What Is Phishing and How Can You Recognize It?

How phishing works

Phishing is social engineering that persuades a person to reveal information or perform an unsafe action. The attacker may imitate a bank, delivery company, employer, cloud service, or friend.

The message often creates urgency: an account will close, a payment failed, a package is waiting, or unusual activity was detected. The goal is to stop the recipient from slowing down and checking independently.

Common forms of phishing

Email phishing targets many people with similar messages. Spear phishing uses personal or workplace details to appear more convincing. Smishing uses text messages, while voice phishing uses phone calls.

Modern attacks may also use fake QR codes, sponsored search results, malicious calendar invitations, browser notifications, and copied login pages.

Warning signs to check

• The message pressures you to act immediately.
• The visible sender name does not match the real address.
• The link domain is misspelled or unrelated.
• The message asks for a password, recovery code, or payment.
• The writing, branding, or context feels inconsistent.
• A login page appears after following an unexpected link.

Good grammar does not prove a message is legitimate. Attackers can copy professional templates and use personal information from previous breaches.

A safer response process

Do not use the message link. Open the official app, use a saved bookmark, or type the known address. Check whether the alert also appears inside the real account.

For workplace requests involving money, files, or credential changes, verify through a separate communication channel. A quick phone call can stop a convincing impersonation attempt.

Why one-time codes can still be stolen

A fake site can collect a password and then ask for the current authenticator code. The attacker relays both to the real site immediately. This is called real-time phishing.

Security keys and passkeys are more resistant because authentication is cryptographically tied to the legitimate domain. They do not solve every form of fraud, but they reduce credential-relay attacks.

What to do after entering information

1. Change the password from a trusted device.
2. Revoke active sessions.
3. Review recovery addresses, forwarding rules, and trusted devices.
4. Replace reused passwords elsewhere.
5. Contact the service through an official channel.
6. Monitor financial activity if payment details were involved.

Summary

Phishing succeeds by manipulating attention, not by defeating encryption directly. Slow down, navigate independently, use unique credentials, and adopt phishing-resistant authentication for important accounts.