Phishing uses email, text, or calls that appear legitimate to get someone to click a link, enter a password, or open an attachment. Business email compromise is a costly variant in which attackers use a compromised or look-alike account to request a payment or a change to bank details, often timed around a real invoice.
Defenses combine technology and process. MFA limits the value of stolen passwords, email filtering catches many attacks, and short, regular training helps staff recognize warning signs. A firm rule that any change to payment details is verified by phone, using a number already on file, stops most payment fraud.