What Is Phishing? How to Spot and Avoid It

Phishing is an attempt to trick you into giving away information or money by pretending to be someone you trust. It arrives as an email, a text, a phone call or a message, and it works by creating a reason to act quickly.

It remains the most common starting point for serious breaches, because it bypasses technical defences entirely and targets the person instead.

How it works

The structure is almost always the same.

1. Impersonation. The message appears to come from your bank, your employer, a delivery company or a service you use.
2. Pressure. Your account will be closed, a payment failed, a parcel is held, someone logged in from another country.
3. An action. Click a link, open an attachment, reply with details, transfer money.
4. The harvest. A convincing fake login page captures your password, or the attachment installs something.

The pressure is the key ingredient. Urgency stops people checking, and every phishing message is designed to make you act before you think.

The main types

• Bulk phishing. Generic messages sent to millions. Often sloppy, and still effective at scale.
• Spear phishing. Targeted at one person using real details about them. Far more convincing.
• Whaling. Spear phishing aimed at executives, usually to authorise payments.
• Smishing. By text message, often a fake delivery notice.
• Vishing. By phone, often someone claiming to be from your bank’s fraud team.
• Business email compromise. A supplier or colleague’s real account is used to request a payment change. These are the hardest to catch, because the sender is genuine.

The signs that actually help

Advice about spelling mistakes is outdated. Modern phishing is often well written. These checks hold up better:

• Check the sender’s full address, not the display name. Display names are trivially faked.
• Hover over links before clicking and read the real destination. On mobile, press and hold to preview.
• Look at the domain carefully. Attackers register lookalikes with swapped or inserted characters.
• Be suspicious of urgency. Real organisations rarely demand action within hours.
• Treat unexpected attachments as hostile, particularly anything asking you to enable content.
• Question any request to change payment details. Verify by phone using a number you already have, never one in the message.
• Notice generic greetings from organisations that know your name.

The strongest habit is simple: never use the link. If a message says there is a problem with your account, open the app or type the address yourself.

Why passwords alone are not enough

Phishing defeats passwords by design, because you hand yours over voluntarily. Two factor authentication adds a second step that a stolen password alone cannot pass.

Not all second factors are equal. App based codes are better than SMS, which can be intercepted through SIM swapping. Hardware security keys are stronger still, because they verify the site’s real address and will not respond to a lookalike domain.

A password manager also helps in an underrated way: it refuses to autofill on a domain that does not match, which catches fakes your eye would miss.

If you have already clicked

1. Do not panic, act quickly. Speed limits the damage.
2. Change the password for that account immediately, and anywhere you reused it.
3. Turn on two factor authentication if it was not already enabled.
4. Check for unfamiliar logins in the account’s security settings, and sign out other sessions.
5. Tell your bank if financial details were involved.
6. Tell your IT team if it was a work account. Delay helps the attacker, and nobody is blamed for reporting.
7. Scan the device if you opened an attachment.

Frequently asked questions

Is it dangerous just to open a phishing email?

Opening the email itself is normally safe. The danger is clicking links, opening attachments or replying.

Why do I get phishing texts about parcels?

Because almost everyone is expecting a delivery at some point, which makes it a plausible message to send blindly.

Can phishing happen on social media?

Yes, frequently, through direct messages, fake support accounts and compromised friends’ accounts.

Does a padlock in the address bar mean a site is safe?

No. The padlock only means the connection is encrypted. Phishing sites routinely have valid certificates.

Will a VPN protect me from phishing?

No. An encrypted connection to a fraudulent site is still a connection to a fraudulent site. See our guide on what a VPN does and does not do.

How do attackers get my email address?

Data breaches, scraped websites, purchased lists and guessed common formats at a company.