PHISHING: PHISHING KPI/ Best-practice Anti Phishing for SMEs

Understanding Phishing and Its Threat to Small Businesses

Phishing is a form of cyber attack where perpetrators deceive individuals into divulging sensitive information such as passwords, credit card numbers, or personal identification details through fraudulent communications. These attacks are commonly executed via email, SMS, or even phone calls, making them a prevalent threat to Small Businesses in the UK and EU. In fact, Phishing attacks have increasingly targeted small businesses, with a staggering 83% of UK businesses experiencing such attacks in 2022. This widespread issue indicates that Small Enterprises are often seen as easier targets due to typically having fewer resources dedicated to cybersecurity.

The financial implications of Phishing attacks can be severe. On average, each Phishing incident results in a loss of approximately £136, contributing to an overall global theft of nearly $44.2 million in 2021. Phishing scams often exploit human emotions, such as fear or urgency, compelling victims to act quickly without verifying the source of the communication. This is particularly problematic as about 65% of cybercriminal groups utilise spear Phishing as their primary method for gathering intelligence on their targets. The increase in remote work has further exacerbated this vulnerability, as employees may let their guard down when responding to suspicious messages.

Common Forms of Phishing Attacks

Small Businesses should be aware of various forms of Phishing attacks that can compromise their security. Email Phishing is the most common type, where attackers send fake emails that appear to be from legitimate organisations, with well-known brands like Google and Adobe frequently impersonated to entice victims to click malicious links. Spear Phishing specifically targets individuals or companies using personal information to lend credibility to the attack, while Vishing (voice phishing) involves phone calls that trick victims into revealing sensitive data. Another variant, Smishing, uses SMS messages to create a sense of urgency that prompts quick responses from the recipient.

Whaling is another sophisticated form of Phishing that focuses on high-profile individuals within a company, such as executives, often using carefully crafted messages to extract sensitive information. Clone Phishing is also noteworthy; it replicates legitimate emails that have been previously sent, replacing links with malicious ones to deceive recipients. Awareness of these varying tactics is essential for Small Businesses to bolster their defence against phishing attempts.

Impact of Phishing on Small Businesses

The impact of Phishing on Small Businesses can be catastrophic. Phishing is reported as the most prevalent type of cyber attack, affecting 84% of businesses in the UK. The financial ramifications can be dire, with the average cost of a disruptive breach around £1,205. Furthermore, significant data breaches can lead to even greater financial consequences, with breaches involving 10 million records costing an average of £50 million. Beyond financial losses, Phishing attacks can severely damage a business’s reputation, leading to a loss of customer trust and potential revenue.

The recovery from a Phishing incident can be exceptionally costly, with estimates suggesting that it may exceed $14.8 million for affected organisations. In fact, a staggering 96% of organisations reported experiencing at least one Phishing attack in the past year, underscoring the pervasive nature of this threat. This statistic highlights the urgency for Small Businesses to take proactive measures in their cybersecurity strategies.