In this SJUK exclusive, Steve Timothy, Cyber Security Specialist Director, Ricoh UK, takes SJUK on a journey through the various “ishing” scam/breach mechanisms and how companies can educate their staff and protect their operations

Cybercriminals have done their homework. The clumsy, typo-ridden scam email has given way to attacks that are well researched and convincing. They arrive by text, by phone, even by a sticker on a restaurant table – and many are built to slip past the security tools organisations have spent years putting in place.

That puts business leaders in an uncomfortable position. Firewalls, endpoint protection, network monitoring and antivirus all have their place, yet attackers increasingly target the people behind the technology. They find a way to earn an employee’s trust, and that trust opens the door far more easily than any piece of software.

Protecting your organisation starts with your employees, and employees can only defend against what they know exists.

The “ishings” family

Most people know phishing: a fraudulent email designed to harvest credentials or tempt someone into clicking a link. Fewer are familiar with the other tactics in the attacker’s playbook, which is precisely why they work.

• Quishing uses QR codes. Criminals stick a malicious code over a legitimate one, perhaps on a restaurant table, a parking machine or a poster offering something for free. Scan it and you land on a fraudulent website that extracts sensitive or personal information. Very few people think to check whether the code they’re scanning is a sticker placed over the real thing.

• Smishing arrives by text message: a parcel about to be returned, a bank account about to be frozen or a time-sensitive one-time passcode that was never requested. The message looks plausible and is designed to rush the recipient, so they only have a split second to decide whether it is genuine.

• Vishing happens over the phone, sometimes through an automated voicemail telling you to call a number to reach your “service desk”. It could also be a live caller claiming to be from IT, or a colleague needing a password reset.

Artificial intelligence (AI) is making all these more convincing. Attackers use it to produce bigger volumes, and better versions of familiar scams. In a world where a text or call from an unknown number could be an imitation of someone you trust, seeing and hearing are no longer believing.

Red flags that travel with your people

Hybrid working means the risk does not stay inside the office. Employees work from home, co-working spaces, cafés and trains – so they scan QR codes and take calls wherever they happen to be.

In an office there is usually a colleague nearby to ask: “Does this look right to you?”. But at home or in a coffee shop, that safety net disappears. Healthy scepticism should be practised everywhere their people work. Business leaders should also encourage the use of VPNs and personal hotspots in place of public Wi-Fi, where criminals can more easily intercept data or even spy on a user’s browsing.

Whatever the channel, most scams pull the same levers. Urgency comes first: your account will be suspended, a payment is overdue, the boss needs this done now. The pressure is manufactured to stop you pausing for thought. Familiarity and authority follow. A name you recognise or a title you respect lowers your guard, and well-researched attackers will know enough about you to sound credible.

Employees should watch for unexpected requests demanding immediate action or requests they never asked for, QR codes that look as though something has been stuck over them and callers keen to steer them away from usual processes. The simplest safeguard is to verify through a separate, trusted route. If someone phones claiming to be from IT, hang up and ring back on a number you already hold.

What leaders can do

Many organisations assume that a few tools and a small security team mean they are covered from all cyber threats. But complacency exists at both ends of the scale. Some large companies believe they have everything they need, while smaller ones wonder why anyone would bother with them. A 20-person architecture firm is as likely a target as a household name.

The attacks on Marks & Spencer and Jaguar Land Rover demonstrated how this plays out.

In both cases, initial access came when attackers phoned a third-party service desk and talked their way into a username and password reset. To all intents and purposes, they became legitimate employees. Businesses are only as strong as their weakest link, and that includes suppliers.

So, what should leadership teams do?

First, build awareness that reaches beyond phishing emails. User-awareness training should cover quishing, smishing, vishing and AI-assisted impersonation, and should be regular and practical.

Second, tighten identity checks around high-risk requests. Password resets, payment approvals and access changes are exactly what criminals target. Make multi-factor authentication the default, ideally through an authentication app, which is far harder to intercept than a code sent by text. Then make sure your own teams – and any third party running a service desk for you – have robust verification procedures that a confident voice on the phone cannot talk around.

Third, plan for the day it happens. The biggest gap I see is reluctance to accept a breach could happen at all, and it often takes a headline incident like M&S or JLR to jolt leadership teams into action. Internal processes should be in place long before that moment, and the better question is how quickly you can respond. Who picks up the phone at two in the morning? Is there a documented incident response plan, and an expert team on call to act on it?

Having someone with eyes on your systems 24/7, 365 days a year is the foundation, and insurers often expect to see this kind of cover. It does not have to be out of reach: outsourced services can be live in under a month, while building your own operation can mean a seven-figure entry cost in a market short of skilled people.

Lastly, employees should know exactly who to tell when something feels wrong and should never be made to feel embarrassed over a false alarm. Speed matters here. A threat reported within hours can be contained early, while one that stays quiet for weeks becomes far harder to unpick. Clear escalation routes, practised in advance, make the difference.

Prepared businesses will stay ahead

Scammers are becoming more sophisticated, and it is tempting to assume that nothing can be trusted any more. But businesses can offer something better than blanket suspicion: clear checks to prepare for every possible situation.

The encouraging part is that the solutions are within reach. Security software matters, and so do informed people, clear verification processes and a rehearsed response plan.

The businesses that put all of these in place will be best placed to weather whatever the scammers dream up next.