Phishing and Social Engineering: How Your Employees Can Spot an Attack

Phishing and social engineering exploit human trust rather than technical security gaps to obtain access credentials, money, or personal data. A single careless click is enough to bypass every technical safeguard. With targeted phishing employee training, your staff learn to recognize warning signs and to react correctly in a real incident.

From the Provimedia editorial team. As of: July 2026. This article is general information, not legal advice.

What is social engineering?

Social engineering refers to methods in which attackers exploit not technical vulnerabilities but human behavior patterns: helpfulness, time pressure, respect for authority, or curiosity. Phishing is its most common form. Attackers pose as a trustworthy sender by email, text message, or phone to obtain access credentials, payments, or confidential information.

Because attacks target people rather than systems, technical IT security alone falls short. Firewalls and spam filters catch a large share, but a well-crafted fake that is not recognized as such bypasses every technical safeguard with a single click. This is exactly where employee awareness comes in, as a complement to technical measures, not a replacement for them. How awareness topics like this differ from classic data protection training, and where they overlap, is explained in the article Information Security Training vs. GDPR Training.

Which forms of attack hit companies most often?

In practice, companies mainly encounter four variants. The following examples are illustrative, constructed scenarios and do not describe any real incident.

Phishing in the narrow sense sends largely identical emails to a large number of recipients, usually in the name of well-known brands, parcel services, or banks. A typical scenario: an employee receives an email, supposedly from the IT provider, demanding immediate "password confirmation" via a link, because the account would otherwise be locked.

Spear phishing is more targeted: attackers research a person's name, role, and current projects in advance to make the message more personal and credible. A typical scenario: a buyer receives an email that appears to come from a known supplier and references a real, currently running order, asking them to use an "updated" bank account for the next payment.

CEO fraud, also known as business email compromise, pretends to come from company management and deliberately builds up time pressure and confidentiality. A typical scenario: shortly before the end of the day, accounting receives an urgent message supposedly from the managing director, who is currently "in a confidential meeting" and asks for an immediate, discreet transfer for an upcoming company acquisition.

Smishing uses text messages or messenger apps instead of email, often with short, inconspicuous senders. A typical scenario: an employee receives a text message, supposedly from a parcel service, with a link to an outstanding "customs fee" to be paid via a fake payment form.

Form	Method	Typical warning sign
Phishing	Mass emails in the name of known brands or services	Impersonal greeting, threat of account lockout
Spear phishing	Targeted, pre-researched message to a specific person	Plausible context, but an unusual request
CEO fraud	Fake instruction supposedly from management	Time pressure, confidentiality demand, payment request
Smishing	Fraudulent text message or messenger message with a link	Short link, alleged fee or parcel tracking

How do I recognize a phishing email?

No single feature reliably proves an attack, but four checks can be applied within seconds: sender, urgency, links or attachments, and the type of request. Running through these before clicking or replying defuses most attempts. Every training should give employees exactly these checkpoints; together, they take less than ten seconds.

• Check the sender closely: does the display name show a familiar name while the actual email address is different or looks foreign?
• Pressure and urgency: is time pressure being built up with deadlines, account lockout, penalties, or "valid today only"?
• Check links before clicking: does the link text shown on mouseover really lead to the expected domain?
• Unexpected attachments: is there an invoice, a fax, or a document that nobody announced?
• Unusual payment or data requests: is there a request for a transfer, bank details, login credentials, or a changed IBAN, deviating from the usual process?
• Language irregularities: does the greeting, grammar, or tone seem atypical for the supposed sender?

What should you do if you suspect an attack?

If in doubt, the correct order matters:

1. Stop: do not click, do not download anything, do not enter any data.
2. Report instead of delete: do not delete suspicious messages; report them to the IT department or your central reporting address, so other teams can be warned and affected systems can be checked.
3. Already clicked? Report the incident immediately and change the affected password right away.
4. Possible data access? Trigger a review under Art. 33 GDPR: as soon as attackers have actually gained access to personal data, for example through an email inbox or a customer database, this constitutes a personal data breach under Art. 4(12) GDPR. How this deadline works and what steps are needed within 72 hours is described in the article Reporting a Data Breach: The 72-Hour Deadline.

Frequently asked questions (FAQ)

How do I recognize phishing?

Check the sender address, the link target before clicking, the tone of the message, and whether unusual payment or data requests are made. If any of these points do not fit the usual contact, caution is warranted. If in doubt, ask the supposed sender through a known, independent channel, not through the contact details given in the suspicious message itself.

Who is liable if an employee falls for phishing?

Under data protection law, liability does not fall on the individual employee but on the company as the controller within the meaning of the GDPR. Fines under Art. 83 GDPR are directed at the organization, not at the person who fell for the message. Employment law consequences for the employee are possible in individual cases, for example in cases of gross negligence. What matters most to supervisory authorities is whether the company trained its employees sufficiently and took appropriate technical protection measures.

Are simulated phishing tests within a company sensible and permissible?

Simulated phishing emails, which companies use to test their employees' attentiveness, are a common tool in security awareness practice. Legally, however, they are not automatically unproblematic: because the behavior of individual employees can be captured and evaluated, they are relevant under co-determination and data protection law. Before introducing them, the data protection officer and, where one exists, the works council should be involved, to clearly define scope, evaluation, and retention period.

Is a one-time training enough to prevent phishing at a company?

No. Training builds baseline knowledge and sharpens attention, but it does not replace technical protection measures such as spam filters, multi-factor authentication, or regular phishing simulations. It works best as one building block among several when it is repeated and combined with clear internal reporting paths.

Our GDPR fundamentals training teaches, in a hands-on way, what matters when handling personal data in compliance with data protection law, including a module on data security in the workplace and on the correct behavior in the event of a data breach, with a certificate of attendance as proof. It does not replace a full security awareness program with simulated phishing campaigns, but it builds a solid basic understanding of why handling suspicious messages is part of data protection.

Sources

• BSI: The State of IT Security in Germany 2025
• BSI: Social engineering, the human factor
• BSI: How do I recognize phishing in emails and on websites?
• Regulation (EU) 2016/679 (GDPR), Art. 4(12), Art. 33, EUR-Lex