Criminals phone staff as they work at home, then tell them to log on to phishing websites that look like corporate portals.