What Is Phishing? How to Spot It and What to Do

In 2025, Americans filed 191,561 complaints about phishing and spoofing with the FBI’s Internet Crime Complaint Center. That made it the most reported crime type of the year, ahead of extortion, investment fraud and data breaches. The reported losses in that category came to about $215 million, which sounds almost modest next to the $20.9 billion lost to internet crime overall.

That gap is the most misunderstood thing about phishing, and it is where this guide starts. Phishing rarely does the damage itself. It is the first step, and the real cost lands somewhere else entirely, filed under a different name. This guide explains what phishing actually is, the forms it takes, how a modern phishing attack defeats defences that people assume are enough, what to do in the first ten minutes if you clicked, and which habits genuinely reduce your risk. No technical background required.

1. What phishing actually is

Phishing is a message that pretends to come from someone you trust, in order to get you to hand over information or take an action you wouldn’t otherwise take. That’s the whole definition. The message might ask for your password, trick you into approving a payment, or get you to open a file that installs something.

The important word is pretends. Phishing doesn’t break into anything. It asks, convincingly, and relies on you to supply the rest. That makes it fundamentally different from an attack that exploits a software flaw, and it explains why phishing has survived thirty years of better technology. You cannot patch a person.

Phishing is one branch of a bigger category called social engineering, which covers any manipulation of a person rather than a machine. What makes phishing specific is the delivery: a message sent at scale or aimed at a chosen target, usually with a link, an attachment or a request attached to it.

2. Where the damage really shows up

Go back to those FBI numbers, because the shape of them tells a story that the headline figure hides.

Business email compromise generated barely an eighth as many complaints as phishing, and more than fourteen times the losses: $3.05 billion. BEC is what happens after a phishing message works. An attacker gets into a real inbox, reads months of genuine conversation, waits for an invoice or a property settlement, and sends a payment-redirect request from an address that belongs to the person it claims to be from. There is nothing to detect, because the email is real.

The same pattern runs through everything else. Credential phishing feeds account takeover. A malicious attachment installs malware, which can end in ransomware weeks later. By the time the damage is recorded, it is filed as fraud, or a breach, or an outage. The phishing email that started it is a footnote, if it is mentioned at all.

Phishing is rarely the crime. It is the way in. Judging its importance by the losses recorded under its own name is like judging burglary by the cost of a broken window.

3. The assumption that gets people caught

Ask most people how they avoid phishing and you get a version of the same answer: they can tell. Bad spelling, odd grammar, a greeting that doesn’t sound like a real company. For about two decades that instinct worked well enough, because writing fluent, personalised English at scale was genuinely hard for the people sending these messages.

That has changed, and the organisation telling you so is the one that used to teach the old advice. CISA’s public guidance now lists urgent or emotionally appealing language, requests for personal or financial information, shortened links and lookalike addresses as the signs to watch, and explicitly notes that poor grammar and misspellings are no longer reliable indicators, because AI can produce polished messages.

There’s research behind that. In a controlled study published in Expert Systems with Applications in June 2026, researchers tested phishing emails on 101 participants split into four groups. A control group clicked at 12%. Emails written by human experts drew 54%. Fully automated, AI-written emails also drew 54%. The study is small, so the precise numbers deserve caution, but the direction is hard to argue with: the machine matched trained specialists, at a fraction of the effort. The researchers estimated AI automation could raise the profitability of large campaigns by up to fifty times.

So the honest version of the advice is uncomfortable. A well-written message is no longer evidence of anything. The defence has to move from how a message is written to what it asks you to do.

4. The types, by how they reach you

The names multiply but the idea doesn’t. Each variant is the same trick on a different channel, or aimed with different precision.

Bulk phishing. The same message sent to enormous numbers of people, impersonating a bank, a delivery service, a streaming account. Low effort, low success rate per message, and still worth it at volume.

Spear phishing. Aimed at one person, using real details about them: their manager’s name, a project they’re working on, a conference they attended. This is the version that catches careful people, and it’s the version AI has made dramatically cheaper to produce.

Business email compromise. The financial endgame described above. Often no link and no attachment at all, which is exactly why filters miss it. Just a request to change payment details, from someone who appears to have every right to ask.

Smishing and vishing. Phishing by text message and by phone call. These are growing faster than email, and they work better. In Verizon’s 2026 Data Breach Investigations Report, 41% of social engineering incidents involved a vector beyond email, and mobile-centric phishing by SMS and voice showed click rates roughly 40% higher than email phishing simulations. Large organisations faced a median of 48 SMS phishing attempts a year against corporate mobile devices, about one every eight days. Voice adds a newer problem, since a convincing cloned voice is now cheap to produce. Our guide on whether deepfakes are a real security threat covers how far that has come.

Pretexting. A live, invented scenario rather than a one-shot message, often impersonating an IT help desk or HR. Verizon’s 2026 report found it in 6% of all breaches and identified it as a significant route into ransomware incidents.

5. How phishing beats two-factor authentication

Turning on two-factor authentication is the single best thing most people can do for their accounts, and nothing below changes that. But it is worth understanding the one technique that gets past it, because the people who get caught are usually the ones who believed they couldn’t be.

The technique is called adversary-in-the-middle phishing. Instead of building a fake login page that merely collects your password, the attacker runs a server that sits between you and the real site and relays everything in both directions.

You receive a link and land on a page that looks exactly right, because it is being relayed from the genuine site. You type your password and it is passed through. You approve the prompt on your phone and that is passed through too. The real service, satisfied, issues a session cookie, which is the small digital pass that keeps you logged in so you don’t have to re-authenticate on every click. The attacker’s server copies it, loads it into their own browser, and is inside your account without ever typing your password or facing a prompt.

Microsoft has documented campaigns running this way, describing iterations that attempted to target more than 10,000 organisations, with open-source toolkits automating the whole process. In some cases the attacker reached the victim’s mailbox within about five minutes of the sign-in, searched for finance-related messages, and set up inbox rules to hide the replies. Microsoft’s own assessment is worth repeating precisely: this is not a vulnerability in multi-factor authentication. The attacker simply replays the proof that authentication already happened.

Two practical consequences follow. First, if you ever suspect this has happened, changing your password is not sufficient on its own, because a stolen session can outlive it. Use the “sign out of all devices” option on the account as well. Second, the defence that does hold is phishing-resistant authentication such as passkeys or hardware security keys, which are cryptographically bound to the real website’s address and simply will not respond to a lookalike domain.

6. How to spot one (and which old advice to drop)

Since the writing no longer gives it away, judge the request instead. The signs below are the ones that still work.

Urgency that forecloses thinking. CISA puts this first for good reason. Your account will be closed, the payment failed, the parcel will be returned, respond within the hour. Manufactured time pressure is the engine of the whole attack, because the one thing that defeats it is a pause.

An unexpected request for credentials, money or data. Legitimate organisations occasionally do ask you to log in. The question is whether this request arrived unprompted and is steering you to do it right now, through their link.

A link that doesn’t go where it claims. Hover over it on a computer, or press and hold on a phone, and read the real address. Check the domain carefully, since amazan.com and micr0soft-login.net are designed to survive a glance. Treat shortened links in unexpected messages as unreadable, because they are.

A channel switch. An email that wants you to call a number, or a text that wants you to move to WhatsApp, is usually trying to escape whatever is monitoring the first channel.

And one piece of advice to retire completely: the padlock in the address bar means nothing here. It confirms the connection is encrypted, not that the site is honest, and phishing pages routinely have one. Our guide on whether HTTPS means a website is safe explains why in full.

CISA’s own summary of what to do is three words: resist, delete, verify. Don’t click. Delete the message rather than replying, including any unsubscribe link. And if it might be genuine, verify through a channel you found yourself, never one the message supplied: type the company’s address into your browser, or ring the number on your card.

7. What to do if you clicked

Nearly everyone does eventually. Speed matters more than embarrassment, and the order below matters too.

If you only opened the page and typed nothing, close it. Don’t enter anything. Run a scan on the device for reassurance.

If you entered a password, change it immediately on the real site, reached by typing the address yourself. Then change it anywhere else you reused it, which is the step people skip and the one attackers count on. Our guide on how passwords actually get stolen explains why reuse is the multiplier.

Then end every active session. Use the account’s “sign out of all devices” option. Because of the session-stealing technique above, a password change alone may leave an attacker logged in.

Check what was changed while you weren’t looking. Look at your email account’s forwarding rules, filters, recovery address and recovery phone number. Attackers set up quiet forwarding so they keep reading your mail after you lock them out. This is the most commonly missed step of all.

If it’s a work device or account, report it now. Not after you’ve tried to fix it. Your security team’s ability to contain this depends on knowing early, and every competent team would rather hear about a false alarm than find out in three weeks. Our guide to what actually happens during a security incident shows what follows from the inside.

If money moved, call your bank immediately and ask about a recall. In the US you can also report to the FBI’s Internet Crime Complaint Center at ic3.gov, and speed genuinely affects whether funds can be frozen. Most countries have an equivalent reporting body.

8. What actually reduces your risk

Awareness is worth something, but it is the weakest control on this list because it depends on you being alert every single time. The useful measures are the ones that work on the day you are tired.

Use a password manager, and let it do the typing. This is the most underrated anti-phishing tool there is, and most people install one for the wrong reason. A password manager matches saved credentials to the exact website address. On a lookalike domain it simply won’t offer to fill anything. That silence is a warning your own eyes can miss, and it works even when the page is a perfect copy.

Move your most important accounts to phishing-resistant sign-in. Passkeys and hardware security keys are bound to the genuine site’s address, so they cannot be relayed to a fake one. Email first, since it can reset everything else, then banking.

Keep two-factor authentication on everywhere else. It stops the overwhelming majority of attacks that rely on a stolen password alone. Knowing that one sophisticated technique can bypass it is a reason to prefer stronger factors, never a reason to turn it off.

Adopt one rule for money and credentials: verify out of band. Any request to change bank details, send a payment or share a login gets confirmed through a channel you already had, on a number you already have. This single habit defeats BEC, the most expensive category in the data, and it costs a two-minute phone call.

Keep software updated. Some phishing relies on an attachment or page exploiting an unpatched flaw. Automatic updates close that route without any judgement required from you.

Report it, at work and at home. Reporting is how a targeted campaign gets spotted before it reaches a colleague who is having a worse day than you. If your organisation treats reporting as an admission of failure rather than a contribution, that culture is a security weakness in itself.

9. Frequently asked questions

What is phishing in simple terms?

Phishing is a message pretending to be from someone you trust, designed to make you hand over information or take an action, such as entering your password, approving a payment or opening a malicious file. It doesn’t break into anything; it persuades you to open the door.

What happens if I click a phishing link but don’t enter anything?

Usually nothing, as most phishing pages need you to type something to be useful. Close the page, don’t enter any details, and run a scan on the device. If you entered a password, change it on the real site and sign out of all devices.

Can phishing get past two-factor authentication?

Yes, with a technique called adversary-in-the-middle, where a fake page relays your login to the real site and steals the session cookie it issues. This doesn’t break two-factor authentication, it reuses the proof that you passed it. Passkeys and hardware security keys resist it, because they’re tied to the genuine website address.

How can I tell if an email is phishing if the spelling is perfect?

Judge the request rather than the writing, since AI now produces fluent text and CISA no longer treats poor grammar as a reliable sign. Look for manufactured urgency, an unexpected demand for credentials or money, a link whose real address doesn’t match, and pressure to switch channels. Verify through contact details you find yourself.

What is the difference between phishing and spear phishing?

Bulk phishing sends the same generic message to huge numbers of people. Spear phishing targets one person using real details about their job, colleagues or projects, which makes it far more convincing and much harder to spot.