Phishing for business owners: the types of attack and how to protect yourself

Most successful attacks do not break into servers — they persuade people. Romania’s National Cyber Security Directorate (DNSC) reports tens of thousands of attacks detected daily in Romania and warns that attacks built with artificial intelligence are growing fast, with the human link remaining the weakest. For a small company, a single wrong click can mean emptied accounts or stolen customer data.

The types of phishing you will come across

• Classic email phishing: messages that appear to come from the bank, ANAF (the Romanian tax authority), courier companies, Google or Microsoft, with a link to a fake login page.
• Spear phishing: the same idea, but the message is built specifically for your company — with real names of colleagues, clients or projects, gathered from the website and social networks.
• “CEO” fraud (Business Email Compromise): a message apparently from the managing director or a supplier asks for an urgent payment or announces a “change of IBAN” on an otherwise correct invoice.
• Smishing: phishing by text message — the “held” parcel, the “suspended” account, the “unpaid” fine, all with a link.
• Vishing: phishing by phone, “from the bank” or “from technical support” — more and more often with voices cloned using AI.
• Quishing: QR codes stuck on posters, invoices or restaurant tables, leading to fake pages.
• Deepfake: AI-generated audio and video that imitates real people — there have already been frauds carried out through video calls with fake “directors”.

Simple rules of defence

1. Any payment request or IBAN change is checked through another channel: call the number you already knew, not the one in the message.
2. Do not open links in unexpected messages; type the address into the browser yourself.
3. Read the sender’s domain letter by letter — “firma-mea.ro” and “firrna-mea.ro” are not the same thing.
4. Haste is the warning sign: “now, urgent, confidential” is the attackers’ main tactic.
5. Turn on two-step verification for email and for all important accounts.
6. Set a written procedure for payments: every new IBAN is confirmed by phone, with no exceptions, however senior the request appears to be.
7. Train the team: a single click by a single colleague is enough.
8. Report incidents: DNSC has the single number 1911 for cyber security incidents.

Phishing cannot be stopped from knocking on your door, but almost all of its variants fail the same test: a calm check, through another channel, before taking any action.