Glossary · Security

Phishing

In plain language

A fake email, text or call designed to trick you into clicking a link, opening a file or handing over a password.

The metaphor

Like a forged letter in your mailbox that looks as if your bank sent it, with a fake Post Office sign on the door you are told to walk through.

Going deeper

How it works

The message copies a trusted sender, such as a bank, a supplier, Microsoft or your boss.
It creates urgency: pay now, verify now, your account will close.
A link leads to a copy of a real login page that captures your password, or an attachment installs malware.
Variants: spear phishing (aimed at you), smishing (text), vishing (voice) and quishing (QR code).

What can go wrong (example scenario)

A four-person accounting practice's receptionist got a “voicemail attached” email during tax season. The link asked for her Microsoft password. Within an hour, the attacker had sent her client list a fake “updated tax documents” link, and three clients entered their own passwords.

How WILDCARD handles it

Email Security filters inbound and outbound mail in real time and catches impersonation and phishing before it lands. Phishing Training sends monthly simulations so your team practises on safe bait. Identity Monitor watches the logins a stolen password would produce.

In practice

A dental office receives a fake Microsoft 365 “storage full” notice with a sign-in link.
A retailer's owner gets a text claiming a Canada Post parcel is held pending a fee.
A non-profit's treasurer receives a “DocuSign” request from a board member's lookalike address.

Example scenario: A two-person design studio got an email from their web host saying the domain would be suspended in 24 hours. The link led to a perfect copy of the host's login page. The owner noticed the domain in the address bar was wrong by one letter and closed it. That one habit protected the studio's entire client portfolio.