Cybersecurity is no longer just an IT concern. For businesses, a compromised account, stolen credential or fraudulent payment can quickly become a financial and operational risk.
Phishing remains one of the most common ways attackers attempt to gain access to organisations. But the threat is evolving. Instead of relying only on suspicious emails, attackers are increasingly using business impersonation, SMS, voice calls, social media and trusted workplace platforms to make fraudulent requests look legitimate.
For companies that handle sensitive financial information, the consequences can be particularly serious.
Phishing is becoming more sophisticated and targeted
The scale of the threat is difficult to ignore. According to the Anti-Phishing Working Group (APWG), phishing attacks increased by 10.1% in Q2 2026, with 425,808 attacks recorded in June alone, the highest monthly total reported since April 2023. Smishing — phishing carried out through SMS and text messages — also increased by 40% between Q1 and Q2 2026.
At the same time, phishing is increasingly being used as a route to something more valuable: access.
Microsoft's 2026 Digital Defense Report recorded more than 46 million business email impersonation attacks over a 12-month period. It also found that 89–95% of email phishing attachments led to an attempt to steal credentials.
This shift matters for businesses. The objective of an attack may not be to infect a computer or steal information immediately. It may simply be to obtain the credentials that give an attacker access to systems, applications, email accounts or financial information.
Once that access is obtained, the consequences can extend far beyond cybersecurity.
From phishing to financial fraud
For finance and treasury teams, one of the most concerning developments is the growing connection between phishing and Business Email Compromise (BEC).
BEC attacks typically involve impersonating a trusted person, such as an executive, supplier or business partner, to convince an employee to share information or initiate a financial transaction.
APWG reported an 88% increase in wire-transfer BEC attacks in Q2 2026. The amount attackers attempted to steal also increased by 45%, reaching an average of $61,732 per attempt.
These numbers highlight an important reality: cybersecurity incidents can quickly become financial incidents.
A compromised email account can be used to request a fraudulent payment. A stolen credential can provide access to sensitive financial information. An impersonated supplier can lead to changed bank details. And a seemingly legitimate request can result in money being transferred to an account controlled by an attacker.
For financial teams, protecting the organisation therefore means protecting not only its systems, but also the information and processes behind financial decisions.
The human element is still critical
Technology plays an essential role in cybersecurity, but people remain a key part of the equation.
Attackers understand how organisations communicate and make decisions. They exploit urgency, authority and familiarity: an email from a "CEO" asking for an urgent transfer, a supplier requesting updated bank details, or a message asking an employee to re-authenticate their account. And attackers are increasingly moving to communication channels where users may be less suspicious.
Microsoft reported that 93% of voice phishing attacks kept victims on the phone long enough to begin social engineering. Microsoft also observed nearly 7.6 billion email-based phishing threats during Q2 2026, while malicious call attempts through workplace communication platforms such as Teams increased significantly.
Verizon's 2026 Data Breach Investigations Report similarly highlights the shift towards mobile social engineering, reporting that mobile-based attacks such as fraudulent texts and calls have a 40% higher success rate than traditional email phishing.
The lesson for businesses is simple: cybersecurity awareness cannot be limited to "don't click suspicious links". Employees need to recognise suspicious behaviour across the channels they use every day.
Financial organisations face an even broader risk landscape
The financial sector is particularly sensitive to cyber threats because financial organisations manage valuable data, critical infrastructure and transactions.
ENISA's 2026 Threat Landscape, covering incidents observed across the EU during 2025, identifies finance and banking among the targeted sectors, accounting for 6% of recorded incidents. ENISA also highlights the growing dependence of financial organisations on ICT infrastructure, third-party providers and supply chains.
This means that cybersecurity cannot be viewed in isolation.
A company may have strong protection around its own infrastructure and still be exposed through a compromised employee account, supplier, third-party service or connected application.
For financial teams, this creates a broader challenge: how can organisations maintain visibility and control over the information that supports financial decisions, while reducing the opportunities for attackers to exploit gaps between systems and people?
AI is changing the speed and scale of attacks
Artificial intelligence is adding another layer to the threat landscape.
AI can help attackers automate reconnaissance, personalise phishing messages, imitate legitimate communication and scale campaigns much faster. Microsoft's 2026 Digital Defense Report describes a shift towards increasingly automated attacks, with AI being applied across phishing, vulnerability discovery, reconnaissance and post-compromise activity.
At the same time, this does not mean that the fundamentals of cybersecurity have changed.
Strong identity controls, limited access, secure authentication, monitoring, employee awareness and well-defined processes remain essential.
In fact, as attacks become faster and more convincing, these fundamentals become even more important.
What can businesses do to reduce the risk?
There is no single solution to eliminate phishing. Businesses need a layered approach that combines technology, processes and employee awareness.
1. Strengthen access controls
Use multi-factor authentication (MFA), strong authentication policies and the principle of least privilege. Employees should only have access to the systems and information they need.
2. Train employees
Security awareness should go beyond identifying suspicious emails.
Employees should know how to handle:
Unexpected payment requests
Changes to supplier bank details
Suspicious messages
Unusual login requests
Impersonation attempts
Most importantly, businesses should establish clear processes for verifying unusual or sensitive requests.
3. Protect financial processes
Payment requests and changes to bank details should always be independently verified, particularly when they are unexpected or urgent.
A simple verification step can prevent a compromised account from becoming a fraudulent payment.
4. Centralise and monitor financial information
Having financial information spread across different banks, systems and spreadsheets can make unusual activity harder to identify.
Centralising data and improving visibility helps finance and treasury teams work with more complete and up-to-date information.
Businesses should also continuously monitor access, authentication and financial activity, regularly reviewing their security controls as threats evolve.
Verizon's 2026 DBIR reinforces the need for this layered approach, with vulnerabilities accounting for 31% of breaches and becoming the leading initial breach vector.
Cybersecurity is also financial risk management
Phishing may start with an email, text or phone call, but its consequences can extend much further — from compromised credentials and exposed financial information to fraudulent payments and operational disruption.
For finance and treasury teams, cybersecurity should therefore be treated as part of financial risk management.
The most resilient organisations combine strong access controls, employee awareness, verification processes and continuous monitoring to protect not only their data, but also the decisions, transactions and trust built around it.
Sources
Anti-Phishing Working Group (APWG) — Phishing Activity Trends Report, Q2 2026: APWG Phishing Activity Trends Reports
Microsoft — Digital Defense Report 2026: Microsoft Digital Defense Report 2026
Microsoft Threat Intelligence — Email Threat Landscape: Q2 2026 Trends and Insights: Microsoft Security Blog — Q2 2026 Email Threat Landscape
ENISA — ENISA Threat Landscape 2026: ENISA Threat Landscape 2026
ENISA — Threat Landscape: Finance Sector: ENISA Threat Landscape: Finance Sector
Verizon — 2026 Data Breach Investigations Report (DBIR): Verizon 2026 Data Breach Investigations Report