Phishing
Phishing
What is phishing?
- Stealing information with spoofed emails and texts
- The top entry point for security incidents
- Doubt and verify: your best defense
What phishing really changes is not how the security budget is split but where accountability sits. You can spend hundreds of millions of won on firewalls, antivirus, and email gateways, and all of it is undone the moment one employee clicks a link and enters a company account password. So the security manager's job shifts from building a network that can't be breached to making sure a suspicious email reaches the security team within minutes. The metrics change too: not block rate, but the number of reports and the time it takes to report.
Phishing is classified by how it arrives. By text message, it is smishing. By phone call or voice prompt, it is vishing. When the sender researches a specific person's title and recent work first, it is spear phishing. When someone impersonates the CEO or CFO and tells an accounting clerk to wire money, it is business email compromise (BEC). People often lump it together with ransomware and data leaks, but phishing is not the result of an attack. It is the way in, and that is where the line falls. Defense rules differ by channel too. For email, check whether the sender's domain matches the reply address. For texts, look for shortened URLs. For calls, check whether the other party called you first. The most effective bait is a document people expect to open, such as a year-end tax settlement notice, a pay slip, or an electronic tax invoice. Fake domains usually differ by just one character.
The most common misstep in practice is using simulations as a tool for catching people out. If you send the list of employees who clicked to department heads and factor it into performance reviews, click rates drop in the next simulation, but when someone clicks a real phishing email, no one raises a hand. You find out an account was taken over two weeks later, from an angry call from a business partner. Two beliefs are dangerous too: that the spam filter catches everything, and that clumsy, translated-sounding wording makes scams easy to spot. Impersonation emails today read smoothly, and the lock icon in the address bar only means encryption, not that the site is genuine. The companies that stop attacks fastest are the ones that first put in writing immunity for reporting instead of disciplinary action.
Seolyeong ParkGenerative AI and AX training specialist: 17 years of hands-on experience and 200+ sessions, making AI usable right away even for non-technical staff
Jaryong KooMarketing PhD and leading authority on AI, data analysis, and personal brandingThe term emerged in the mid-1990s from attacks on online service accounts, and phishing has since become the most common type of cyberattack.
Consider a hypothetical case: Company A, an auto parts manufacturer with 320 employees and annual revenue of around KRW 90 billion (≈ US$67,335,000). In March, an email impersonating a contact at an overseas client reached the accounting team, claiming “our bank has changed” and demanding a KRW 42 million (≈ US$31,400) transfer. It was stopped only by a phone call from the team leader just before the accounting associate submitted it for approval. The head of management support said, “We were just lucky this time,” and ordered a six-month program.
- A deputy manager on the information security team went through a year of email logs and found 17 similar impersonation emails. Nine were concentrated in the accounting and purchasing teams, so the first round of training was narrowed to those two teams, 41 people in all.
- In an April simulation, a 'year-end tax refund notice' email went out. Of 41 people, 19 clicked the link and only 2 reported it. The division head made one thing clear: no one should report the names of people who clicked.
- The training dropped the lecture format. Instead, 12 emails the company had actually received were put on screen, and the group worked at telling real from fake. A purchasing team manager spotted it unprompted: the domain ended in .cc, not .co.
- The finance team wrote a rule into policy: when an account-change request arrives, don't reply by email. Instead, call back on the registered landline to verify. Transfers of KRW 30 million (≈ US$22,400) or more now need approval from two team leads.
- In the second simulation in September, clicks fell from 19 people to 3 and reports rose from 2 to 28. The average time to report a suspicious email dropped from four days to 22 minutes.