Phishing in Colombia: Why It's Still Attackers' #1 Entry Point

It's tempting to picture sophisticated cyberattacks: zero-day exploits, advanced hacking tools, attackers with exceptional technical skill. The reality behind most incidents in Colombia is far less cinematic. According to figures from the Ministry of Information and Communications Technology, fraud — driven mainly by phishing and unauthorized use of email accounts — accounts for close to 80% of incidents reported in the country over the past two years. You don't need a sophisticated exploit when a well-designed email and one employee clicking without a second thought will do.

If phishing is such a well-known technique, why does it remain so effective? The answer has less to do with technology and more to do with human psychology. Phishing doesn't exploit a software vulnerability — it exploits trust, urgency, and routine. An email that looks like it's from the bank, with the right logo and an urgent tone about "suspicious activity on your account," triggers an emotional response that overrides critical thinking, especially when the person is busy, distracted, or checking email on their phone between other tasks.

Generic phishing — mass emails with obvious spelling errors — still exists, but it accounts for an increasingly smaller share of the real problem. The variants actually causing incidents today are far more targeted:

Emails impersonating Colombian banks and financial institutions, asking to "verify" account information over supposedly suspicious activity — the hook that consistently drives the most clicks because it directly appeals to the fear of losing money.

Emails impersonating real vendors or clients of the company, requesting a bank account change for a payment — a variant that has caused significant losses in business transactions.

Messages impersonating government agencies or public utilities, exploiting processes most people are already used to handling online.

Variants that no longer arrive only by email: smishing (via SMS) and vishing (via phone call) are growing specifically because many security filters were designed with only email in mind.

A successful phishing email is rarely the entire attack — it's the entry point that enables something bigger. Credentials stolen through phishing are frequently the first step toward a ransomware-as-a-service attack, toward unauthorized access to systems protected under Law 1273, or toward outright theft of funds through fraudulent transfers. Treating phishing as "just a suspicious email" seriously underestimates what it actually represents within the full chain of an attack.

Technology alone doesn't solve the phishing problem, because phishing is specifically designed to evade technology by appealing to the human factor. The measures that consistently show real impact combine both fronts: