeeding, and how organizations can make scams harder to pull off.

Phishing in the Modern Day

Phishing is no longer restricted to an email inbox. Attackers target every channel of modern communication and workflows that employees rely on to get their job done:

• Spearphishing: Highly targeted emails aimed at specific individuals or roles using researched personal details. Today, AI AI allows attackers to create polished, convincing emails that imitate familiar writing styles and reference real workplace activities.

• Whaling: Targeted attacks directed at C-level executives, high-net-worth individuals, or key decision makers. These are increasingly combined with voice cloning and deepfakes to impersonate executives on audio or video calls.

• Smishing (SMS): Phishing through text messages that use urgency or fear to prompt action. Common tactics include fake package delivery notifications, fraudulent bank alerts, MFA verification requests, and suspicious login warnings designed to trick recipients into clicking malicious links or sharing sensitive information..

• Vishing: Phone-based attacks designed to trick victims into giving up credentials or system access. Scammers frequently impersonate IT help desk personnel over the phone to convince employees to reset passwords or grant access.

The Fundamentals: Recognize, Verify, and Report 

While phishing techniques continue to evolve, the fundamentals of identifying and responding to suspicious activity remain an essential first line of defense. 

1. Question Urgent & Unexpected Requests Be suspicious of any message demanding immediate action — such as resetting credentials, approving login prompts, or transferring funds. Urgency is designed to bypass critical thinking and make you act first.
   

2. Verify Through a Trusted ChannelIf a request seems unusual, confirm it using a trusted, independent communication channel. Call the sender back using an internal company directory or a known phone number — never use the contact information or link provided in the suspicious message.
   

3. Upgrade to Phishing-Resistant MFA Transition away from SMS or simple push prompts toward hardware security keys (FIDO2) or passkeys. These authentication methods cannot be intercepted by simple reverse-proxy phishing sites or SMS interception.
   

4. Protect Help Desk and Account Recovery Workflows Implement strict identity verification protocols before resetting passwords or modifying MFA tokens for any employee. Never share passcodes, recovery codes, or login approvals with anyone claiming to be a member of a support team.
   

5. Report Suspicious Activity Immediately flag suspicious emails, calls, or prompts using your organization’s reporting tools – even if you accidentally clicked a link. Early notification gives security teams time to isolate potential threats and warn others.
   

Beyond the Fundamentals: Defending Against Modern Social Engineering

For IT and security teams, phishing defense requires more than filtering suspicious emails or conducting periodic awareness training. Attackers increasingly target interactions between people, identities, and trusted systems, making layered security and stronger verification processes essential.

1. Strengthen Identity and Account Recovery Protections As we highlighted in last week's focus on MFA, phishing-resistant authentication methods provide an important layer of defense against credential theft and account compromise. But strong authentication is only part of the equation. Attackers now target the recovery process itself — impersonating employees to trick help desks into resetting passwords or registering new MFA devices. Organizations must establish strict identity verification for support requests and restrict high-risk account modifications.
   

2. Recognize Scams Targeting IT and Developer Workflows Social engineering now directly preys upon everyday technical processes. In recruiter fraud, attackers seek out developers in convincing interviews before tricking them into running malicious coding assessments. Microsoft's March 2026 analysis of the Contagious Interview campaign documents how seemingly routine recruitment is used to deliver malware and gain access to sensitive development environments. State-sponsored actors can also use fake identities to obtain remote IT roles and access sensitive systems. Organizations should enforce strict verification across recruitment and isolate environments used for code evaluation.
   

3. Prepare for AI-Enabled Phishing and Evolving Attack Techniques Generative AI and voice cloning allow attackers to craft polished messages and believable impersonations of colleagues or executives. Meanwhile, ClickFix campaigns present fake error prompts that convince users to run malicious troubleshooting commands themselves. Defenses must go beyond training users to spot typos and instead focus on strict verification requirements and restricted privileges for sensitive actions.
   

4. Turn Phishing Reports into Actionable Defenses Even with strong controls, some phishers will slip through. Security teams should monitor for indicators like unexpected MFA changes, abnormal cloud access, and suspicious application permissions to lock down threats early. Learning from reported incidents helps refine detection rules, while sharing threat indicators with trusted partners like IT-ISAC informs the broader sector.

Make It Harder for Attackers: Trust, but Verify

Phishing succeeds when attackers exploit trust, routine, and urgency. As generative AI makes fake messages virtually indistinguishable from real ones, you shouldn't rely on spotting grammatical errors alone.

By enforcing strict verification habits, adopting phishing-resistant technologies, and establishing clear security procedures, you can make it significantly harder for scammers to succeed.

Don't let familiarity replace verification. Whether it's an email from a colleague, a call from IT support, or a seemingly legitimate request from a vendor, taking the time to verify can make all the difference.

This Cybersecurity Awareness Month, Make It Harder for Attackers by making it harder for scams to succeed.