Phishing: What It Is, How It Works, and How to Stop It
The most common way accounts get compromised isn't a technical hack, it's a convincing message that tricks you into handing over access. Here's how to recognize it before it works.
What Is Phishing?
Phishing is a scam where someone impersonates a trusted person or organization, usually by email, text, or phone, to trick you into clicking a malicious link, opening an infected attachment, or handing over sensitive information like passwords or payment details.
The name comes from "fishing": the attacker casts bait (a fake but convincing message) and waits for someone to bite. It's the starting point for the large majority of data breaches and account takeovers, because it targets people rather than software, and people can be persuaded in ways that firewalls can't be.
How Phishing Works
Most phishing attempts follow the same basic pattern, whether they arrive by email, text, or phone call:
The Bait
A message arrives that looks like it's from someone you trust: a bank, a coworker, a delivery service, or a well-known company.
The Hook
It creates urgency or curiosity, an account problem, a package issue, an unexpected invoice, pushing you to act quickly without thinking it through.
The Catch
You click a link to a fake login page, open an infected attachment, or reply with sensitive information, and the attacker now has what they wanted.
Common Types of Phishing
Phishing isn't just fake emails anymore. Here are the forms it takes today:
Email Phishing
The classic version: a mass email pretending to be from a bank, retailer, or service you use, pushing you to click a link or open an attachment. Low effort, sent to thousands of people, relying on a small percentage taking the bait.
Spear Phishing
A targeted version aimed at one person or organization, using real details, like your name, employer, or role, to seem legitimate. Far more convincing than generic phishing because it's personalized.
Whaling
Spear phishing aimed at executives or high-value targets, often impersonating a CEO or vendor to authorize a wire transfer or request sensitive data.
Smishing (SMS)
Phishing delivered by text message, often impersonating a delivery service, bank, or government agency with a link to a fake tracking or verification page.
Vishing (Voice)
Phone-based phishing, including live calls or AI-generated voice messages, often impersonating tech support, a bank's fraud department, or a government agency to create urgency and extract information.
Quishing (QR Code)
Phishing via QR code, on a poster, parking meter, or email, that leads to a fake login page. QR codes are especially risky since the destination isn't visible until after you scan it.
Clone Phishing
A copy of a real, previously delivered email, with the legitimate link or attachment swapped for a malicious one, then resent as if it were a follow-up.
Business Email Compromise (BEC)
An attacker impersonates a coworker, manager, or vendor, often after gaining access to a real inbox, to request a wire transfer, gift cards, or a change to payment details.
Current Trends Worth Knowing
AI-written scams
The spelling and grammar mistakes that used to be a reliable red flag are disappearing. AI tools let attackers write fluent, personalized messages at scale, so the old "bad grammar" test matters less than it used to.
MFA fatigue / push-bombing
Attackers who already have your password send repeated multi-factor authentication prompts, hoping you'll approve one out of frustration or confusion. Never approve a login prompt you didn't request.
QR code scams (quishing)
QR codes on flyers, parking meters, or even in email attachments are increasingly used to bypass email link scanners and lead to fake login pages.
Deepfake voice and video
AI-generated voice clones are being used in vishing calls, sometimes impersonating a real manager or family member's voice, to add urgency to a request for money or credentials.
Warning Signs to Watch For
Urgency or fear
Threats of account suspension, legal action, or a limited-time deadline are designed to make you act before you think.
Mismatched sender address
The display name looks right, but the actual email address is off, a wrong domain, extra characters, or a free email service pretending to be a company.
Generic greeting
"Dear Customer" or "Dear User" instead of your actual name, especially from a company that would normally know who you are.
Suspicious links
Hover over a link (without clicking) to see where it actually goes. If the destination doesn't match the company it claims to be from, that's a red flag.
Unexpected attachments
Especially .zip, .exe, or macro-enabled Office files you weren't expecting, even from someone you know, since their account may be compromised.
Requests for credentials or payment
Legitimate companies don't usually ask you to "confirm your password" by email, or request payment via gift cards or wire transfer.
Poor spelling or odd phrasing
Not always present, especially with AI-written scams now, but still a common tell, particularly in less sophisticated attempts.
Too good to be true
Prize winnings, unexpected refunds, or investment opportunities that seem too generous are almost always a setup.
How to Protect Yourself
Pause before clicking
Urgency is the attacker's main weapon. Take 30 seconds to verify before acting, especially on anything involving money or credentials.
Verify through a separate channel
If an email or text claims to be from your bank, employer, or a service you use, contact them directly through their official website or phone number, not the one in the message.
Use a password manager
It won't autofill your password on a fake look-alike site, since it checks the actual web address, not just how the page looks.
Enable multi-factor authentication (MFA)
Even if your password is stolen, MFA can stop an attacker from getting in. Use phishing-resistant two-factor authentication (2FA) methods such as a security key or a passkey. Passwords is ancient/dinosaur technology. When supported, use passwordless authentication—such as passkeys or security keys—for a safer, simpler sign-in.
Check the URL carefully
Look for the exact domain name, not just a familiar-looking word inside a longer, unfamiliar address.
Don't scan unknown QR codes
Especially ones on flyers, stickers, or posters in public places, where a fake code could easily be placed over a real one.
Keep software updated
Updates often patch the vulnerabilities that malicious attachments and links try to exploit.
Report it
Reporting phishing attempts, to your email provider, IT team, or the platform involved, helps get scam messages and fake sites taken down faster.
Test What You've Learned
Take our free interactive Phishing 101 course, then check your understanding with a short quiz.
Some links on this site may be affiliate links.