Phishing is the most common cyberattack in the world. Over 90% of data breaches start with a phishing email, and billions of phishing messages are sent every day. No matter how strong your passwords or firewalls are, one convincing phishing message can bypass everything.
In this guide, we explain how phishing attacks work, the different types you will encounter, real-world examples, and exactly how to spot and avoid them.
What Is Phishing?
Phishing is a social engineering attack where an attacker impersonates a trusted entity to trick you into revealing sensitive information — like passwords, credit card numbers, or personal data. The attacker creates a sense of urgency or trust to manipulate you into acting without thinking.
Phishing can happen through email, text messages (smishing), phone calls (vishing), social media, and even fake websites. The common thread is deception — making something malicious appear legitimate.
How Phishing Attacks Work
A typical phishing attack follows this pattern:
- Research — The attacker identifies targets and gathers information about them (company, role, interests, contacts)
- Crafting the lure — They create a convincing message that impersonates a trusted brand, colleague, or authority figure
- Delivery — The phishing message is sent via email, SMS, social media, or other channels
- Exploitation — The victim clicks a malicious link, opens an infected attachment, or enters credentials on a fake website
- Harvesting — The attacker collects the stolen data (credentials, financial info, personal details)
- Monetization — Stolen data is used for account takeover, identity theft, financial fraud, or sold on dark web markets
Types of Phishing Attacks
1. Email Phishing (Mass Phishing)
The most common type. Attackers send thousands or millions of generic emails impersonating well-known brands like Microsoft, Amazon, Netflix, or banks. These emails typically claim there is a problem with your account and urge you to click a link to “verify” or “update” your information.
The link leads to a fake login page that looks identical to the real one. When you enter your credentials, they go straight to the attacker.
2. Spear Phishing
A targeted attack aimed at a specific individual or organization. Unlike mass phishing, spear phishing emails are personalized — they reference your name, job title, recent activities, or colleagues to appear legitimate.
Spear phishing is far more dangerous than generic phishing because the personalization makes it much harder to detect. Attackers often research victims on LinkedIn, company websites, and social media before crafting the message.
3. Whaling
A form of spear phishing that targets high-value individuals — CEOs, CFOs, executives, and other senior leaders. Whaling emails often impersonate board members, legal counsel, or government agencies, and request wire transfers, sensitive documents, or confidential data.
A single successful whaling attack can result in millions of dollars in losses. The FBI estimates that business email compromise (BEC) — a form of whaling — has caused over $50 billion in global losses.
4. Smishing (SMS Phishing)
Phishing delivered via text messages. Smishing messages often impersonate delivery services (“Your package could not be delivered”), banks (“Suspicious activity detected”), or government agencies (“Your tax refund is ready”).
Smishing is increasingly effective because people tend to trust text messages more than emails, and mobile screens make it harder to inspect URLs before clicking.
5. Vishing (Voice Phishing)
Phishing conducted over phone calls. Attackers impersonate tech support, bank representatives, or government officials and use urgency or fear to extract information. Common vishing scenarios include fake IRS calls, “your computer has a virus” tech support scams, and bank fraud department impersonation.
6. Clone Phishing
The attacker takes a legitimate email you have previously received, clones it, and replaces the links or attachments with malicious versions. Because the email looks identical to one you have already seen and trusted, clone phishing is extremely difficult to detect.
7. Pharming
A technical attack that redirects you from a legitimate website to a fake one without your knowledge — even if you type the correct URL. Pharming works by compromising DNS servers or modifying the hosts file on your computer. Unlike traditional phishing, pharming does not require you to click a malicious link.
Red Flags — How to Spot Phishing
Learn to recognize these warning signs:
Check the Sender Address
Look at the actual email address, not just the display name. Phishing emails often use addresses that look similar to legitimate ones but with subtle differences: [email protected], [email protected], [email protected].
Urgency and Fear Tactics
Legitimate companies rarely threaten immediate account suspension or demand urgent action. Messages saying “Your account will be locked in 24 hours” or “Immediate action required” are almost always phishing.
Hover Over Links Before Clicking
On desktop, hover your mouse over any link to see the actual URL in the status bar. If the displayed text says “Login to PayPal” but the URL points to paypal-secure-login.sketchy-domain.com, it is phishing. On mobile, long-press links to preview the URL.
Grammar and Formatting Errors
While AI-generated phishing emails are getting better, many still contain spelling mistakes, awkward phrasing, or inconsistent formatting. Legitimate companies have professional copywriters and proofreaders.
Unexpected Attachments
Be extremely cautious with email attachments you did not expect. Common malicious attachment types include .zip, .exe, .docm (macro-enabled Word), .xlsm, and .pdf files with embedded scripts.
Too Good to Be True
Emails claiming you won a prize, inherited money, or received a refund you did not request are classic phishing lures. If you did not enter a contest, you did not win one.
How to Protect Yourself From Phishing
Enable Multi-Factor Authentication (MFA)
MFA is the single most effective defense against phishing. Even if an attacker steals your password through a phishing page, they cannot access your account without the second factor. Use an authenticator app (like Google Authenticator or Authy) rather than SMS codes, which can be intercepted.
Use a Password Manager
A password manager will only auto-fill your credentials on the legitimate website domain. If you visit a phishing site that looks identical to the real one, your password manager will not auto-fill because the domain does not match. This is a built-in phishing detector.
Verify Through Official Channels
If you receive a suspicious email from your bank, do not click any links in the email. Instead, open a new browser tab, type the bank’s URL directly, and log in. Or call the phone number on the back of your card. Never use contact information provided in a suspicious message.
Keep Software Updated
Software updates patch vulnerabilities that phishing attacks exploit. Keep your operating system, browser, and email client updated. Enable automatic updates whenever possible.
Use Email Filtering
Modern email providers (Gmail, Outlook) have built-in phishing detection that catches most mass phishing emails. Ensure spam filtering is enabled and report phishing emails when they get through to improve the filters.
Use a VPN on Public Networks
On public WiFi networks, attackers can perform man-in-the-middle attacks to redirect you to phishing pages. A VPN encrypts your traffic and prevents this type of attack.
What to Do If You Fall for a Phishing Attack
Act fast if you suspect you have been phished:
- Change your password immediately — For the compromised account and any other accounts using the same password
- Enable MFA — Add multi-factor authentication if it is not already enabled
- Check for unauthorized access — Review account activity, login history, and connected devices
- Scan for malware — If you opened an attachment, run a full antivirus scan
- Report the phishing — Forward phishing emails to your email provider’s abuse address and report to [email protected]
- Monitor your accounts — Watch for suspicious activity on financial accounts and consider a credit freeze if personal data was compromised
Frequently Asked Questions
Can phishing emails contain malware?
Yes. Phishing emails can deliver malware through malicious attachments (Word docs with macros, PDFs with scripts, ZIP files with executables) or through links that lead to drive-by download sites. Never open unexpected attachments, even from known contacts.
Are phishing attacks getting more sophisticated?
Significantly. AI tools now generate flawless phishing emails in any language. Attackers use legitimate services (Google Docs, Microsoft Forms, Dropbox) to host phishing pages, making URL-based detection harder. Real-time phishing proxies can even bypass MFA by relaying authentication tokens.
How do I report phishing?
Forward phishing emails to your email provider ([email protected], [email protected]). In Gmail, click the three dots menu and select “Report phishing.” In Outlook, use the “Report” button. You can also report phishing websites to Google Safe Browsing.
Final Thoughts
Phishing remains the most effective attack vector because it targets the weakest link in any security system — humans. Technical defenses like email filters and antivirus help, but the ultimate defense is awareness and skepticism.
Stay vigilant: verify sender addresses, hover over links, question urgency, and use MFA on every account. Combined with a strong password manager and good privacy habits, you can make yourself a much harder target for phishing attacks.