Everything You Need to Know About Phishing Attacks

What Is Phishing?

Phishing is a type of digital fraud where an attacker impersonates a trusted person, business, or institution to trick you into revealing sensitive information — such as your password, credit card number, or Social Security number. The name is a play on "fishing": attackers cast wide nets hoping someone takes the bait.

It remains the most prevalent entry point for account takeovers. According to the FBI's Internet Crime Complaint Center (IC3), phishing consistently ranks as one of the top reported cybercrime types in the United States each year. Understanding it is foundational to staying safe online — explore the full Scams & Phishing hub to broaden your knowledge beyond email alone.

How Phishing Attacks Are Constructed

A phishing attack has several moving parts, all designed to make you act without thinking. Attackers typically:

1. Choose a target audience — either broad (any Gmail user) or narrow (employees of a specific company).
2. Clone a trusted brand — copying logos, color schemes, and email templates from banks, shipping services, or social platforms.
3. Craft an urgent scenario — "Your account will be suspended," "Unusual sign-in detected," or "Your package is on hold."
4. Create a fake landing page — a website that looks identical to the real one but captures everything you type.
5. Send the message — via email, SMS (smishing), phone call (vishing), or even social media.

To understand exactly what happens the moment you interact with one of these links, see our companion piece: what actually happens when you click a suspicious link.

The Most Common Types of Phishing

Not every phishing attempt looks the same. Here are the variants you're most likely to encounter:

Email phishing

Mass emails impersonating banks, streaming services, or delivery companies. The broadest and most common form.

Spear phishing

Highly personalized attacks using your name, employer, or recent activity. Far more convincing and harder to detect.

Smishing

Phishing via SMS text message. Often claims to be a package delivery alert or bank fraud notice.

Vishing

Voice phishing — a caller pretends to be tech support, the IRS, or your bank to extract information verbally.

Clone phishing

An attacker duplicates a real email you previously received, swapping the legitimate link for a malicious one.

Spear phishing and bulk campaigns operate very differently. Our article on targeted vs. mass phishing attacks breaks down the key differences.

How to Spot a Phishing Attempt

Most phishing messages share recognizable warning signs once you know what to look for:

• Mismatched sender address: The display name says "PayPal" but the actual email address is support@paypa1-secure.net.
• Urgency or threats: Pressure to act immediately is a manipulation tactic, not a genuine business practice.
• Generic greetings: "Dear Customer" instead of your actual name suggests a mass-sent message.
• Suspicious links: Hover over any link (without clicking) to preview the real destination URL. If it doesn't match the claimed sender's domain, don't click.
• Unexpected attachments: Legitimate companies rarely email unsolicited PDFs or ZIP files asking you to "review your account."
• Grammar and spelling errors: Professional organizations proofread their communications. Consistent errors are a red flag.

Phishing is rarely just a technical trick — it's psychological. Attackers deliberately trigger anxiety or excitement to bypass your critical thinking. Our guide on social engineering and digital fraud explains exactly how these manipulation tactics work.

What to Do If You've Been Phished

Acting quickly can limit the damage significantly. Follow these steps in order:

1. Change your password immediately on the affected account, and on any other account where you reused the same password.
2. Enable multi-factor authentication (MFA) — this requires a second verification step (like a code sent to your phone) so a stolen password alone isn't enough to access your account.
3. Check for unauthorized activity — review recent logins, sent messages, and transactions for anything you don't recognize.
4. Notify your bank or card issuer if you entered any financial information.
5. Report the phishing message — forward phishing emails to reportphishing@apwg.org and to the impersonated company's abuse team. In the US, you can also report to the FTC at reportfraud.ftc.gov.

Phishing is one of several ways attackers break into accounts. Learn about lesser-known account takeover tactics so you can defend against the full threat landscape.

Building Long-Term Phishing Resistance

One-time vigilance isn't enough — the threat evolves constantly. These habits, practiced consistently, significantly reduce your exposure:

• Use a password manager to generate and store unique passwords for every account, removing the risk of credential reuse.
• Enable MFA on every account that offers it, prioritizing email, banking, and social media.
• Pause before clicking any unexpected link — even from a known contact, since their account may have been compromised.
• Keep your devices and apps updated; security patches close vulnerabilities that phishing follow-up malware often exploits.
• Stay informed about new phishing variants — attackers adapt quickly to current events and trending topics.

Small, repeatable behaviors compound over time into genuine resilience. Our piece on everyday habits that reduce phishing risk offers a practical, routine-based approach. For app-specific privacy guidance, visit the App Privacy & Safety hub.