Phishing is when an attacker impersonates someone trustworthy — your bank, your IT department, a delivery company, even your boss — to trick you into handing over a password, clicking a malicious link, or sending money. It's the starting point for most ransomware infections and data breaches, because it targets the easiest thing to exploit in any system: human trust.
You don't need to be a security expert to defend against it. You need to know what to look for, and what to do in the moment you're not sure.
What is Phishing?
Phishing is a social-engineering attack that uses fake messages — usually email, but also text, voice calls, or chat — to trick you into giving up credentials, clicking a malicious link, or taking an action that helps the attacker.
It works because it doesn't try to break encryption or hack software — it tries to get a person to make one wrong click. That's also why it remains effective even against organizations with strong technical defenses: the weakest point is rarely the firewall, it's an inbox.
Types of Phishing You'll Actually Encounter
Email phishing
The classic version — a mass email pretending to be from a bank, software vendor, or shipping company, asking you to "verify your account" or "confirm a payment."
Spear phishing
A targeted version aimed at one specific person, using real details about them (their name, job title, recent activity) to feel more convincing. This is far harder to spot because it doesn't look like a mass email.
Business Email Compromise (BEC) / CEO fraud
An attacker impersonates an executive or finance contact, usually by email, asking an employee to urgently wire money or buy gift cards. These rely entirely on urgency and authority, with no malware involved at all.
Smishing (SMS phishing)
Text messages claiming to be from a delivery service, bank, or government agency, with a link to a fake login page.
Vishing (voice phishing)
Phone calls, increasingly using AI-generated voices that mimic a real person, pressuring the target into sharing information or making a payment over the phone.
Clone phishing / link manipulation
A near-exact copy of a real, previously sent email or website, with one detail changed — usually the link destination — that's easy to miss on a quick glance.
Warning Signs: How to Spot Phishing
- A sense of urgency or threat: "Your account will be suspended in 24 hours," "Unusual sign-in detected," "Final notice." Real organizations rarely demand instant action under threat.
- A mismatched sender address: The display name might say "Microsoft Support," but the actual email address is something unrelated. Always check the full address, not just the display name.
- Links that don't match where they claim to go: Hover over (don't click) a link to see the real destination URL before trusting it. Look closely — attackers register lookalike domains like
paypa1.comormicros0ft-support.com. - Requests for credentials, payment, or gift cards via email: Legitimate companies don't ask you to "log in to verify" through an emailed link, and finance teams should always verify wire-transfer requests through a second channel.
- Generic greetings on a supposedly personal message: "Dear Customer" from a service that normally uses your name can be a sign of a mass phishing campaign.
- Unexpected attachments, especially ZIP files, macro-enabled Office documents, or files from someone you weren't expecting to hear from.
- Spelling and formatting that doesn't quite match the real brand, though this is less reliable now — well-resourced attackers increasingly use AI to write polished, error-free messages.
What to Do If You Clicked a Phishing Link
If you entered a password on a fake site
Change that password immediately, on the real site, and on any other account where you reused the same password. Enable multi-factor authentication (MFA) if you haven't already.
If you downloaded and opened an attachment
Disconnect the device from the network right away, the same way you would for suspected ransomware, and run a full antivirus/endpoint scan. If this is a work device, report it to IT immediately rather than trying to quietly fix it yourself.
If you sent money or gift card codes
Contact your bank or payment provider immediately — speed matters for any chance of reversing a transfer. Report it to your local cybercrime reporting authority as well.
In every case, report it
Forward the phishing email to your IT/security team or use your email provider's "report phishing" feature. This isn't just cleanup — it helps block the same message from reaching others, including coworkers.
Why This Matters to You
Phishing is the entry point for the large majority of data breaches and ransomware infections, which means stopping phishing is one of the highest-leverage things you can do for your own security or your organization's. A single successful phishing email can lead directly to a stolen password, a ransomware infection, or a fraudulent wire transfer — there's often no second layer of defense if the click already happened and credentials were entered.
A Real-World Example
Imagine an employee, Raj, gets an email that looks like it's from his company's IT helpdesk, warning that his email storage is full and he needs to "click here to upgrade" before losing access. The link goes to a page that looks exactly like his company's real login screen. He almost enters his password — but pauses because the sending address is [email protected], not his company's actual domain. He reports it to IT instead of clicking further. IT confirms it's a phishing campaign hitting multiple employees and blocks the sender, preventing several other people from falling for the same email.
Prevention Habits That Actually Work
Turn on multi-factor authentication everywhere
MFA is the single most effective control against phishing's main goal — stolen passwords. Even if a password is captured, MFA usually stops the attacker from getting in.
Verify unusual requests through a second channel
If an email asks for a payment, password reset, or sensitive data, confirm it by phone or in person using a number/contact you already know is real — never a number or link provided in the suspicious message itself.
Use a password manager
Password managers won't autofill credentials on a lookalike phishing domain the way you might by habit, which makes them a quiet but effective phishing defense.
Keep email filtering and anti-phishing tools updated
Modern email security tools catch a large share of phishing before it reaches an inbox — but none catch all of it, which is why the human-side habits above still matter.
Run regular phishing-awareness training
For organizations, periodic simulated phishing tests measurably reduce click rates over time, especially when paired with quick, blame-free feedback rather than punishment.
Slow down on urgency
Attackers rely on you acting fast without thinking. Treat any message demanding immediate action as a reason to slow down and verify, not speed up.
Common Mistakes to Avoid
Trusting the display name instead of the actual address
Display names are trivial to fake. Always check the full sending email address.
Clicking links to "double check" if something is real
If you're unsure, navigate to the official site directly by typing the address yourself or using a saved bookmark — never the link in the suspicious message.
Assuming good spelling means it's legitimate
AI tools have made it easy for attackers to write fluent, error-free phishing messages. Don't rely on typos as your main signal anymore.
Staying quiet after realizing you clicked something
Embarrassment causes delay, and delay is exactly what makes phishing damage worse. Reporting immediately, even after the fact, meaningfully limits the damage.
Frequently Asked Questions
Can opening a phishing email alone infect my device?
Simply opening a plain-text email is very unlikely to infect you, but opening attachments, enabling macros, or clicking links inside it can. Treat any unexpected attachment or link with caution, regardless of whether you've already "opened" the email.
How can I tell a real bank email from a fake one?
Check the actual sender address (not just the name), hover over links to confirm they point to the bank's real domain, and remember that banks generally don't ask you to "confirm your password" via an emailed link. When in doubt, log in directly through the bank's app or by typing the address yourself.
What's the difference between phishing and a data breach?
Phishing is a method of attack (tricking a person into giving up access). A data breach is often the result — phishing is one of the most common ways attackers gain the access needed to cause a breach in the first place.
Does antivirus software stop phishing?
Antivirus and email filters block a meaningful share of phishing attempts and malicious attachments, but well-crafted phishing messages and brand-new lookalike domains regularly slip through. Human awareness remains a necessary second layer.
Conclusion
Phishing succeeds by exploiting trust and urgency, not by breaking technology. Learning the warning signs — mismatched sender addresses, suspicious links, urgent demands, requests for credentials or payment — and knowing exactly what to do if you slip up turns phishing from a near-guaranteed compromise into a minor, recoverable incident.
Keep Learning on ITVedas
One of many free guides across 8 IT chapters — all in plain English.
Explore All Chapters →