Phishing Attacks: Prevention Guide for Australian Businesses

Phishing is the #1 cause of data breaches in Australia — 91% of cyber attacks start with a phishing email

Phishing attacks trick employees into revealing credentials, clicking malicious links, or transferring money by impersonating trusted contacts. The ACSC reported that Australian businesses lost over $77 million to business email compromise (BEC) in 2025 — a sophisticated form of phishing that targets finance teams with convincing impersonation of executives or suppliers.

Types of phishing targeting Australian businesses

Email phishing (mass targeting)

Bulk emails impersonating well-known brands — ATO, Australia Post, MyGov, banks, and telcos. These emails create urgency ("Your tax return needs immediate action", "Your parcel is being held") to trick recipients into clicking malicious links or entering credentials on fake login pages.

Spear phishing (targeted)

Personalised emails targeting specific individuals, often using information gathered from LinkedIn, company websites, and social media. A spear phishing email might reference a real project, use a colleague's name, or mention a recent company event — making it far more convincing than mass phishing.

Business Email Compromise (BEC)

The most financially damaging phishing type. Attackers either compromise a real executive's email account or create a convincing lookalike domain (e.g., rabb1ico.com instead of rabbiico.com) and send payment instructions to finance teams. Average BEC loss in Australia: $64,000 per incident.

Smishing (SMS phishing)

Phishing via text message, exploiting Australia's high mobile usage. Common lures include toll payment notifications, delivery tracking, and bank security alerts. SMS phishing has a higher click-through rate than email because people are less suspicious of text messages.

AI-enhanced phishing (emerging threat)

Attackers now use AI to generate phishing emails that are grammatically perfect, contextually appropriate, and personalised at scale. AI-generated phishing emails have shown a click-through rate comparable to human-crafted spear phishing — eliminating the spelling and grammar errors that traditionally helped recipients identify fakes.

How to protect your business

Technical controls

• Email authentication (SPF, DKIM, DMARC) — prevents attackers from spoofing your domain. DMARC set to "reject" ensures spoofed emails are blocked entirely
• Email filtering — deploy an email security gateway that scans attachments, rewrites URLs for safe clicking, and quarantines suspicious messages
• Multi-factor authentication — even if credentials are phished, MFA prevents account access. Use phishing-resistant MFA (hardware keys, passkeys) for high-risk accounts
• Link protection — rewrite URLs in emails to route through a scanning proxy before redirecting users
• Browser isolation — render suspicious web content in a sandbox rather than on the user's machine

Process controls

• Payment verification procedures — require verbal confirmation (phone call to a known number) for any payment instruction change, wire transfer, or new supplier bank details. Never verify via email — the email may be compromised
• Dual approval for payments — require two authorisations for payments above a threshold
• Supplier verification — maintain a verified list of supplier bank details. Any change request requires out-of-band verification

Staff awareness

• Regular training — quarterly phishing awareness sessions covering current tactics
• Simulated phishing — send test phishing emails to measure susceptibility. Use results for targeted training, never punishment
• Reporting culture — make it easy and safe to report suspicious emails. Staff who report should be praised, not questioned
• Executive training — leaders are the highest-value targets. They need the most training, not the least

What to do when staff click a phishing link

1. Don't blame the individual — focus on containment, not consequences. Blame culture reduces reporting
2. Change credentials immediately — for the affected account and any accounts using the same password
3. Check for account compromise — review email forwarding rules, connected apps, and recent login locations
4. Scan for malware — run a full endpoint scan on the affected device
5. Monitor for follow-up attacks — once attackers know a click was successful, they often send more targeted follow-ups
6. Report to ACSC — cyber.gov.au/report