1 Types of phishing

Phishing is commonly categorized by how an attacker delivers the trick and what outcome they seek. While tactics vary, most campaigns follow a similar pattern: lure the target with an attractive or threatening message, then steer them toward an action that exposes credentials, money, or device access.

1.1 Email phishing

Email phishing uses messages delivered through email systems to impersonate organizations or individuals. These emails often include a fraudulent link to a look-alike login page, a malicious attachment, or a prompt to “confirm” personal information. Attackers may also rely on compromised or spoofed sending addresses to appear legitimate.

In link-based phishing, the primary goal is to direct the victim to a deceptive URL. The landing page may resemble a trusted service, attempt to capture credentials, or guide the victim into providing additional personal data. The link can be shortened, obfuscated, or embedded behind a seemingly harmless button.

1.3 Attachment-based phishing

Attachment-based phishing distributes files that attempt to execute harmful actions when opened. These may be documents that display prompts to enable macros, compressed archives containing scripts, or other content designed to bypass casual inspection. Even when the attachment is not directly malicious, it can still serve to collect information or to persuade the user to complete an additional step.

1.4 Credential harvesting pages

Credential harvesting pages are web portals designed specifically to obtain login information. They typically mirror the appearance and layout of a real authentication screen, including logos, form fields, and error messages. Many campaigns rely on victims typing passwords into these forms, which the attacker captures in real time.

1.5 Spear phishing and targeting

Spear phishing refers to phishing directed at specific individuals or organizations rather than broad, untargeted campaigns. Attackers may research roles, communication patterns, recent events, or personal details to craft a message that seems credible to a particular recipient. This customization can improve success rates compared with generic scams.

1.6 Smishing and messaging-based phishing

Smishing uses SMS or other messaging platforms to distribute phishing content. Messages may include short links, prompts to verify an account, or “support” conversations intended to lead to credential submission. Because messaging channels can be perceived as more casual, the scam can also exploit trust and familiarity.

1.7 Vishing and voice-based phishing

Vishing involves phone calls where attackers impersonate help desks, banks, or other authorities. They often guide victims through steps such as confirming identity details, authorizing account changes, or visiting a fraudulent web page to “secure” an account. Voice cues—such as scripted urgency and persuasive language—are central to this approach.

1.8 Social media phishing

Social media phishing occurs through direct messages, comments, profile links, or ads. Attackers may impersonate friends or brands, offer “verification,” “giveaways,” or account recovery help, or direct users to external pages. Because links can be shared quickly and widely on these platforms, campaigns can spread faster than traditional email scams.

2 Common phishing lures and tactics

Phishing lures rely on psychological leverage—an urgency trigger, a fear prompt, a desire for convenience, or the appeal of rewards. The most effective lures reduce the victim’s ability to pause and verify by presenting a simple action with limited time to comply.

2.1 Brand impersonation

Attackers often impersonate recognizable brands, service providers, or internal company functions. The goal is to borrow trust associated with established organizations. Impersonation may extend beyond logos to include consistent styling, official-sounding sender names, and references to account features.

2.2 Urgency and time pressure

Time pressure is a common tactic, with messages claiming an account will be locked, a payment will fail, or a process expires soon. Urgency discourages careful inspection and encourages immediate action, such as clicking a link or entering credentials without verification.

2.3 Fear-based prompts

Fear-based prompts attempt to create anxiety about consequences like suspicious logins, overdue bills, or account compromise. These messages frequently instruct the victim to “secure the account” quickly, which can funnel the victim into an attacker-controlled workflow.

2.4 Too-good-to-be-true offers

Some phishing campaigns use offers that appear unusually advantageous, such as exaggerated refunds, unexpected rewards, or free services. These lures are meant to bypass skepticism by encouraging excitement and rapid engagement.

2.5 Fake account alerts

Account alert lures claim there is a problem requiring attention—password expiration, billing anomalies, delivery issues, or security alerts. Because real services often send similar notifications, the scam can mimic familiar patterns while directing users to a counterfeit resolution page.

2.6 Payroll, delivery, and invoice scams

Payroll and invoice scams target both individuals and organizations, using business contexts to make fraudulent requests feel normal. Delivery-related lures may claim a package is held and request address or payment confirmation through a link. These messages can be paired with realistic formatting and document “proofs,” such as fake invoices or tracking details.

2.7 “Verify now” workflow tricks

Many campaigns rely on a repetitive-sounding instruction: “verify now,” “confirm details,” or “review and update.” The instruction is designed to position the target as the responsible party, while the attacker captures whatever the victim submits or authorizes in response.

2.8 Malware delivery methods

Some lures are designed not just to steal information but to deliver malware. This can occur through attachments, link redirects, or downloads triggered by interaction. Malware delivery often tries to look routine (e.g., “document access,” “security update,” or “invoice PDF”) so that the victim’s behavior aligns with the attacker’s plan.

3 Red flags and detection basics

Detection approaches focus on inconsistencies, behavioral cues, and anomalies that indicate deception. No single sign is definitive, but a combination of indicators can strongly suggest a phishing attempt.

3.1 Suspicious sender identity

A suspicious sender identity may involve a mismatched display name, unusual reply-to addresses, or sending accounts that do not align with the claimed organization. Attackers can spoof superficial identifiers while underlying details reveal inconsistency.

3.2 Unexpected requests for credentials

Unexpected requests for passwords or one-time codes are a major red flag. Legitimate services generally do not solicit credentials through unsolicited messages; instead, they rely on established login flows and user-initiated access.

3.3 Mismatched domains and URLs

Phishing URLs often use look-alike domains, unusual subdomains, or unexpected top-level domains. Even minor differences—like additional characters or a changed spelling—can signal a counterfeit destination.

3.4 Deceptive link text vs. real destinations

Attackers may display benign-looking link text while the underlying destination points elsewhere. Checking the actual destination helps reveal mismatches between what the victim thinks they will open and where the link truly leads.

3.5 Malformed language and formatting anomalies

Poor grammar, inconsistent punctuation, and awkward wording can indicate a scam, particularly in untargeted campaigns. Formatting anomalies—such as inconsistent fonts, broken layouts, or mismatched branding—can also suggest tampering or hurried fabrication.

3.6 Attachment behavior and file cues

Attachment-based scams can show cues such as unexpected file types (e.g., executable content disguised as documents), unusual file extensions, or prompts to enable dangerous features. Even when the attachment appears document-like, behavior upon opening is an important diagnostic indicator.

3.7 Requesting unusual actions

Phishing frequently asks for actions that deviate from standard procedures, such as installing software, granting remote access, or providing sensitive information via chat. Unfamiliar steps are especially suspicious when they are paired with urgency.

3.8 Error pages and certificate warnings

Some phishing sites trigger browser warnings related to certificate issues or domain mismatches. Others avoid warnings by using more credible-looking infrastructure, but error pages or persistent security warnings can still help identify fraudulent pages.

4 Prevention and safe practices

Prevention combines operational habits, technical safeguards, and organizational guidance. Effective defenses reduce the chance that users will interact with fraudulent content and limit the damage if credentials are exposed.

4.1 Verifying requests via trusted channels

Verifying suspicious requests through an independent, trusted channel reduces reliance on the message itself. This can include contacting the organization using a known contact method or checking internal communications from official sources rather than responding to the message directly.

Safe handling practices include avoiding direct interaction with links from unsolicited messages and treating unexpected attachments cautiously. Users can reduce risk by opening resources through manually typed addresses or bookmarked services, and by using preview or inspection features where appropriate.

4.3 Multi-factor authentication (MFA) fundamentals

Multi-factor authentication adds an extra verification step beyond passwords, which can prevent account takeover even if credentials are compromised. The strongest MFA implementations resist phishing by ensuring the second factor is tied to the authentication session in a way that is difficult for counterfeit pages to reproduce.

4.4 Password hygiene and credential management

Password hygiene involves using unique passwords for different services, avoiding password reuse, and managing credentials securely. Credential managers can help users generate and store strong passwords while reducing the temptation to share or repeat them across sites.

4.5 Browser and email security features

Modern browsers and email clients include tools such as phishing protection, safe browsing, and warnings for suspicious downloads or sites. Leveraging these features can provide an additional layer of scrutiny without requiring users to be security experts.

4.6 Security awareness training basics

Security awareness training teaches people to recognize common lures and to respond appropriately. Effective training is practical: it emphasizes verification behaviors, explains likely scam patterns, and encourages reporting rather than attempting to “solve” suspicious messages.

4.7 Least privilege and access controls

Least privilege limits what accounts can do, so stolen credentials cause less harm. Access controls such as role-based permissions and segmentation reduce the blast radius of compromised accounts and make unauthorized actions less likely to succeed.

4.8 Email authentication concepts (e.g., SPF/DKIM/DMARC)

Email authentication technologies help receiving systems verify whether a message aligns with authorized sending infrastructure. SPF, DKIM, and DMARC are commonly discussed mechanisms that can reduce spoofing effectiveness and improve detection outcomes, particularly when paired with organizational enforcement policies.

5 Response and recovery

A timely response can reduce damage after a phishing encounter. The appropriate actions depend on what the victim interacted with—link, credentials, or attachment—but a general principle is to contain and verify account activity quickly.

If a link was clicked, immediate steps typically include closing the page, avoiding further logins there, and checking whether any downloads occurred. Users should then report the incident and monitor accounts for unexpected changes, particularly if the link led to an authentication prompt.

5.2 What to do if you entered credentials

When credentials are entered on a phishing page, the risk is elevated because the attacker may capture passwords and other sensitive inputs. Recovery usually starts with securing the affected account, changing the password, and reviewing recent sessions and security events.

5.3 What to do if you opened an attachment

Opening a malicious attachment can potentially impact the device. Response often involves disconnecting the device from the network if suspicious behavior occurs, running endpoint scans with reliable tools, and checking for persistence mechanisms. Organizational IT practices guide remediation steps.

5.4 Reporting to IT and service providers

Reporting helps organizations block ongoing attempts, update filters, and support affected users. Service providers and internal IT teams can also initiate account-side protections, such as forcing session resets, reviewing logs, or applying temporary restrictions.

5.5 Steps to secure accounts

Securing accounts may include forcing logouts, updating passwords, enabling or confirming MFA, and reviewing account recovery settings. It also helps to verify email forwarding rules and third-party app authorizations that could allow attackers continued access.

5.6 Resetting passwords and auditing sessions

Password resets should focus on affected services, with attention to whether passwords were reused elsewhere. Session auditing involves reviewing active logins and device lists, then terminating suspicious sessions and verifying the legitimacy of remaining activity.

5.7 Checking for signs of compromise

Signs can include account logins from unusual locations or times, new password reset emails that were not requested, unexpected profile or security changes, or new connected applications. On managed devices, monitoring tools can further reveal indicators of compromise.

5.8 Preserving evidence for investigation

Evidence preservation includes saving suspicious emails or messages, recording timestamps, and noting the links visited and pages displayed. Many organizations request forwarding of the original message headers or message artifacts to support analysis and improve filters.

6 Tools and protections

Security tools aim to prevent phishing interaction, detect suspicious content, and reduce the usefulness of stolen credentials. These protections function best when layered, because each tool may cover a different slice of the attack chain.

6.1 Phishing-resistant authentication approaches

Phishing-resistant authentication techniques reduce the ability of counterfeit pages to complete login flows. They typically involve cryptographic methods that bind authentication to a legitimate challenge and are less transferable to attacker-controlled sites.

6.2 Email filtering and sandboxing

Email filtering identifies suspicious messages based on reputation, content signals, and known patterns. Sandboxing can safely execute attachments or link previews in isolated environments to observe behavior before allowing them into a user’s normal workflow.

6.3 URL reputation and web protection

Web protections use blocklists, reputation scoring, and classification to limit access to malicious or newly observed phishing sites. Some systems also analyze redirect chains and attempt to detect suspicious landing page behavior.

6.4 Security training platforms and simulations

Training platforms may run interactive simulations that mimic phishing lures. When used responsibly, simulations teach recognition and response behaviors and can inform organizations about where additional guidance is needed.

6.5 Endpoint protection considerations

Endpoint protection includes antivirus, behavioral detection, and exploit mitigation features. These tools can help limit malware delivered via attachments and can detect malicious processes or unusual network behavior after interaction.

6.6 Browser isolation and hardened viewing modes

Browser isolation keeps remote content separated from the user’s device, limiting the impact of malicious pages. Hardened viewing modes and controlled rendering can reduce the risk of drive-by interactions and help enforce safer handling.

7 Measuring and improving defenses

Defense quality improves through measurement, feedback, and iterative policy updates. Organizations typically track outcomes such as reporting rates, blocked messages, and user recovery performance.

7.1 Phishing metrics and reporting

Useful metrics include the number of reported phishing attempts, click or credential-submission rates where available, and detection rates by channel. Careful measurement helps distinguish between blocked attacks and those that reach users.

7.2 Red-team and simulation exercises

Red-team exercises test the organization’s resilience by intentionally attempting phishing scenarios under controlled conditions. Simulations can validate user training and technical controls, while revealing where gaps exist in processes and tooling.

7.3 Incident postmortems and lessons learned

After an incident, postmortems document what happened, why controls failed, and how response actions performed. This process turns specific events into actionable improvements, such as tightening verification procedures or tuning filters.

7.4 Policy updates and user guidance

Policy updates translate lessons learned into operational changes. Guidance can include clearer reporting instructions, revised handling rules for links and attachments, and updated expectations for credential verification and account recovery steps.

7.5 Continuous improvement cycle

Phishing evolves alongside defenses, so improvement must be ongoing. Continuous monitoring, periodic training refreshers, and regular review of authentication and filtering strategies help maintain effectiveness over time.