What Is Phishing?
Phishing is a type of scam where a criminal pretends to be a trusted organization or person to get you to do something harmful. That might mean clicking a link to a fake login page, opening an infected attachment, sending money or sharing personal details.
The name comes from “fishing”: scammers send out bait and wait for someone to bite. Most phishing arrives by email, but the same tricks are used in text messages, phone calls, social media and even QR codes.
Phishing works because it targets people, not computers. A message that looks like it comes from your bank, your boss or a delivery company can catch anyone who is busy, worried or in a hurry.
How Big Is the Problem?
Phishing is the most common internet crime reported to the FBI. In 2025, the FBI’s Internet Crime Complaint Center (IC3) received 1,008,597 complaints in total, with reported losses of about $20.9 billion.1 Phishing and spoofing made up 191,561 of those complaints, the highest of any category.1
Those figures cover only crimes that were reported, so the real numbers are likely higher. Phishing is also often the first step in bigger attacks, such as stealing a work password to break into a company’s systems.
How a Phishing Attack Works
Most phishing attacks follow the same basic pattern.
The scammer first makes the message look trustworthy, often by copying a logo, a sender name or a writing style. Then they add pressure, such as a warning that your account will be closed. Finally they ask for one action. If you take it, they get what they wanted.
Types of Phishing
Phishing comes in several forms, depending on the channel and the target.
| Type | How it reaches you | Typical example |
|---|---|---|
| Email phishing | Mass emails | A fake bank email asking you to “verify your account” |
| Spear phishing | Targeted emails using your name, job or contacts | A message that seems to come from a colleague about a shared file |
| Smishing | Text messages | A delivery text with a link to “reschedule” a parcel |
| Vishing | Phone calls or voicemail | A caller claiming to be from your bank’s fraud team |
| Business email compromise | Emails that copy a boss or supplier | An urgent request to change bank details for an invoice |
| QR code phishing | Printed or emailed QR codes | A sticker on a parking meter that leads to a fake payment page |
Spear phishing and business email compromise are especially dangerous because they are tailored. The scammer may research you on social media or company websites first, so the message feels genuine.
Warning Signs of a Phishing Message
Most phishing messages share a handful of tell-tale signs. The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Trade Commission (FTC) both highlight these.23
- Urgency or threats: CISA points to urgent or emotional language, especially threats of serious consequences if you do not act immediately.3
- Requests for personal or financial details: the FTC notes that legitimate companies won’t email or text you a link to update your payment information.2
- Odd addresses and links: sender addresses or web links that are slightly wrong, such as a misspelled company name, or shortened links you cannot check.3
- Unexpected messages: an invoice you did not expect, a prize you did not enter or a problem with an account you do not have.2
- Generic greetings: “Dear customer” instead of your name, although targeted attacks may use your real name.
One old warning sign no longer works. CISA notes that polished grammar is not a reliable clue any more, because AI tools can produce flawless messages.3 Judge a message by what it asks you to do, not by how well it is written.
Why Phishing Works So Well
Phishing exploits normal human reactions rather than technical weaknesses. Fear, urgency, curiosity and the wish to be helpful all make people act before they think.
A message that says your account is locked triggers worry. One that offers a refund triggers hope. A request that seems to come from a boss triggers the instinct to help quickly. Scammers also time their messages well, for example around tax deadlines, holiday shopping or major news, when similar real messages are common.
Knowing these triggers helps you resist them. When a message makes you feel a strong urge to act right now, treat that feeling itself as a warning sign and take a moment to check before you do anything.
Get One Clear Explainer a Week
Stay one step ahead: get one plain-English explainer on tech, money and business every Thursday, with no spam.
Get the Newsletter →How to Check a Suspicious Message
When in doubt, check the message through a route the scammer does not control.
- Pause. Urgency is the scammer’s main tool. A real company will not lose your account because you took ten minutes to check.
- Ask whether it makes sense. The FTC suggests asking whether you even have an account with the company or know the sender.2
- Do not use its links or numbers. Contact the company through a website or phone number you know is real.23
- Check the sender address. Look at the full address, not just the display name.
- Hover before you click. On a computer, hovering over a link shows where it really goes.
How to Protect Yourself From Phishing
A few settings and habits make phishing far less likely to succeed, and far less damaging if it does. The FTC recommends several of them.2
| Protection | What it does |
|---|---|
| Multi-factor authentication | Requires a second step, such as a code or security key, so a stolen password alone is not enough |
| Automatic updates | Fixes security holes in your phone, computer and apps |
| Security software | Blocks many malicious links and attachments |
| Backups | Lets you recover your files if malware locks or deletes them |
| A password manager | Creates unique passwords and will not fill them on a fake site |
Multi-factor authentication is the single most effective step for most people. The FTC explains that it makes it harder for scammers to use a stolen password, because they would also need your second factor.2
What to Do If You Clicked or Replied
If you think you fell for a phishing message, act quickly; speed limits the damage.
- Change your password for the affected account, and anywhere else you used the same password. Turn on multi-factor authentication.
- Contact your bank or card company straight away if you shared payment details or sent money.
- Visit IdentityTheft.gov if your Social Security, credit card or bank account number may have been exposed. The FTC says it gives steps based on what was exposed.2
- Scan your device if you opened an attachment or clicked a link: update your security software, run a scan and remove anything it flags.2
- Watch your accounts and credit for unfamiliar activity, and consider a credit freeze.
Feeling embarrassed is normal, but phishing catches careful people every day. Reporting it quickly helps you and helps protect others.
How to Report Phishing
Reporting phishing helps companies and authorities block scams faster. The FTC lists these options.2
- Emails: forward them to the Anti-Phishing Working Group at reportphishing@apwg.org.
- Text messages: forward them to SPAM (7726).
- The FTC: report the attempt at ReportFraud.ftc.gov.
- Your email provider: CISA suggests using the report phishing or report spam option in your email app.3
Then delete the message. CISA advises not replying, opening attachments or clicking anything in it, including unsubscribe links.3
Real-World Examples to Recognize
Phishing messages change their stories, but a few themes come up again and again. These are illustrations of common patterns, not real messages.
- The account problem: “We noticed unusual activity. Log in within 24 hours or your account will be suspended.” The link leads to a fake login page.
- The missed delivery: a text says a parcel could not be delivered and asks for a small fee to rebook. The real goal is your card details.
- The unpaid invoice: an email with an attached “invoice” for something you never bought. Opening it may install malware.
- The urgent boss: a message that seems to come from a manager asking you to buy gift cards or pay a supplier today, quietly.
- The refund or prize: a promise of money owed to you, if you first confirm your bank details.
Each one combines a believable story with pressure and a single request. Recognizing the pattern is often easier than spotting technical clues.
Phishing on Social Media and Messaging Apps
Scammers also use social networks and chat apps, where messages can feel more personal. A friend’s hacked account may send you a link, or a fake customer support account may reply to your public complaint and ask you to “verify” your details.
Be wary of messages that move quickly to links, money or login codes, even from accounts you know. Never share a one-time code sent to your phone: a real company will not ask you to read it back to them. If a friend’s message seems out of character, check with them another way before you click anything.
Protecting Children and Older Relatives
Phishing often targets people who are less familiar with online scams. A short conversation about the warning signs can prevent a costly mistake.
Agree on simple family rules: never share passwords or codes, always call back on a known number before sending money, and ask someone you trust when a message feels odd. Turning on multi-factor authentication and automatic updates on their devices adds protection even if a message gets through.
Phishing at Work
For businesses, one successful phishing email can lead to stolen data, a ransomware attack or a fraudulent payment. Attackers often target staff who handle money, such as people who pay invoices, or who have access to important systems.
- Verify payment changes by phone, using a number you already have, never one in the email.
- Use multi-factor authentication on email and business accounts.
- Train staff regularly with real examples, and make reporting a suspicious email quick and blame-free.
- Limit access so that one stolen password cannot open every system.
A workplace where people feel safe saying “I think I clicked something” is much better protected than one where they hide mistakes.
AI and the Future of Phishing
AI tools are making phishing messages more convincing. They can write fluent emails in any language, copy a writing style and produce messages at scale. As CISA notes, good grammar is no longer a sign that a message is genuine.3
Voice cloning adds another risk: a phone call can now sound like a family member or a boss. Agreeing on a simple check with family and colleagues, such as calling back on a known number before sending money, is a practical defense. Our explainers on AI and large language models explain how these tools work.
Common Myths About Phishing
A few beliefs leave people more exposed than they think.
- “I would never fall for it.” Targeted messages can fool careful, experienced people, especially when they are rushed.
- “The padlock means the site is safe.” A padlock means the connection is encrypted, not that the site is honest. Scam sites can have one too.
- “It came from a known contact, so it is safe.” Accounts get hacked, and display names are easy to fake.
- “My spam filter catches everything.” Filters stop a lot, but not all, especially targeted messages.
Key Terms Explained
- Phishing: a scam using fake messages to steal information or money.
- Spoofing: faking a sender’s name, email address, phone number or website to look trustworthy.
- Smishing and vishing: phishing by text message and by voice call.
- Multi-factor authentication (MFA): a login that needs two or more proofs of identity.
- Malware: harmful software, often delivered through phishing links or attachments.
The Bottom Line
Phishing tricks you into helping the attacker, so your best defense is to slow down and verify. Treat urgent requests for passwords, payments or personal details with suspicion, contact companies through channels you trust and turn on multi-factor authentication. If you slip up, act fast and report it. For more, browse our tech and AI explainers.
A password manager adds another layer: it will not fill your login on a fake site.
The best backstop if a password is stolen is a second sign-in step. Our explainer on two-factor authentication shows how to set it up.
Frequently Asked Questions
It is a scam where someone pretends to be a trusted company or person to trick you into giving away passwords, money or personal details. It usually arrives by email, text or phone.
Watch for urgent threats, requests for personal or payment details, and sender addresses or links that look slightly wrong. If unsure, contact the company directly using details you already know.
Change the affected password, turn on multi-factor authentication and contact your bank if you shared payment details. Scan your device and visit IdentityTheft.gov if personal numbers were exposed.
Forward phishing emails to reportphishing@apwg.org and texts to 7726 (SPAM), then report at ReportFraud.ftc.gov. You can also use the report button in your email app.
Yes, phishing is not limited to email. By text it is called smishing and by phone it is called vishing, and both use the same tricks of urgency and impersonation.
It does not stop the messages, but it makes a stolen password much less useful. Scammers would also need your second factor, such as a code or security key.
Sources
- 1FBI Internet Crime Complaint Center: 2025 Internet Crime Report
- 2Federal Trade Commission: How to Recognize and Avoid Phishing Scams
- 3Cybersecurity and Infrastructure Security Agency: Recognize and Report Phishing
Every figure in this article is checked against the sources above. How we research and fact-check →
Get One Clear Explainer a Week
Stay one step ahead: get one plain-English explainer on tech, money and business every Thursday, with no spam.
100% free · No sign-up
