Phishing
Fake emails, texts and websites built to steal your logins, money or data. Learn the tell-tale signs and the one habit that defeats almost every phishing attempt.
What phishing is
Phishing is a message that pretends to come from someone you trust so that you will click a link, open an attachment, type a password or send money. The name is a play on "fishing": the attacker casts out bait and waits for someone to bite. It is the most common way accounts get taken over and one of the most common first steps in business breaches, because it attacks people rather than technology.
A phishing message usually tries to do one of four things:
- Steal a login by sending you to a fake sign-in page that looks like Microsoft 365, Google, your bank or a delivery company.
- Install malware through an attachment (an invoice, a "scanned document", a voicemail file) or a download link.
- Move money by asking you to pay an invoice, buy gift cards or change bank details.
- Collect personal data such as your date of birth, card number or the answers to security questions.
The main types
| Type | What it looks like | Who it targets |
|---|---|---|
| Bulk phishing | "Your account is locked", "Package could not be delivered" | Everyone |
| Spear phishing | A message that uses your name, job title or a real colleague's name | Specific people |
| Whaling | Spear phishing aimed at executives or finance staff | Leaders, accountants |
| Business email compromise | A real or look-alike supplier or boss asking to change payment details | Companies |
| Clone phishing | A copy of a real email you received, with the link swapped | Anyone who got the original |
| Smishing and vishing | The same tricks by text message or phone call | Everyone |
Text and phone versions have their own guide: smishing and vishing.
Red flags to check in ten seconds
- Urgency or fear. "Act within 24 hours", "your account will be closed", "unusual sign-in detected". Pressure is the attacker's main tool.
- The sender address. Look at the actual address, not the display name.
support@micros0ft-security.comis not Microsoft. - The link destination. On a computer, hover over the link and read the real address in the corner of the browser. On a phone, press and hold. Read the domain from right to left: in
paypal.com.account-check.netthe real site isaccount-check.net. - An unexpected attachment, especially
.zip,.html,.iso, or Office files that ask you to "enable content". - A request that breaks the normal process: gift cards, crypto, a new bank account, or "keep this confidential".
- A generic greeting ("Dear customer") from a company that normally uses your name. Good spear phishing does use your name, so this sign is helpful but not reliable.
Spelling mistakes used to be the classic giveaway. With AI writing tools, many phishing emails are now fluent, so judge the request, not the grammar.
The single most effective habit: never sign in from a link in a message. Open the app you already have, or type the website address yourself, and check there. If the warning is real, you will see it.
Why passwords alone are not enough
Fake login pages capture whatever you type. If you reuse that password elsewhere, attackers try it everywhere (see credential stuffing). Two-factor authentication blocks most of these attacks, and passkeys go further: a passkey only works on the real website it was created for, so a look-alike site cannot use it at all. Read two-factor authentication and passkeys.
Some advanced phishing kits sit between you and the real site and steal your logged-in session even after you type a text-message code. Phishing-resistant methods (passkeys and hardware security keys) stop that technique too.
What to do if you clicked
Clicking a link by itself rarely causes harm on an up-to-date device. What matters is what happened next.
- You typed a password: change it right away on the real site, and anywhere else you used the same password. Sign out other sessions if the service offers it, and turn on two-factor authentication.
- You entered card details: call the number on the back of your card and ask for a replacement card.
- You opened an attachment or installed something: disconnect from the internet, run a full scan with your built-in antivirus, and if this is a work device, tell your IT team immediately. Speed matters more than embarrassment.
- You sent money: contact your bank at once; transfers can sometimes be recalled if you act within hours. In the US, report to the FBI at ic3.gov and the FTC at ReportFraud.ftc.gov.
More steps are in what to do if you get hacked.
Report it
Reporting helps block the next victim. Use the "Report phishing" option in Gmail or Outlook, forward phishing emails to reportphishing@apwg.org, and forward scam texts to 7726 (SPAM) in the US and UK. At work, use your company's report button even if you did not click.
