Phishing is a social engineering attack in which a criminal sends a fraudulent message that impersonates a trusted person or organization in order to trick the recipient into revealing credentials, transferring money, opening a malicious attachment or approving access. In cybersecurity, phishing is the most common initial access technique, because it targets human judgment rather than a software flaw.
The term covers email as well as SMS, voice calls, messaging apps, collaboration platforms and even QR codes. What unites these variants is deception plus a call to action: the message creates a believable pretext and pushes the target to act before thinking.
How a phishing attack works
A phishing campaign follows a recognizable sequence. The attacker chooses a pretext, such as a delivery notice, an invoice, a password expiry or a message from an executive, then builds the lure: a message with spoofed or look-alike sender details and a link, attachment or reply request. The final element is the payload, which is either a fake login page, malware or a fraudulent instruction.
Psychological pressure does most of the work. Phishing messages rely on urgency, authority, fear, curiosity and reward, because these emotions shorten deliberation. A message claiming that an account will be closed within 24 hours or that the chief financial officer needs a payment today is designed to bypass the careful checking a person would normally apply.
Technically, attackers use look-alike domains that swap or add characters, compromised legitimate mailboxes, URL shorteners, redirects through trusted services and pixel-perfect copies of real login pages. Modern kits act as adversary-in-the-middle proxies that relay the real site in real time, capturing not only passwords but also session cookies, which defeats one-time codes.
Generative text and voice tools have lowered the cost of convincing lures. Messages in fluent, context-aware language and cloned voices make the old advice to look for poor grammar unreliable, so defenses increasingly focus on verifying the request itself rather than judging how polished it looks.
Types of phishing
Phishing variants differ by channel, targeting and goal. Broad campaigns trade precision for volume, while targeted attacks invest research in a few high-value recipients.
| Variant | Channel or target | Typical goal |
|---|---|---|
| Bulk phishing | Mass email to many recipients | Harvest credentials or spread malware |
| Spear phishing | Researched message to a specific person | Access to one organization |
| Whaling | Senior executives | High-value approvals or data |
| Business email compromise | Finance staff via real or spoofed mailboxes | Fraudulent wire transfers |
| Smishing | SMS and messaging apps | Credentials or payment card data |
| Vishing | Voice calls, sometimes synthetic voices | Passwords, codes or remote access |
| Quishing | QR codes in email or print | Bypass link scanning on desktops |
| Consent phishing | Malicious OAuth application | Persistent mailbox or file access |
Business email compromise often involves no link or attachment at all. A plain-text request to change a supplier’s bank account or to buy gift cards can pass technical filters entirely, which is why it causes some of the largest financial losses among phishing variants.
Phishing compared with related attacks
Phishing is a delivery and deception method, not a type of malicious software. It frequently serves as the first stage of other attacks, which is why it is grouped with malware and intrusion techniques.
| Threat | What it is | Relation to phishing |
|---|---|---|
| Malware | Malicious software in general | Often delivered by phishing attachments |
| Ransomware | Malware that encrypts or steals data for extortion | Phishing is a common entry point |
| Trojan | Malware disguised as legitimate software | Typical phishing payload |
| Credential stuffing | Reusing leaked passwords at scale | Uses credentials that phishing may harvest |
| Pretexting | Fabricated scenario to obtain information | The storytelling core of phishing |
The boundaries matter for incident response. When a phishing email delivered malware, responders must examine the infected device and search for persistence. When it harvested credentials, the priority shifts to revoking sessions, resetting passwords and reviewing mailbox rules, OAuth grants and sign-in logs, because attackers often create forwarding rules or register their own authentication methods to keep access after the password changes.
Defenses that work against phishing
Effective protection combines technical controls, authentication design and people. Each layer catches what the others miss, and no layer alone stops every message.
| Layer | Control | What it stops |
|---|---|---|
| Email authentication | SPF, DKIM and DMARC with an enforcing policy | Direct spoofing of the organization’s domain |
| Filtering | Link rewriting, attachment sandboxing | Known malicious links and files |
| Authentication | Phishing-resistant MFA such as FIDO2 security keys or passkeys | Use of stolen passwords and relayed codes |
| Process | Call-back verification for payment changes | Business email compromise fraud |
| People | Training and an easy report button | Novel lures that bypass filters |
| Response | Rapid session revocation and password resets | Persistence after a successful lure |
The strongest single control is phishing-resistant authentication. Passkeys and FIDO2 keys bind each login to the genuine website domain, so a fake page cannot obtain a usable credential. One-time codes sent by SMS or generated by an app help against password reuse but can still be phished through real-time proxies.
Common misconceptions
- Phishing is easy to spot: well-crafted messages contain no spelling errors and may come from a genuinely compromised partner mailbox.
- The padlock means safety: phishing sites routinely use valid HTTPS certificates; the padlock proves encryption, not legitimacy.
- Training alone solves the problem: even careful staff click occasionally, so systems must limit the damage of a single click.
- Punishing clickers improves security: blame discourages fast reporting, which is often the most valuable signal a security team receives.
A mature program measures how quickly suspicious messages are reported, not only how many people click. Early reports allow the security team to remove the same message from every mailbox before others act on it.
Explained without jargon
Phishing is fraud dressed up as a familiar message. The sender pretends to be a bank, a delivery service, a colleague or a boss. The message asks for something quickly: log in here, open this file, pay this invoice.
The name comes from fishing. Attackers cast many baited hooks and wait for someone to bite. The best protection is to pause, check the request through another channel and report anything strange.
A typical use case
An accounts payable clerk at a manufacturing firm receives an email that appears to come from a long-standing supplier. It says the supplier has changed banks and attaches a letter with new account details for an outstanding invoice of 48,000 euros. The message arrives from the supplier’s real address, because the attacker had taken over that mailbox through an earlier phishing email.
The firm’s procedure requires call-back verification for any change of bank details, using a phone number already stored in the supplier record rather than one in the email. The supplier confirms it never changed banks. The clerk reports the message, the security team warns the supplier and blocks the account details, and the outcome is a prevented fraudulent transfer with no money lost.