The #1 way attackers get in — and the easiest to stop once you know the signs.
A man in a high-vis jacket knocks at your door. He says he's from the gas board, there's an urgent leak, and he needs to come in right now. He's got a clipboard, he looks the part, he sounds in a hurry. But he hasn't shown you a real ID, the van outside has no logo, and when you ask your neighbour later, no one else was visited.
A phishing email is exactly that — a stranger in a costume, using urgency and authority to get you to open the door (click the link, type your password).
"Your Microsoft 365 password expires today — click here to keep your account active." Sender: security@microsft-portal.com (note the missing 'o' in Microsoft). The link led to a fake login page that captured the password. Two colleagues clicked — only one reported it.
Hit the Report Phish button in Outlook, or drop IT a line on Teams. You catching one protects everyone.