Phishing is a method of deception that uses a forged email or some other form of communication from a source of authority such as your bank, delivery service or employer to obtain information about yourself including passwords and credit card information. You can identify a phishing attempt by looking out for four main things.
It’s not an unusual occurrence. According to the FBI’s Internet Crime Report of 2025, phishing and spoofing topped the list of complaints, with 191,561 reports, while reported losses due to cybercrime have exceeded $20 billion (Biometric Update). The Anti-Phishing Working Group (APWG) also counted 425,808 phishing attacks in June 2026 alone, the highest monthly total since April 2023 (APWG Q2 2026 report).
The bright side of the matter is that most of the phishing scams fall apart under scrutiny. During this course, you will gain all the information regarding what phishing means, how phishing takes place, and what you have to do if you get phished.
Quick Summary
- Phishing tricks you into making an action before thinking.
- Verify the source address, the actual URL being linked and the request made.
- Don’t give out any passwords, PINs or one-time passwords to any unknown sender.
- Use two-factor authentication and password management applications.
- In case of clicking on something, update all your passwords and inform your bank immediately.
What Is Phishing?
Phishing refers to fraudulent activity on the Internet where a perpetrator tries to trick you into revealing your personal data by pretending to be a legitimate business or individual. The name phishing is derived from fishing, as the criminal uses a hook to catch his/her victim.
Usually, the bait takes the form of a message that appears to be legitimate at first glance. The message can be regarding your account being suspended, your package being undeliverable, or you winning some kind of a prize. The link embedded in the message will lead to a fake website copy, which sends everything that you enter directly to the fraudster.
Common Types of Phishing Scams
Phishing is not confined to emails any more. Below are the different phishing types that you will come across.
|
Type |
How it reaches you |
What it looks like |
|
Email phishing |
|
A message from a bank or Microsoft saying your account will close unless you log in |
|
Spear phishing |
Email, LinkedIn, chat |
A message that uses your name, job or recent activity to look personal |
|
Smishing |
SMS or WhatsApp |
A text message about the failure to deliver, card being blocked or a refund with a shortened link |
|
Vishing |
Phone call |
A caller who claims to be from your bank or a government office and asks for an OTP |
|
Quishing |
QR code |
A QR code on a poster, parking sign or email that opens a fake login page |
|
Social media phishing |
Direct messages, fake ads |
A friend sharing a link, or a fake support account replying to your complaint |
|
Business email compromise |
|
The message will be one that seems to have come from either your employer or a vendor requesting a payment or bank account change. |
However, spear phishing is one other form of attack which should be highlighted because it involves sending emails customized to you following your details which have been gathered from your social networking pages and even from any previous data breaches in your company website.
How to Recognize a Phishing Scam: 8 Red Flags
No single sign can identify an impersonation email, but a couple will definitely do.
The sender address is slightly off
Make sure to check the actual email address and not just the name of the sender. These people make fake websites that look very much like real websites, such as paypa1.com or support-amazon-help.com. If the email address of your bank seems strange, then proceed with caution.
The message creates panic or urgency
Your account will be suspended within 24 hours. Unusual login attempt noted. Reputable firms offer you some time and notify you via your account dashboard as well. This is because pressure is the scammers’ primary weapon.
The link goes somewhere else
For computer users, place the cursor on top of the link but don’t click on it, and check the domain at the bottom of the browser. In case of a mobile device, long tap the link to see the preview. If the domain name doesn’t match that of the company, don’t proceed. Shortened links, bit.ly etc., deserve special attention.
It asks for private information
The banks, tax collectors, and online stores will never ask for your password, PIN, full credit card number, or OTP by email, SMS, or phone call. It should be regarded as fraud if you get such requests.
You were not expecting it
Return of something which you have not bought yourself, a parcel which you never ordered, and a job offer when you have never applied. Good news out of the blue is also bait.
The greeting and wording feel wrong
Generic salutations such as ‘Dear Customer’ as well as improper grammar still exist. But one cannot only rely on this indicator. Scammers use special software that enables them to write perfect letters with no errors at all.
The attachment is unexpected
Emails containing invoices, payments, voice messages in .zip, .html and Microsoft Office files with macros are one of the common ways to transmit malware. You should not open any attachments unless you know the sender and you are expecting that file.
The request is unusual, even from someone you know
Request by colleague to buy gift cards, request by vendor regarding updating bank details, and request by relative for urgent money transfer. Your account can be hacked, and your voice and pictures can be forged. Verify by using the second means of communication through the known number.
A Quick Example
Think about what happens when you receive an SMS telling you that your parcel is held up and you have to pay a little amount to release it using the link. You might even be waiting for your parcel, making it seem legitimate. Once you click on the link, a website that resembles a courier service pops up, requesting your credit card information. The payment is negligible, but the credit card information is the ultimate aim.
What to Do When You Get a Suspicious Message
- Stop. Please do not respond to any number provided in that text message.
- Verify the sender. Examine the complete email address or phone number and not just the displayed name.
- See the source directly. Access the source by either navigating to the URL or accessing the application via the bookmark.
- Check via a reliable phone number. Use the contact number provided on the card or the website.
- Report it. Forward phishing emails to your email provider’s report option and to your local cybercrime authority. In the US you can report to the FBI’s IC3.
- Delete it. Once reported, remove the message.
How to Protect Yourself From Phishing: 9 Effective Habits
- Type out the address yourself. Don’t visit banking, shopping, or account pages through any links sent to you via e-mail or other messages.
- Turn on two-factor authentication (2FA). Even if the scammer knows your password, they will require the second factor. The best option here is using an authenticator application.
- Utilize password manager. It will fill your login credentials on legitimate sites only, thus if it is a scam page, the password manager will not react to it.
- Have different passwords for all your accounts. It is worth noting that giving out passwords does not mean risking all your accounts at one time.
- Be sure to update your smart phone, computer, and browsers. The updates will help fix any vulnerabilities that may be used by links and attachments.
- Install an antivirus or use an inbuilt one. Windows Security and the antivirus of Apple is enough for the majority of people.
- One must be extremely careful while posting any information on the Internet. The name, birth date, phone number, and travel information can be used by someone to post a phishing message.
- Use caution when you use public Wi-Fi. Avoid using your login credentials and password when connecting to an insecure network.
- Discuss it. Speak to your friends and colleagues about the scams that are occurring. Seniors are often the target, and discussing it with them will help them save a lot of money.
What to Do If You Already Clicked a Phishing Link
Calm down and don’t be embarrassed. It happens even to security professionals. Just do it straightaway:
- If you have downloaded some files or installations, then disconnect from the internet.
- Change the password on the hacked account from another computer, and any other account if you use the same password for them too.
- Activate the two-factor authentication method and terminate all other active sessions from the settings page.
- If you have provided the details of the card, then please get in touch with the bank. Ensure that your card is blocked.
- Do a virus check in your computer in case you receive any attachment.
- Keep an eye on your accounts during the coming weeks and, if possible within your jurisdiction, place a credit freeze or fraud alert on your account.
- Notify the business being impersonated by the scam and your country’s cybercrime agency.
Frequently Asked Questions
What is the most usual symptom of phishing emails?
Both urgency and connection were seen. An urgent message received from any organization needs to be taken as a red flag and needs to be verified through the official website or application of that organization.
Is phishing possible on WhatsApp, via SMS or phone calls?
Yes, smishing is when phishing takes place by using SMS text message while vishing is when phishing occurs via telephone call. Delivery fraud, bank alerts and lottery scams can be commonly found. The same principle applies, do not click, do not code.
Is it safe to open a phishing email if I don’t click anything?
Yes, generally. But sometimes no. Reading an email is harmless enough, but opening attachments or links or replying to them can be dangerous. It’s best to delete such emails or report them.
In case I entered my password on a fraudulent site, what should I do?
Change your password now from a safe computer and make sure to change the password on all accounts where it has been used. Don’t forget to turn on 2FA too.
How can I guarantee that a hyperlink is safe?
Click it with your mouse (or long press it on mobile devices) to view the real URL. One can also copy-paste the URL and then analyze it using the available online services like Google Transparency Report and VirusTotal, without even clicking on the link. For an added measure of safety, one can just skip the link and go directly to the web page.
Does antivirus software stop phishing?
It is helpful, particularly when it comes to malware and known phishing websites, but it does not protect you from entering your password on a highly credible phishing site. You still have to do the legwork yourself.
Final Thoughts
Phishing is successful since it targets people instead of machines. For a phishing attack to be successful, the perpetrator must make you anxious, frightened, or curious in less than half a minute. You just need to get into the habit of stopping and going to the website on your own initiative.
Save this guide, pass it along to someone who isn’t as comfortable using the Internet, and refer to it anytime something seems a bit fishy.