Fundamentals Phishing
Phishing is a trick that uses fake messages to steal passwords, money, or personal details. The name comes from fishing. Attackers cast a wide net of bait and wait for someone to bite. Anyone with an inbox or a phone can become a target.
How a Phishing Attack Works
A criminal sends a message that looks like it comes from a trusted source such as a bank, a delivery company, or a manager. The message urges the reader to click a link or open a file. The link leads to a copy of a real login page. Anything typed there goes straight to the criminal.
+----------+ +--------------+ +-----------+ +-----------------+
| Attacker | -> | Fake message | -> | Victim | -> | Fake login page |
+----------+ +--------------+ +-----------+ +-----------------+
^ |
| v
+------------- Stolen username and password -----------+
Types of Phishing
Email Phishing
Email phishing reaches thousands of people at once with a generic message.
Spear Phishing
Spear phishing targets one person. The attacker studies the victim's job, friends, and habits to write a convincing note.
Whaling
Whaling aims at senior leaders such as chief executives and finance directors. A successful hit can move large sums of money.
Smishing
Smishing uses text messages. A fake parcel notice with a link is a common form.
Vishing
Vishing happens over phone calls. The caller pretends to be a bank officer or a technical support agent.
Red Flags in a Message
| Red Flag | What It Looks Like |
|---|---|
| Odd sender address | support@bank-secure-alerts.example instead of the real bank domain |
| Pressure and urgency | "Your account closes in one hour" |
| Mismatched link | Visible text shows one site while the link points elsewhere |
| Unexpected attachment | An invoice that nobody ordered |
| Request for secrets | A message asking for a password or one-time code |
| Poor writing | Spelling errors and awkward greetings |
Sample Fake Message
From: Account Security <alerts@secure-bank-help.example> Subject: Urgent - Verify your account now Dear Customer, We found unusual activity. Click the link below within 30 minutes or we will suspend your account. http://secure-bank-help.example/verify
This message shows four warning signs. The greeting is generic, the sender domain is strange, the deadline is short, and the link does not belong to the real bank.
Safe Habits Before Clicking
- Pause and read the message slowly.
- Hover over a link to see the real address.
- Type the official website address into the browser instead of clicking.
- Call the company using the number printed on a card or the official website.
- Check unexpected attachments with the sender through another channel.
If You Already Clicked
- Change the affected password at once on the real website.
- Turn on multi-factor authentication for the account.
- Run a security scan on the device.
- Tell the bank or employer so they can watch for misuse.
- Report the message to the email provider as phishing.
Protection Tools
Email filters catch many fake messages before they reach an inbox. Browsers warn users about known harmful sites. Password managers refuse to fill in a login on a fake domain, which gives a useful silent alarm. Multi-factor authentication limits the damage even after a password leaks.
Why Phishing Works
Phishing exploits human nature rather than computer flaws. Fear, curiosity, and the wish to help push people to act fast. Attackers time messages around tax season, holiday shopping, and news events, when people expect official notices. Busy readers skim messages and miss small clues. Slowing down for ten seconds defeats most attempts.
Phishing at Work
Companies run simulated phishing exercises. Staff receive harmless test messages, and the security team measures how many people click. Those who fall for a test receive friendly coaching instead of blame. Over time, click rates drop and reporting rates rise.
Key Points
- Phishing relies on trust and urgency rather than technical skill.
- Spear phishing and whaling target specific people with personal details.
- Checking the sender and the link exposes most fake messages.
- Reporting a suspicious message protects other people too.