For years we were taught to be wary of emails full of mistakes. It was good advice, but today it is no longer enough. Artificial intelligence tools allow anyone to write a convincing message, in correct language, with the right tone and perhaps even mentioning the name of a real client. So here is how to spot phishing in 2026, with signs that work even against the most polished scams.
What is phishing?
Phishing is an attempted scam in which the attacker poses as someone you trust in order to get you to do something harmful: click on a link, open an attachment, enter a password, authorise a payment. The name is a play on fishing: you cast the bait and wait for someone to bite.
There are several variants:
- Smishing: the same scam by SMS (“Your parcel is being held, click here”).
- Vishing: the scam over the phone, increasingly with voices cloned by AI (we discuss this in the article on the CEO voice deepfake scam).
- Spear phishing: a tailor-made attack, prepared by studying the victim (the office website, LinkedIn, news).
How widespread is it?
Phishing remains the entry point most used by cybercriminals.
- According to the ENISA Threat Landscape 2025 report (ENISA is the EU Agency for Cybersecurity), phishing was the initial vector in around 60% of the cases analysed in Europe.
- The Clusit Report 2026 (published by Clusit, the Italian Association for Information Security) records a 66% increase in Italy in serious incidents based on phishing and social engineering in 2025, equal to 12.4% of the total.
- According to Verizon’s Data Breach Investigations Report 2025, around 60% of data breaches involve a human error or action.
The reason is simple: deceiving a person costs less than breaking into a system.
How to spot phishing: the 7 signs that really matter
- Urgency or fear. “Within 24 hours”, “account suspended”, “final notice”, “penalty”. The rush is there to stop you from thinking.
- An unusual request. A client asking you to pay to a different IBAN, a supplier sending an “updated” invoice, a colleague asking for login details. If the request is out of the ordinary, stop.
- A sender that does not add up. Read the full address, not just the display name: “Banca Rossi” assistenza@banca-rossi-verifica.com is not your bank.
- Misleading links. Hover the mouse over the link without clicking (on a phone, press and hold): the real address appears at the bottom or in a pop-up box. Be wary of domains that are similar but different.
- Unexpected attachments. Invoices, “shared documents”, compressed files or files that ask you to “enable macros” or to enter a password to open them.
- A login page straight after the click. If a link takes you to a page asking you to enter your email and password, close it and access the service by typing the address yourself.
- The wrong channel. Banks, the Italian Revenue Agency (Agenzia delle Entrate), INPS (Italy’s national social security institute) and couriers do not ask for passwords or codes by email, SMS or phone.
The golden rule: when a request concerns money, passwords or data, check through a different channel from the one it arrived on. Call the number you already know, not the one written in the message.
Why does artificial intelligence make phishing more dangerous?
Generative AI tools allow scammers to:
- write emails without mistakes, in the style of a specific company or person;
- personalise thousands of messages in a few minutes, using public information;
- translate scams that originated abroad perfectly;
- create convincing fake voices and videos for phone and video calls.
The result is that a “nose” for scams based on mistakes no longer works. What does work is procedures: always verify payment requests, never enter login details from a link you have received, report any doubts. We explore this topic in the article on artificial intelligence and cybersecurity.
Typical examples in a professional office
| Message | What it is after | How to check |
|---|---|---|
| “Please find attached the updated invoice with the new IBAN” | Diverting a payment | Phone the supplier on the usual number |
| “Document shared with you: click to view” | Stealing your email password | Access the service by typing the address yourself |
| “Notice from the Revenue Agency, download the notice” | Installing a malicious program | Check in the official reserved area |
| “This is the lawyer, I’m in a meeting, make this bank transfer right away” | Bank transfer fraud | Call the owner back on their mobile |
| SMS: “Parcel on hold, pay €1.99 for delivery” | Stealing card details | Ignore it: couriers do not ask for payments like this |
What to do if you have already clicked
It happens even to the most careful people. What matters is to act immediately and speak up, without embarrassment.
- Disconnect the device from the network (cable and Wi-Fi), but do not switch it off: it may be needed to understand what happened.
- Change the password for the account involved from another device, and wherever you had reused it.
- Turn on two-factor authentication, if it was not already on (see the guide to passwords, MFA and passkeys).
- Immediately inform the owner and whoever looks after the office’s IT.
- If you provided bank details, call the bank straight away to block cards or transactions.
- Report the attempt to the Postal Police (Polizia Postale, Italy’s cybercrime police) through the Commissariato di PS Online portal.
- If clients’ personal data are involved, assess with your privacy consultant whether notification to the Italian Data Protection Authority (Garante per la protezione dei dati personali) is needed (see what to do after a cyberattack).
A wrong click can be the start of a ransomware attack: that is why speed matters. Read also how ransomware works in professional offices.
How to reduce the risk in the office
- Two-factor authentication on email and cloud services: even if the password is stolen, on its own it is not enough.
- A written rule on payments: no change of IBAN without verification by phone.
- Short, repeated training: ten minutes a month is worth more than one course a year.
- A channel for reporting doubts without fear of looking naive.
- A network that notices if a computer tries to connect to a malicious site. This is one of the tasks of Strega Defence: it blocks the suspicious connection and alerts the owner in plain language, explaining what happened and what to do. Find out how it works.
For an overall check of your office’s security, try our 10-question checklist.
Frequently asked questions
How can you tell if an email is phishing?
Check four things: whether it creates urgency or fear, whether it contains an unusual request (payments, passwords, unexpected attachments), whether the sender’s full address and the links lead to the correct domains, and whether the channel is the usual one. If in doubt, check by phoning a number you already know.
Are spelling mistakes still a sign of phishing?
They can be, but they are no longer reliable: with artificial intelligence, scammers write messages in correct language with a professional layout. It is better to focus on the content of the request and on verifying the sender, not on the form.
What is the difference between phishing, smishing and vishing?
It is the same scam on different channels: phishing arrives by email, smishing by SMS or messaging app, vishing through a phone call, sometimes using voices cloned with artificial intelligence.
I opened a phishing email but did not click anything: is it serious?
Usually, opening and reading an email is not enough to infect the computer, as long as the software and operating system are up to date. The risk arises when you click a link, open an attachment or enter data. Delete the message and report it to whoever looks after IT.
Where do you report a phishing attempt?
You can report it to the Postal Police (Polizia Postale, Italy’s cybercrime police) through the Commissariato di PS Online portal. If the scam uses the name of your bank or of a company, let them know too. In the office, it should always be reported to the owner or to the person responsible for IT.
Does certified email (PEC) protect against phishing?
No. PEC certifies that a message was sent and delivered, but not that the sender is acting in good faith: there are scams sent from compromised PEC mailboxes. The same rules of caution apply as for ordinary email.
Sources and further reading
- ENISA Threat Landscape 2025 — ENISA, October 2025.
- Rapporto Clusit 2026 – dati principali (in Italian) — Clusit, 11 March 2026.
- Data Breach Investigations Report — Verizon, 2025 edition.
- Cybersecurity: temi e consigli (in Italian) — Italian Data Protection Authority (Garante per la protezione dei dati personali).
- Phishing: attenzione ai pescatori di dati personali (infografica) (in Italian) — Garante privacy.
- Smishing and Vishing (in Italian) — Garante privacy.
- Segnalazioni al Commissariato di PS Online (in Italian) — Postal Police (Polizia Postale).
Written by Ing. Sergio Florio, founder of Strega Byte, an engineer with over twenty years of experience across research, development and business. Article updated on 11 October 2026.
