What phishing is
Phishing is an attempt to trick someone into handing over information, money or access by pretending to be someone trustworthy. The message might claim to come from a bank, a delivery company, an employer, a government office or a colleague. Its goal is usually one of three things: collecting passwords or card details through a fake sign-in page, getting the recipient to install harmful software through an attachment or link, or persuading them to make a payment or share sensitive details directly.
Phishing works because it targets attention and emotion, not technical flaws. Messages are often built to feel urgent, frightening or tempting, so the reader acts before thinking.
Variations worth knowing
- Email phishing: the classic form, often sent to large numbers of people with generic wording.
- Spear phishing: a targeted message that uses details about a specific person or organization, such as a manager’s name or a real project, to seem credible.
- Smishing: phishing by text message. Short texts about parcels, account problems or unpaid fees are common, and a small screen makes it harder to inspect a link.
- Vishing: phishing by phone call, sometimes with a caller claiming to be from a bank or technical support.
- Spoofed messages: the sender name or address is made to look genuine. A display name can say anything, and a web address can be altered by a single character or use lookalike letters.
- Business email compromise: a message that appears to come from an executive or supplier, asking for a payment or a change of bank details.
Tricks that go beyond phishing, such as pretexting in person or by phone, are part of the wider topic of social engineering.
Common warning signs
No single sign is proof, and well-made scams can avoid all of them. Still, these are worth noticing:
- Pressure and urgency. Threats of closed accounts, penalties or missed deliveries, with a tight deadline.
- Unexpected requests. A message you were not expecting that asks for a password, one-time code, payment or gift cards. Legitimate organizations generally do not ask for a password by message.
- Mismatched details. A sender address that does not fit the organization, a link whose real destination differs from the text shown, or a greeting that is oddly generic.
- Unusual payment methods. Requests for gift cards, cryptocurrency or transfers to a new account.
- Odd wording or formatting. Spelling and tone can be a clue, although better writing tools mean polished scams are increasingly common.
- Unexpected attachments. Especially invoices, documents or files you did not request.
Habits that help
- Pause before acting. Urgency is the scammer’s main tool, and a short pause often breaks it.
- Go to the source yourself. Instead of using the link in a message, open the organization’s official app or type its address, or call a number you already trust.
- Check links before clicking. On a computer, hovering over a link often shows where it goes. On a phone, pressing and holding may show it.
- Never share one-time codes. Anyone asking for a code sent to you is likely trying to take over your account.
- Use multi-factor authentication. It does not make accounts immune, but a stolen password alone is then less likely to be enough.
- Consider a password manager. These tools fill credentials only on the sites they were saved for, which can act as a quiet warning when a lookalike site does not trigger autofill.
- Keep software updated. Browsers and email programs often block known malicious pages and attachments.
- Verify payment changes separately. If a supplier or colleague asks for new bank details, confirm through a different channel.
If you clicked a bad link
Mistakes happen to careful people. Acting calmly and quickly generally limits the damage. These steps are general, not a guarantee, and the right response depends on what was exposed.
- If you only clicked and nothing loaded or was entered: close the page. Consider running a scan with your security software and keep an eye on your accounts.
- If you entered a password: change it immediately on the real site, and anywhere else the same password was used. Turn on multi-factor authentication if it is not already on.
- If you entered card or bank details: contact the bank or card issuer using the number on your card or their official site. They can advise on blocking cards and watching for fraud.
- If you opened an attachment or installed something: disconnect the device from the network, run a security scan, and consider asking a professional for help. Change important passwords from a different, clean device.
- If you sent money: contact your bank straight away, as quick reports sometimes improve the chances of stopping or recovering a payment, though this is never certain.
- If it happened on a work device or account: tell your IT or security contact promptly. Reporting quickly is usually more helpful than worrying about blame, and organizations often have an incident response process for exactly this.
It can also help to report the message to the impersonated organization, your email provider or a national fraud reporting service, if one exists where you live. Watch for follow-up scams, since people who have responded once are sometimes targeted again, including by fake “recovery” services.
For families and older relatives
Scammers often adjust their messages for different audiences. Older adults are targeted with tech-support and relative-in-trouble stories, and children may be targeted through games and social platforms. A simple household rule helps: nobody has to decide on the spot, and anyone can say “let me call you back on the number I already have.” More on this appears in discussions of elder scams and general online safety.
Staying realistic
Perfect detection is not possible. Some phishing messages are very convincing, and filters miss some of them. The goal is to build habits that make a successful attack less likely and less costly: slow down, verify through a separate route, protect accounts with more than a password, and report problems early.