What Is a Phishing Attack?

Phishing is a type of social engineering attack where a malicious actor impersonates a trusted entity — a bank, employer, tech company, or even a friend — to trick a victim into revealing sensitive information such as passwords, credit card numbers, or personal data. The name is a play on "fishing," because attackers cast a wide net and wait for someone to take the bait.

Despite being one of the oldest forms of cybercrime, phishing remains devastatingly effective. Most large-scale data breaches begin with a single successful phishing email.

Common Types of Phishing

  • Email Phishing: Mass emails impersonating well-known brands, urging recipients to click a malicious link or download an infected attachment.
  • Spear Phishing: Highly targeted attacks customized to a specific individual using personal details harvested from social media or data breaches.
  • Smishing: Phishing delivered via SMS text messages, often impersonating delivery services, banks, or government agencies.
  • Vishing: Voice phishing — attackers call victims pretending to be tech support, tax authorities, or financial institutions.
  • Quishing: Using malicious QR codes to redirect victims to fraudulent websites.

Red Flags to Watch For

Recognizing a phishing attempt is your first and most important line of defense. Look for these warning signs:

  • Urgency or fear: Messages like "Your account will be suspended in 24 hours!" are designed to override your critical thinking.
  • Suspicious sender addresses: The display name may say "PayPal" but the actual email address is something like noreply@paypal-secure-login.net.
  • Generic greetings: "Dear Customer" instead of your actual name suggests a mass campaign.
  • Mismatched or suspicious URLs: Hover over links before clicking. A URL like amazon-account.support is not an Amazon domain.
  • Unexpected attachments: Legitimate organizations rarely send unsolicited invoice PDFs or "important documents."
  • Grammar and spelling errors: While AI is making phishing emails more polished, many still contain awkward language.

How to Protect Yourself

Enable Multi-Factor Authentication (MFA)

Even if an attacker steals your password, MFA adds a second verification step they likely cannot bypass. Use an authenticator app rather than SMS-based MFA where possible.

Use a Password Manager

Password managers autofill credentials only on the legitimate domain. If you're on a fake site, the autofill won't trigger — a useful safety net.

Verify Requests Through Official Channels

If an email asks you to take urgent action on an account, close the email and navigate directly to the official website by typing the address yourself — don't click the link in the message.

Keep Software Updated

Phishing often delivers malware. Keeping your browser, OS, and applications updated closes known security vulnerabilities that such malware exploits.

Report Suspicious Messages

Most email clients allow you to report phishing directly. Doing so helps train spam filters and protects others.

The Bottom Line

Phishing succeeds because it exploits human psychology — urgency, authority, and curiosity. Technical safeguards are important, but your awareness and skepticism are your strongest defenses. When in doubt, pause, verify, and don't click.