Watch for unusual requests arriving from familiar contacts, sudden changes to payment details, unexpected urgency, and messages that shift between channels to keep pressure high. Repeated account takeover attempts, odd login patterns and conversations that do not fit established business routines are also strong indicators.
How to Recognise That Multichannel Phishing Is Taking Hold
multichannel phishing starts looking successful when the attacker moves a victim from a single suspicious message into a believable interaction chain. The clearest sign is not one odd email, but a pattern of cross-channel pressure: email, chat, SMS, phone, collaboration tools, or payment instructions all begin to point in the same deceptive direction.
At that stage, the attacker is no longer just testing a lure, they are steering behaviour. That makes the warning signs broader than classic phishing indicators and more focused on whether normal business relationships, routines, and approval paths are being bent out of shape.
What Behavioural Changes Usually Appear First?
The earliest successful phishing signs are usually social and procedural. A familiar sender suddenly asks for a payment reroute, a password reset, or a quick exception that bypasses normal review. The message may sound routine, but the content creates urgency, narrows time for verification, and encourages the recipient to move the conversation to another channel where scrutiny is weaker.
Another strong indicator is inconsistency. The same request may appear across multiple channels with slightly different wording, different contact details, or a changed tone designed to keep the target engaged. When a conversation stops sounding like the real person or team you know, treat that drift as a meaningful warning sign, not a communication quirk.
What Technical and Operational Signals Suggest the Campaign Is Working?
Successful multichannel phishing often leaves traces in account behaviour and workflow disruption. Repeated login attempts, unusual MFA prompts, unexpected password resets, new device registrations, and access from atypical locations or times can all show that the attacker is attempting to turn social engineering into account access. If the target account then starts sending unusual replies or forwarding chains, the compromise may already be active.
Operationally, look for requests that no longer fit the approved business process. Payment detail changes, vendor bank updates, invoice redirection, gift card requests, or document-sharing demands become more suspicious when they arrive outside the normal approval path or arrive after an earlier email, chat, or phone call has created pressure to trust them.
Cross-checking matters because the attacker often relies on channel switching to evade a single control. A message that looks weak in isolation may become convincing when a fake caller, spoofed chat account, and realistic email all reinforce the same false instruction.
Risk and Threat Considerations
Multichannel phishing is dangerous because it exploits both human trust and channel fragmentation. When one channel is easy to challenge, the attacker simply pushes the victim toward another channel where context is thinner and verification is less likely.
Failure mechanism: The attacker gains credibility through repetition, urgency, and apparent continuity across channels, then uses that trust to capture credentials, approve payments, or redirect business processes before defenders notice the inconsistency.
Impact: Once the attack is succeeding, the fallout can include account takeover, fraudulent transfers, exposure of sensitive conversations or documents, and wider compromise if the attacker reuses the access for internal movement or impersonation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1566 — Phishing | Multichannel phishing is an ATT&CK phishing pattern with credential and trust abuse. |
| Recommendation — Map observed lure sequences to T1566 and correlate them with account access anomalies. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Successful phishing often shows up as abused user authentication and account access. |
| AU-6 — Audit Review, Analysis, and Reporting | Phishing success is often visible in logs, login anomalies, and unusual account activity. | |
| AC-6 — Least Privilege | Limiting permissions reduces the damage when phishing captures an account. | |
| Recommendation — Require strong user authentication and investigate abnormal login patterns immediately. Review authentication and messaging logs for atypical sequences and suspicious access patterns. Restrict account privileges so a successful phish cannot trigger broad business impact. | ||
Practitioner Guidance
What to verify: Treat any cross-channel request for money, credentials, or urgent exception handling as untrusted until it is verified out of band with a known-good contact path. Verification should confirm both the requestor and the business context, because attackers often fake one more convincingly than the other.
What good looks like: Teams pause on channel shifts, challenge urgency, and use established approval paths even when the message appears to come from a known colleague or vendor. The strongest defensive signal is not perfect detection, but consistent refusal to let pressure override process.
Common mistake: Teams often look only for a malicious email and miss the broader interaction sequence. In multichannel phishing, the real indicator is often the combination of social pressure, account anomalies, and process deviation rather than any single message.
Practitioner takeaway: When a request starts to move from one channel to another in ways that increase urgency or reduce verification, assume the attacker is testing whether the organisation will let convenience outrun confirmation.
Related resources from NHI Mgmt Group
- What are the signs that man-in-the-middle phishing is succeeding against banking users?
- Why do phishing attacks still succeed even when people know the warning signs?
- Why do phishing campaigns that use links keep succeeding even when awareness training is in place?
- What are the signs that phishing awareness training is not working well enough?