What is Phishing?
A social engineering attack where attackers impersonate legitimate entities through fake emails, websites, or messages to trick victims into revealing sensitive information like passwords, credit card numbers, or personal data.
Also known as: Phishing Attack
Phishing is the art of deception at scale. Attackers craft convincing messages that look like they're from your bank, employer, or favorite service, tricking you into handing over credentials.
Types of Phishing
Mass Phishing
- Sent to millions
- Generic messages
- "Your account has been compromised"
- Low success rate, high volume
Spear Phishing
- Targeted to specific individuals
- Researched and personalized
- References real details about you
- Much higher success rate
Whaling
- Targets executives/high-value individuals
- Highly customized
- Often involves wire transfers
- Multi-million dollar losses
Smishing & Vishing
- SMS-based (smishing)
- Voice/phone (vishing)
- Same tactics, different channel
Common Phishing Tactics
Urgency/Fear
- "Your account will be closed"
- "Unauthorized access detected"
- "Act within 24 hours"
Authority
- Impersonating CEO, IT, bank
- Official-looking logos/branding
- Legitimate-seeming email addresses
Curiosity/Reward
- "You've won a prize"
- "Package delivery notification"
- "Tax refund available"
Identifying Phishing
Email Red Flags
- Generic greeting ("Dear Customer")
- Spelling/grammar errors
- Mismatched sender domains
- Suspicious links (hover to check)
- Attachments from unknown senders
Website Red Flags
- Wrong URL (amaz0n.com, g00gle.com)
- No HTTPS padlock
- Poor design/different from real site
- Asking for unusual information
Protection Strategies
Technical
- Email filtering
- Browser warnings
- 2FA (phishing-resistant like hardware keys)
- Password managers (won't autofill on fake sites)
Behavioral
- Verify unexpected requests through separate channel
- Don't click links—type URLs directly
- When in doubt, contact company directly
- Report phishing attempts
If You've Been Phished
- Change passwords immediately
- Enable 2FA if not already
- Check for unauthorized activity
- Alert financial institutions
- Report to IT/security team
- Monitor accounts for suspicious activity
Related Terms
Social Engineering
Psychological manipulation techniques used to trick people into revealing confidential information or performing actions that compromise security. Social engineering exploits human trust rather than technical vulnerabilities.
Two-Factor Authentication
A security method requiring two different types of identification to access an account: something you know (password) plus something you have (phone, hardware key) or something you are (biometric). This significantly reduces the risk of unauthorized access even if your password is compromised.
Have more questions?
Use our guided flow to get the right next privacy step for Phishing.
Open Guided Flow