What is Phishing?
Types, Techniques, Prevention, and Response

What Phishing Is and How It Works

Phishing Is Social Engineering

Phishing is a cyberattack that uses fake messages to trick people into sharing sensitive information, clicking on a malicious link, or giving up login credentials. However, calling it just “fake email” misses the full picture. It is a form of social engineering — it exploits trust, not code. Over 90% of all cyberattacks begin with phishing (CISA). Furthermore, 3.8 million phishing attacks were recorded (APWG). As a result, knowing the types of phishing, building strong phishing prevention, and training teams to spot every scam email is now a survival skill for every firm.

Unlike malware that targets systems, this threat targets people. The attacker poses as someone the victim trusts — a boss, a bank, a vendor, or a tech platform. Then they send a message designed to trigger a quick, thoughtless action. The goal is always the same: get the victim to hand over personal information, login credentials, or access.

How Phishing Working Unfolds

Most scams of this kind follow a clear pattern. First, the attacker picks a target and crafts a message. It might be an email, a text message, or even a phone call. Then, they add a hook — creating a sense of urgency. Phrases like “your account will be locked” or “confirm this payment now” push victims to act fast.

Next, the victim takes the bait. They might click a link that leads to a fake website. Or they might open a file that installs malware. Or they might reply with credit card details or login credentials. In fact, the median time-to-click on a scam email is just 21 seconds (Verizon DBIR). That is all the time an attacker needs. After that, the stolen data feeds the next stage — account takeover, wire fraud, or full network access.

Types of Phishing

Email Phishing and Spear Phishing

Email phishing is the most common type of phishing attack. Attackers send fraudulent emails in bulk, hoping a small fraction of targets will click a link or open an infected file. These phishing emails often mimic well-known brands — banks, cloud platforms, or delivery services. Google blocks roughly 100 million phishing emails every day. Yet enough still get through to cause billions in losses.

Spear phishing is far more targeted. Instead of blasting thousands, the attacker focuses on one person. They research the target’s name, role, and company. Then they craft a message tailored to that individual. Because the message looks real and relevant, spear this method achieves much higher click rates. In fact, AI-generated spear phishing now achieves a 54% click rate — matching skilled human attackers at a fraction of the cost (HBR).

Whaling and Clone Phishing

Whaling goes after the biggest targets: CEOs, CFOs, and senior leaders. A whaling email might claim the company faces legal action and that the executive must click a link at once. Because executives control budgets and approvals, a single whaling attack can cost millions. For instance, Austrian firm FACC lost over EUR 42 million to a BEC-style whaling attack.

Clone phishing takes a different approach. The attacker copies a legitimate email the victim already received — but swaps the links or files for malicious versions. Because the message looks like a reply or follow-up to a real conversation, it is very hard to spot. In short, this technique weaponizes trust in past communications.

More Types of Phishing Every Team Should Know

Voice Phishing and Smishing

Voice phishing — also called vishing — uses phone calls instead of email. The attacker pretends to be from a bank, a government agency, or the victim’s own IT team. They pressure the target into sharing login credentials or granting remote access. What makes vishing alarming now is AI voice cloning. McAfee reports that just 3 seconds of audio is enough to create a convincing clone of someone’s voice. CrowdStrike tracked a 442% rise in voice phishing in recent periods.

Smishing uses text message delivery instead of email. A short SMS might say “your package is delayed — click here” or “your bank flagged a charge — verify now.” Because people trust text messages more than email, smishing click rates are high. SentinelOne reports that 35% of all phishing now uses SMS or messaging apps.

Pharming, Quishing, and Angler Phishing

Pharming is a phishing technique that redirects users from a legitimate website to a fake website — even if they typed the correct URL. It works by poisoning DNS settings or the victim’s host file. Similarly, quishing uses QR codes to deliver malicious links. Because the URL is hidden inside an image, traditional email filters miss it. QR code scam campaigns have surged as contactless payments and digital menus have become routine.

Angler phishing targets users on social media. Attackers create fake support accounts that mimic real brands. When a customer posts a complaint, the fake account responds with a link to a malicious website — posing as “customer support.” This technique exploits the trust people place in public brand interactions.

How Phishing Attacks Happen

Common Phishing Techniques

Every phishing attack starts with a lure. The most common phishing techniques include sending fraudulent emails with malicious links, creating a sense of urgency to force fast action, and spoofing trusted sender addresses using spoof emails. In addition, attackers build fake websites that mirror real login pages — tricking victims into entering login credentials on a page the attacker controls.

Furthermore, these campaigns now use multiple channels at once. An attacker might send a scam email, follow up with a text message, and close with a phone call — all targeting the same victim. This multi-channel approach makes each attack harder to dismiss. Also, adversary-in-the-middle (AitM) kits steal session tokens in real time, bypassing multi-factor authentication entirely. Microsoft reports that 80% of MFA-bypass breaches now use this technique.

The Phishing Attack Chain

A phishing attack follows a clear sequence. First, the attacker sends a message — email, SMS, or voice. Then, the victim takes an action: clicking on a malicious link, opening a file, or sharing login credentials. After that, the attacker harvests the stolen data — passwords, session tokens, or personal information.

Next, the attacker acts on what they stole. They might drain a bank account, access internal systems, or sell the login credentials on dark web markets. In many cases, a single email is just the entry point. The real damage comes later — through lateral movement, data theft, or ransomware. In fact, phishing appears in 36% of all data breaches (Verizon DBIR). Therefore, defense must focus on breaking the chain at every stage.

The Evolving Phishing Threat Landscape

Modern phishing looks nothing like the clumsy scam emails of a decade ago. Instead, today’s campaigns are polished, targeted, and powered by AI. Research shows 56% of observed emails showed signs of AI assistance (Hoxhunt). As a result, grammar errors — once the easiest red flag — are vanishing from phishing emails.

Moreover, voice phishing has exploded. CrowdStrike measured a 442% rise, driven by AI voice cloning that needs just 3 seconds of audio to create a convincing fake. Similarly, smishing now accounts for 35% of all phishing (SentinelOne). In addition, adversary-in-the-middle kits — available for as little as $120 per month — let attackers bypass multi-factor authentication by stealing session tokens in real time.

The financial impact keeps growing. The FBI reported $2.77 billion in BEC losses annually. Meanwhile, the average cost of a social-engineering-driven data breach reached $4.88 million (IBM). It takes an average of 254 days to identify and contain a breach that starts with phishing. That is nearly nine months of undetected exposure.

Who Phishing Targets Most

Phishing targets everyone, but some groups face more risk. For instance, finance teams handle wire transfers and invoices — making them prime targets for BEC scams. A single spoofed email from a fake vendor can redirect a payment worth millions. Similarly, executives face whaling attacks that exploit their authority to approve transactions or share sensitive information.

IT staff are targeted because they hold admin login credentials and system access. Meanwhile, customer support teams interact with the public daily, making them vulnerable to angler phishing on social media. Furthermore, new employees are especially at risk — they receive their first phishing email after just three weeks on the job, on average.

From a sector view, healthcare and financial services face the highest pressure. Healthcare holds sensitive patient data and faces strict regulatory penalties. Finance handles high-value transactions that attackers can redirect with a single phishing scam. In addition, SMBs face growing risk because they often lack dedicated security teams and phishing prevention programs.

How to Spot a Phishing Attempt

Red Flags in Phishing Emails

Spotting suspicious messages saves firms millions. First, check the sender address. These messages often come from domains that look close to real ones but have small changes — like “support@micros0ft.com” instead of the real domain. Second, look for urgency. Phrases like “act now” or “your account will be closed” are classic tricks aimed at creating a sense of urgency.

Third, hover over links before clicking on a malicious link. If the URL does not match the claimed destination, it is likely a fake website. Fourth, watch for generic greetings. Legitimate companies usually address you by name. Also, check for spelling or formatting issues — though AI-generated messages are making this red flag less reliable.

Signs Beyond Email

Phishing is not just an email problem. For instance, watch for unexpected phone calls asking for login credentials or payment details — that is voice phishing. Similarly, text messages with shortened links and urgent language may be smishing. Also, QR codes in unexpected places — posters, parking meters, or unsolicited mail — could be quishing attempts.

Furthermore, watch for social media messages from accounts that look like brand support but have few followers or were created recently. These are likely these attempts leading to malicious websites. In short, if any message — email, text, call, or social — asks for personal information and creates a sense of urgency, treat it as a potential threat until proven otherwise.

Phishing Prevention Best Practices

Technical Controls

Strong defense starts with technical layers. First, deploy multi-factor authentication on all accounts. MFA stops most credential theft from succeeding — even when login credentials are stolen. However, use attack-resistant MFA like FIDO2 or passkeys, since AitM kits can bypass standard MFA.

Second, enforce DMARC, SPF, and DKIM on all email domains. These protocols stop attackers from sending spoof emails that impersonate your brand. Third, deploy email security gateways that scan for malicious links, suspicious attachments, and known attack methods. Also, enable URL sandboxing so links are tested in a safe environment before users can click a link.

Human Controls

Technical tools catch many threats, but people remain the last line of defense. Therefore, run regular security awareness training with real-world attack examples. Simulated campaigns test whether staff can spot suspicious emails under pressure. Firms with ongoing training see click rates drop to as low as 1.5%.

In addition, make it easy to report a suspicious message. Add a “report threats” button to email clients and messaging platforms. The faster an attack email gets reported, the faster the security team can block it for everyone. Also, brief new hires during onboarding — they receive their first attack email within three weeks. Phishing prevention is not a one-time training. Instead, it is an ongoing discipline that must keep pace with evolving phishing techniques.

Phishing Prevention Tools

No single tool stops every attack. Instead, combine layers that cover different parts of the chain.

Email security gateways scan incoming messages for malicious links, spoof emails, and known attack campaigns. They block the majority of bulk scam emails before they reach inboxes. Multi-factor authentication — especially attack-resistant types like FIDO2 — adds a barrier even when login credentials are stolen.

DMARC/SPF/DKIM protocols stop domain spoofing, making it harder for attackers to send fraudulent emails that look like they come from your brand. Similarly, URL sandboxing tests links in a safe environment before users can click a link. Furthermore, security awareness platforms like KnowBe4, Hoxhunt, and Proofpoint run automated attack simulations, track click rates, and deliver targeted training to staff who need it most.

In addition, DNS filtering blocks access to known malicious websites and fake website domains — stopping the attack even if a user clicks. Together, these tools form a layered defense stack that breaks the attack chain at multiple points.

What to Do After a Phishing Attack

Contain the Damage

Speed matters. As soon as an attack is confirmed, reset all compromised login credentials at once. Revoke any active sessions — since AitM attacks steal session tokens, a password reset alone may not be enough. In addition, isolate any device that clicked on a malicious link or downloaded a suspicious file.

Furthermore, preserve evidence. Screenshot the attack email, save headers, and log the timeline. These details help forensic teams trace the attack and support any regulatory reporting. For help, see our cybersecurity services required for a data breach.

Recover and Strengthen

After containment, assess the impact. Did the attacker access sensitive information? Were any funds transferred? Was personal information or credit card data exposed? Notify affected parties per regulatory rules — GDPR requires notice within 72 hours.

Then, close the gap. If the attack email bypassed your email gateway, update the rules. If staff clicked on a malicious link, schedule targeted training. Also, review your defense controls and update the response playbook. Every incident is a learning event. The firms that improve after each incident build the strongest defenses over time.

Building Phishing Resilience

Resilience is not about stopping every threat. It is about shrinking the blast radius and speeding up recovery. The strongest firms treat this as a cycle.

The firms that survive phishing attacks intact are not the ones with the fanciest tools. Instead, they are the ones with trained people, tested playbooks, and a culture where reporting a phishing attempt is rewarded — not punished.

Conclusion

Phishing is not going away. It is getting faster, smarter, and harder to spot. With AI crafting flawless scam emails, voice cloning driving vishing surges, and AitM kits bypassing MFA, the types of phishing keep expanding.

But the defense playbook is clear. Strong phishing prevention combines technical controls — MFA, DMARC, email gateways — with human controls like security awareness training and simulated phishing campaigns. Every scam email that gets reported before someone clicks is a win. Every incident that triggers a faster response makes the next one easier to handle.

For leaders looking at their security posture, the message is simple. Defense is not a product. It is a discipline. Build it into daily operations, test it regularly, and treat every incident as a chance to improve.

Frequently Asked Questions

References

1. StationX — Phishing Statistics: Latest Attack Data and Trends
2. Hoxhunt — Phishing Trends Report (Updated for 2026)
3. Astra — 81 Phishing Attack Statistics