Email is the backbone of modern business communication. It's also the number one way cybercriminals break into your systems. Phishing attacks account for over 90% of data breaches, and South African businesses are prime targets.
What Makes Phishing So Dangerous
Phishing works because it targets humans, not technology. A convincing email from what looks like your CEO, your bank, or a trusted supplier can bypass even the best technical defences. Modern phishing attacks are increasingly sophisticated — AI-generated emails can mimic writing styles and avoid the spelling and grammar mistakes that used to be giveaways.
Common Phishing Types
Spear Phishing
Targeted emails aimed at specific individuals. The attacker has done their research — they know your name, your role, and maybe even your recent activities. A spear phishing email might reference a real meeting you attended or a project you're working on.
Business Email Compromise (BEC)
Attackers impersonate executives or suppliers to trick staff into transferring money or sharing sensitive data. BEC attacks have cost South African businesses millions. We've explored this in detail in our guide on business email compromise.
Clone Phishing
A legitimate email you've received before is copied and resent with malicious links or attachments. Because you've seen a version of it before, you're more likely to trust it.
Smishing and Vishing
Phishing via SMS (smishing) or phone calls (vishing) is on the rise. Attackers pose as your bank, IT support, or a service provider.
How to Protect Your Business
Technical Defences
- **Email filtering** — Advanced spam filters catch most phishing attempts before they reach inboxes
- **DMARC, DKIM, and SPF** — Email authentication protocols that prevent spoofing
- **Link scanning** — Tools that check URLs in real-time for known threats
- **Attachment sandboxing** — Suspicious attachments are opened in a safe environment first
Human Defences
Train your team to spot the signs:
- Urgent or threatening language ("Your account will be closed")
- Unusual sender addresses (ceo@c0mpany.com instead of ceo@company.com)
- Requests for sensitive information via email
- Unexpected attachments or links
- Poor grammar and spelling (though AI-generated phishing is getting better)
What to Do If Someone Clicks
- **Report it immediately** — Don't punish, encourage reporting
- **Change the affected passwords** — Immediately
- **Scan the device** — Run a full malware scan
- **Notify your IT provider** — They can check for broader compromise
- **Review account activity** — Look for unusual logins or data access
The Role of Security Awareness Training
The most effective email security programmes combine technical controls with ongoing training. Simulated phishing campaigns — where your IT provider sends fake phishing emails to test your staff — are particularly powerful. They identify which employees need additional training and reinforce good habits. Over a 12-month programme, most businesses see phishing susceptibility drop from 30% to under 5%.
Email Security FAQ
Q: What is DMARC and do I need it?
A: DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that prevents attackers from spoofing your business domain. Yes, you need it. Without DMARC, attackers can send emails that appear to come from your company. Setting up DMARC, DKIM, and SPF should be a priority for every business — and CT Bedfordview can configure it for you as part of our email security service.
Q: How often should I run phishing simulations?
A: Monthly for the first quarter, then quarterly once your team consistently recognises phishing attempts. Always follow up simulations with training for those who clicked.
Worried about phishing targeting your team? CT Bedfordview offers email security assessments and staff training. Get in touch to strengthen your defences.