Phishing Attacks in Australia: How to Protect Your Business
Phishing is the most common attack vector Australian businesses face. It’s not glamorous—no zero-day exploits, no sophisticated hacking tools. Just emails designed to trick your staff into revealing passwords, downloading malware, or transferring money.
And it works. According to the Australian Signals Directorate (ASD), phishing remains one of the primary initial access methods for targeted attacks on Australian organisations. Nearly every significant breach starts with someone clicking the wrong link or opening a malicious attachment.
The Phishing Landscape in Australia
Australian organisations are under active phishing campaigns. Phishing is pervasive (responsible for the initial compromise in the majority of cyber incidents), attackers are getting smarter (more convincing impersonation), business email compromise is growing (compromised legitimate accounts used for phishing), and ransomware follows phishing (initial access is the starting point for attacks).
Australian businesses are also targeted because Australia is economically significant, English-speaking, and has strict financial and data protection regulations that make data valuable to criminals.
Types of Phishing Attacks
Standard Phishing
Bulk email campaigns sent to many recipients. The email impersonates a trusted company and asks you to “verify your account” or “update your payment method.” The link takes you to a fake website. When you enter credentials, the attacker captures them.
Spear Phishing
Targeted phishing aimed at specific individuals. The attacker researches the target, personalises the email with real details (name, company, role, colleagues, recent projects), making it much more convincing.
Whaling
Spear phishing targeting senior executives (CFO, CEO, Managing Director). The attacker knows these people have access to money and sensitive information, so it’s worth extra effort. Senior executives often have limited email security training and might bypass normal approval processes.
Business Email Compromise (BEC)
Attackers compromise a legitimate business email account and use it to send phishing emails to other staff, customers, or suppliers. Because the email comes from a real, trusted account, it’s extremely effective.
Technical Controls: Defending Against Phishing
Email Authentication (SPF, DKIM, DMARC)
Prevents attackers from spoofing your email domain. SPF specifies which servers are allowed to send email from your domain. DKIM digitally signs emails. DMARC ties SPF and DKIM together and tells email systems what to do if authentication fails (quarantine or reject).
When properly configured, these prevent attackers from sending emails that appear to come from your domain. A common phishing tactic is to spoof a company’s email address. DMARC stops this.
Email Filtering and Threat Detection
Scans incoming emails for malware, suspicious links, phishing indicators, and known threats. Examines attachments for malware, links for phishing sites, sender reputation, email content for phishing patterns, and header information for spoofing attempts.
Microsoft Defender for Office 365 is a strong email filtering option if you use Microsoft 365. It uses machine learning, threat intelligence, and heuristics to catch phishing. Good email filtering catches 80-90% of phishing emails.
URL Rewriting
When an email arrives, the email filter rewrites links so they go through a security gateway. When users click the link, the gateway checks if it’s malicious before allowing them to visit it. If it’s a phishing site, the gateway blocks it and warns the user.
This is extremely effective. Even if a phishing email makes it past filtering, URL rewriting prevents users from being taken to fake login pages or malware sites.
Multi-Factor Authentication (MFA)
Even if someone enters their password on a phishing site, the attacker can’t get into the account without the second factor (usually a code from an authenticator app or SMS). This is one of the most important controls and is why it’s part of the Essential Eight.
Endpoint Protection (Antivirus, EDR)
If someone downloads malware from a phishing email, antivirus or endpoint detection and response (EDR) catches it before it runs or quarantines it if it does. Stops malware infections that start with phishing.
User Training: The Human Firewall
Technology stops most phishing, but some emails get through. Your staff are your last line of defence.
Phishing Awareness Training
Regular training teaching staff to recognise phishing attempts, verify unusual requests, and report suspicious emails. Effective training covers common phishing tactics (urgent requests, threats, impersonation), red flags in emails (suspicious sender, poor grammar), how to verify sender identity, what to do if you suspect phishing, and how to report it.
Training significantly reduces click rates. Studies show: without training 30-40% click phishing emails; with initial training 15-20% click; with ongoing training 3-5% click.
Simulated Phishing Campaigns
IT sends fake phishing emails to staff to test whether they’ll click. It’s not to punish people—it’s to identify who needs more training and keep phishing awareness top-of-mind. Simulated campaigns reinforce training and make phishing a tangible, real threat. Staff remember the simulation and are more cautious with real emails.
Clear Reporting Process
Staff need an easy way to report suspected phishing. The process should be simple (one click if possible), and there should be no negative consequences for reporting. When staff report phishing, IT can respond quickly to compromise. If a staff member’s email has been hacked, the sooner you know, the sooner you can isolate it.
When Phishing Works: Incident Response
Password Compromise
If someone enters their password on a phishing site, assume the account is compromised. The attacker now has a valid password. If MFA is not enabled, they can log in. Response: force password change, check for unauthorised access, investigate further if evidence exists.
Malware Download
If someone downloads malware from a phishing email, endpoint protection should catch it. Verify antivirus logs confirm detection. If not detected, investigate what the malware was. Consider rebuilding if sophisticated.
Data Exfiltration or Money Transfer
If someone fell for a convincing phishing email and transferred money or disclosed data: immediately escalate (CEO, CFO, legal), contact the bank to try to reverse it, investigate breach notification obligations, and understand how the attack succeeded.
Phishing and Essential Eight Compliance
Phishing defence is interwoven with Essential Eight compliance. Key controls: MFA stops attackers who steal passwords, application whitelisting prevents downloaded malware from running, patching keeps systems from being exploited, admin privilege restriction limits damage if accounts are compromised.
Building Your Phishing Defence Program
- Email authentication — Implement SPF, DKIM, and DMARC. This is free and foundational.
- Email filtering — Use Microsoft Defender for Office 365 or another reputable email security solution.
- MFA — Enable for all cloud accounts.
- Endpoint protection — Ensure all computers have antivirus.
- Initial awareness training — Conduct phishing awareness training for all staff. Make it clear this is standard cyber hygiene, not punishment.
- Reporting process — Implement a “Report Phishing” button in email.
- Simulated campaigns — Start with quarterly campaigns, measuring click rates and providing targeted training.
- Incident response procedure — Document what happens when someone reports phishing or you suspect compromise.
Common Mistakes in Phishing Defence
- Over-relying on filtering alone — Email filtering is essential but not enough. You still need MFA, user training, and endpoint protection.
- Punishing phishing clicks — If staff feel punished, they’ll stop reporting. Training should be supportive.
- Not implementing MFA — This is the most impactful single control.
- Poor email authentication — Many organisations don’t implement DMARC properly, allowing attackers to spoof their email domain.
- No incident response process — Have a clear process documented.
- One-time training — Phishing awareness needs to be ongoing.
The Bottom Line
Phishing is the most common attack vector Australian businesses face. Defence requires both technical controls and user training. The cost of professional phishing defence is minimal compared to the cost of a breach. It’s worth getting right.
Related reading: incident response planning | business resilience | breach liability
