Phishing is a scam in which criminals send messages that pretend to come from a trusted person or organization, hoping you will click a harmful link, open an attachment or hand over personal details. The most reliable way to spot it is to notice pressure and unusual requests, then check the message through a channel you already trust rather than the one the message gives you.
What is phishing, exactly?
The US Cybersecurity and Infrastructure Security Agency (CISA) describes phishing as criminals trying to get you to open harmful links, emails or attachments that could request personal information or infect your devices. The message itself is the “bait.” It usually arrives as an email, text, social media direct message or phone call, and it is designed to look as though it comes from someone you would normally trust.
The UK’s National Cyber Security Centre (NCSC) adds that the links in these messages lead to malicious websites. Those sites may install malware, which is software designed to cause harm, such as ransomware, or may simply try to steal passwords or money.
Phishing is one form of social engineering, a term for attacks that rely on human interaction and persuasion rather than on breaking technology. That distinction explains why it is so common: tricking a person is often easier than defeating a well-defended system.
How does a phishing attack actually work?
Most attacks follow the same rough arc:
- The lure. A message arrives claiming to be a bank, delivery company, employer, government department or colleague.
- The hook. It gives a reason to act now: a locked account, an unpaid bill, a prize, a problem with a parcel.
- The trap. A link opens a lookalike login page, an attachment launches malware, or the sender simply asks for a payment or a code.
- The payoff. Stolen credentials are used to enter the real account, or the money is gone.
A common version is the login credential phishing attempt, which CISA describes as a fake site that resembles a real vendor’s sign-in page. You type your password in good faith, and the attacker receives it.
CISA notes that attackers often ride on current events, such as health scares, economic worries, elections and holidays, because people are already paying attention to them. The NCSC lists “current events” among its tell-tale signs for the same reason, giving tax reporting season as an example.
Phishing, smishing, vishing and spear phishing
The same trick travels over several channels, and each has a name.
| Term | Channel | What it means |
|---|---|---|
| Phishing | Email or websites | Messages or fake sites that pose as legitimate organizations such as banks or charities |
| Smishing | Text message (SMS) | Texts with links that open webpages or prompt you to call a number |
| Vishing | Voice calls | Phone attacks, sometimes using spoofed caller ID so the call appears to come from a trusted source |
| Spear phishing | Any | A targeted version that uses details about a specific person or company to seem more convincing, as the NCSC describes it |
CISA’s description of vishing notes that caller ID can be faked through internet-based phone services, so a familiar name on your screen is not proof of who is calling.
What are the warning signs of a phishing message?
Agencies describe two overlapping sets of clues: how the message looks, and how it tries to make you feel.
Signs in the message itself
CISA lists these indicators:
- A sender address that imitates a real business with small changes. Its example is a misspelled brand name in a domain.
- Generic greetings and missing contact information.
- Links whose real destination does not match the text shown, or shortened links that hide where they go.
- Unsolicited attachments, often paired with false urgency.
- Requests to send personal or financial information.
Signs in the psychology
The NCSC names five levers that scam messages pull:
- Authority: the message claims to be from a bank, doctor, solicitor or government department.
- Urgency: a short deadline, or a threat of fines or other consequences.
- Emotion: an attempt to make you panic, or feel fear, hope or curiosity.
- Scarcity: an offer of something in short supply, such as tickets, money or a medical cure.
- Current events: a hook tied to news, big events or deadlines like tax reporting.
A message that combines several of these, for instance an official-looking sender, a deadline and a request for a password, deserves the most suspicion.
Is bad grammar still a reliable giveaway?
Not any more. CISA’s guidance notes that poor grammar used to be a warning sign, but artificial intelligence can now produce flawless messages, so readers should rely on the other signs. The NCSC’s guidance also cautions that training alone cannot teach people to catch every phishing email, which is why it recommends layered defenses rather than relying on any one person’s vigilance.
Our earlier look at why AI-assisted scam messages are harder to spot covers that shift in more detail. The practical consequence is simple: judge the request, not the polish. A beautifully written email that asks for a password is still a red flag.
What should you do with a suspicious message?
CISA frames the response as three steps: recognize, resist and delete.
- Recognize the signs above.
- Resist the urge to click links or attachments that seem too good to be true. Use the report option near the sender’s address, or the “report spam” button, if your email service has one.
- Delete the message without replying or clicking anything, including any “unsubscribe” link.
If a message could be genuine, both CISA and the NCSC point to the same method: do not use the links or phone numbers inside it. Contact the company through its official website or a number you already know. The NCSC says that a bank or other official source will never ask for personal information by email or ask you to confirm bank details by phone.
For organizations, the NCSC recommends learning the normal way key tasks such as payments are handled so that odd requests stand out, and verifying important email requests through a second channel such as a phone call.
Worked example: a parcel text
Imagine a text saying a parcel is held at a depot and a small fee must be paid within 24 hours, with a shortened link. Checking it against the lists above:
- Urgency: a 24-hour deadline.
- A request for payment details.
- A shortened link that hides its destination.
- No tracking number you recognize, and no parcel you are expecting.
Any one of these is a reason to pause. All four together are a reason to delete. If you really are waiting on a delivery, open the courier’s official app or website yourself and look up the parcel there.
Why do filters not catch everything, and how much does it matter?
Defenses exist at several layers, and the NCSC illustrates how they interact with a case study of a financial company with about 4,000 employees that received a malware campaign. The figures below are from that case study:
| Stage | Emails |
|---|---|
| Sent | 1,800 |
| Stopped by email filtering | 1,750 |
| Reached inboxes | 50 |
| Clicked, launching the malware | 14 |
| Failed to run because devices were up to date | 13 |
| Installed malware | 1 |
The arithmetic is worth noticing. Filtering stopped 1,750 of 1,800 messages, about 97 percent, yet 50 still arrived. Of those, 14 were clicked, which is 28 percent of the messages that got through. Only one infection resulted, and the affected device was seized and cleaned within a few hours, according to the NCSC. Twenty-five people reported the messages, including some who had already clicked.
The lesson is not that clicking is harmless. It is that filtering, software updates and a culture of quick reporting each removed risk that the others missed. The NCSC says people should not be blamed or punished for reporting, since fear of blame delays the alert that lets defenders act.
What if you already clicked or shared details?
Speed matters more than embarrassment. Drawing on CISA’s advice for suspected compromise:
- Report exposed work information to the right people, including network administrators.
- Contact your bank or other financial institution right away, close compromised accounts and watch for unexplained charges.
- Change any revealed passwords immediately. Use a different password for every account and never reuse one that has been exposed.
- Watch for signs of identity theft.
- Consider reporting the attack to the police and filing a report with the Federal Trade Commission in the United States.
In the UK, the NCSC says to forward scam texts to 7726, a free reporting number run with most phone providers, so the provider can investigate the sender and block them if the message is malicious. If you lost money or were hacked, it points people in England, Wales and Northern Ireland to the national police fraud reporting service or the number 0300 123 2040, and people in Scotland to Police Scotland on 101.
Protections that do not depend on spotting the fake
Because no one catches every message, CISA recommends layering: antivirus software, firewalls, email filters, any anti-phishing features in your email client and browser, and multifactor authentication (MFA), which requires a second proof of identity beyond a password. Our guide to how authentication methods compare explains why some forms of MFA hold up better than others against a convincing fake page. Passkeys go further, since they are tied to the genuine website and will not work on a lookalike.
Phishing is also a frequent first step in larger incidents. Our overview of how ransomware attacks unfold shows where a single stolen login can lead.
CISA’s page also advises checking for HTTPS and a padlock icon before sending sensitive information. Treat that as a minimum, not a verdict: it indicates an encrypted connection, not that the site’s owner is honest, so it does not replace checking the address and the request.
Pause, verify, report: a short conclusion
Phishing works by borrowing trust and manufacturing urgency. The defense is a habit: notice pressure, refuse to use the contact details in the message, verify independently and report what you receive. Reporting matters even when you were not fooled, because it helps providers and agencies block the sender for everyone else.
This is general information, not a substitute for professional security advice.
Sources: CISA; NCSC; Federal Trade Commission
