The Complete Guide to Phishing: How to Recognize and Stop Email, SMS and Online Attacks

It is Monday morning. An email from "IT Support" says your mailbox is 98% full and will stop receiving messages today unless you verify your account. The logo is right, the tone is polite, and there is a blue button labelled "Verify now". You click, a familiar sign-in page appears, and you type your password. Nothing seems to happen. By lunchtime, someone else is reading your email.

That is phishing: a message that imitates someone you trust so that you hand over something valuable yourself. It is the most common way attackers get into email accounts, bank accounts and company networks, and it arrives by email, text, phone, social media and messaging apps.

This guide explains how phishing works, every common type, how to check a sender and read a link like a professional, which protections actually stop it, how to report it, and what to do if you have already clicked. It is written for anyone, anywhere, whether you are protecting your own accounts or your whole organization.

What is phishing?

Phishing is a deceptive message designed to make you click a link, open a file, reply with information, call a number or make a payment, by pretending to come from a trusted person or organization. The name comes from fishing: the attacker casts a lure and waits for someone to bite.

Phishing is usually the first step, not the whole attack. What the attacker does next depends on what they catch:

• Passwords and codes, used to take over email, banking, social media or work accounts.
• Card and bank details, used for fraud.
• A foothold on your device through a malicious file, which can lead to data theft or ransomware.
• A payment, made to the attacker directly.

How a phishing attack works

1. The lure. A message that looks like it comes from a bank, a delivery company, your IT department, a colleague, a government agency or a well-known brand.
2. The reason to act. A problem (your account is locked), an opportunity (a refund is waiting) or a routine task (a document has been shared with you).
3. The hook. A link to a fake page, an attachment, a phone number to call, or a request to reply.
4. The catch. You enter a password, a code or card details, open the file, or send the payment.

The psychology behind it, authority, urgency, fear and curiosity, is explained in the six levers attackers pull on people. Phishing is one delivery method for the wider family of tricks covered in our complete guide to online scams.

Types of phishing

Email phishing

The classic version: a mass email copying a bank, a streaming service, a parcel company or an email provider. Our step-by-step guide how to spot a phishing email covers the basics.

Spear phishing and whaling

Targeted messages written for a specific person or team, using real names, projects and details found online. Whaling targets senior people such as directors and finance heads.

Business email compromise

An attacker impersonates, or takes over, the email of an executive or supplier to redirect payments. It is one of the most costly forms of phishing for organizations. See business email compromise.

Smishing (SMS phishing)

Text messages about parcels, tolls, banks or tax refunds that carry a link. The sender name can be faked. See smishing.

Vishing (voice phishing)

Phone calls from someone posing as a bank, a government office or IT support. Read fake IT support calls.

Callback phishing

An email with no link at all, just a fake invoice or subscription renewal and a phone number to call "to cancel". The person who answers talks you into installing remote access software or paying a "refund" fee.

QR code phishing

A QR code in an email or on a poster that leads to a fake login or payment page. See QR code phishing.

Clone phishing

A copy of a real email you received earlier, resent with the link or attachment swapped for a malicious one, often "resending" a document.

Search engine and ad phishing

Paid adverts or fake results that appear above the real site when you search for your bank, a support number or popular software.

Social media and messaging app phishing

Direct messages that claim your account will be suspended, fake brand support accounts, and links sent from friends' hacked accounts. WhatsApp versions are covered in our guide to WhatsApp scams.

Code-stealing pages and consent phishing

More advanced phishing pages pass your password and two-step code to the real site as you type, logging the attacker in at the same moment. Another variant asks you to "allow" a malicious app access to your email or files, so no password is needed at all. Both look like normal sign-in screens.

Anatomy of a phishing message

How to read a link

This is the most useful skill in this guide. On a computer, hover over a link to see its address at the bottom of the window. On a phone, press and hold the link to preview it. Then find the domain: the part just before the first single slash after https://. Read it from right to left.

• https://www.examplebank.com/login is examplebank.com.
• hxxps://examplebank.com.account-verify[.]net/login is account-verify.net. Everything before it is decoration.
• hxxps://www.examp1ebank[.]com uses the number 1 instead of the letter l.
• hxxps://examplebank-security[.]com is a different domain from examplebank.com, however official the words sound.
• Shortened links hide the destination entirely. Treat them with extra caution in unexpected messages.

The addresses above are illustrative and deliberately broken so they cannot be clicked. The safest habit of all: if a message asks you to sign in or pay, do not use the link. Open the app, or type the address you already know.

Illustrative examples, with the red flags explained

These examples are fictional and written for this guide.

Dangerous attachments

Attachments are a common way to deliver malware. Be especially careful with:

• Files you did not expect, even from people you know, since their account may be compromised.
• Office documents that ask you to "enable content" or "enable editing" to view them.
• Zipped or password-protected files, which filters cannot inspect.
• Files ending in unusual extensions, or with a double extension such as invoice.pdf.exe.
• HTML attachments that open a sign-in page in your browser.
• "Shared document" messages linking to file-sharing sites that then ask for your password.

If you are unsure, confirm with the sender through a separate channel before opening.

Two-step verification and phishing-resistant sign-in

Two-step verification, also called multi-factor authentication, stops most attacks that rely on a stolen password, so turn it on everywhere. But some phishing pages relay codes in real time, and attackers can bombard you with approval prompts, as described in MFA fatigue.

The strongest option is phishing-resistant sign-in: passkeys and physical security keys. They are tied to the genuine website, so they simply refuse to work on a fake one, however convincing it looks. The US Cybersecurity and Infrastructure Security Agency recommends phishing-resistant methods, especially for administrators and high-risk accounts. Where your email, bank or work accounts offer passkeys, use them.

Why phishing is harder to spot on a phone

Many people now read most of their email and messages on a phone, and attackers design for it.

• Addresses are hidden. Mail apps often show only the sender's name, not the full address. Tap the name to reveal it.
• Links are harder to inspect. There is no hover, so press and hold to preview the address before opening anything.
• Screens are small. A lookalike domain is easy to miss when only part of it fits in the address bar.
• We read on the move, between meetings or while walking, which is exactly when careful checking slips.

A simple rule for your phone: if a message wants you to sign in or pay, close it and open the official app instead.

Phishing themes to watch for

The disguises change with the calendar and the news, but a handful of themes appear again and again, in every country.

• Account security alerts: "unusual sign-in", "your password expires", "verify your account".
• Deliveries and customs fees, especially around holidays and big shopping events.
• Tax refunds and government payments during tax season or after new schemes are announced.
• Invoices, receipts and payment failures aimed at people who handle money.
• Shared documents and e-signature requests that lead to fake sign-in pages.
• Job offers and HR messages, such as salary reviews or new policies to "acknowledge".
• Current events: disasters, elections, health scares and major sporting events.

How to protect yourself from phishing

Habits

• Go direct. For sign-ins and payments, use the app or a bookmark, never a link in an unexpected message.
• Verify requests through another channel, especially anything involving money, passwords or codes.
• Slow down on urgency. The more urgent a message feels, the more carefully you should check it.
• Never share codes or approve sign-ins you did not start.

Tools

• A password manager. It fills in passwords only on the exact site they belong to. If it does not offer to fill in, stop and check the address. See passwords your staff will remember.
• Passkeys and two-step verification on every important account.
• Updates for your operating system, browser and apps.
• Your email provider's protections and the browser's built-in warnings, which block many known phishing sites.

How to report phishing

If you clicked, entered details or opened a file

1. Stop. Close the page and do not enter anything else.
2. Password entered? Change it from a trusted device, and anywhere you reused it. Check that two-step verification is still on and no new devices have been added.
3. Code entered or sign-in approved? Tell the provider or your IT team at once so they can end the attacker's session.
4. File opened? Disconnect from the network and get help before using the device again.
5. Card or bank details? Call your bank on the number on your card.
6. Report it, quickly and honestly. At work, a fast report can protect your colleagues.

Our step-by-step article clicked a phishing link at work? covers each situation in more detail.

Phishing and organizations

For organizations, phishing is the front door to account takeover, payment fraud and ransomware. No single control stops it, so it is handled in layers:

• Email authentication (SPF, DKIM and DMARC) makes it harder for attackers to send email pretending to be your domain.
• Filtering removes many known phishing messages before anyone sees them.
• Phishing-resistant sign-in for administrators and finance first, then everyone.
• People who spot and report. Short training and realistic practice turn staff into an early warning system. See how to run phishing simulations your staff won't resent.

CyberWatch AI helps organizations with the people layer: realistic phishing simulations, short training where it is needed, one-step reporting for every employee, and a security score that shows whether it is working.

Common myths about phishing

• "Phishing emails are full of spelling mistakes." Many are flawless, especially now that AI writes them.
• "The padlock means it's safe." Phishing sites use padlocks too.
• "It came from a real company address." Accounts get compromised, and display names are easy to fake.
• "I have two-step verification, so I'm safe." It helps enormously, but codes can be phished. Passkeys are stronger.
• "Only careless people fall for it." Well-crafted phishing catches experienced people on busy days. Reporting quickly matters more than never clicking.

Frequently asked questions

Sources

1. How To Recognize and Avoid Phishing Scams, US Federal Trade Commission
2. Recognize and report phishing, US Cybersecurity and Infrastructure Security Agency
3. Implementing phishing-resistant MFA (fact sheet), US Cybersecurity and Infrastructure Security Agency
4. Phishing: Spot and report scam emails, texts, websites and calls, UK National Cyber Security Centre
5. Reporting a scam email, UK National Cyber Security Centre
6. Suspicious email actions, UK National Cyber Security Centre
7. Report phishing, Anti-Phishing Working Group
8. Avoid and report phishing emails, Gmail Help
9. Report a phishing page, Google Safe Browsing
10. Report cybercrime online, Europol