What Is Phishing? A Complete Guide to Recognizing and Avoiding Attacks

Key Takeaways

Phishing is the cybercrime reported most often to the FBI: its Internet Crime Complaint Center (IC3) received 191,561 phishing and spoofing complaints in 2025, more than for any other crime type
Ready-made phishing kits and “phishing-as-a-service” platforms let criminals with little technical skill run convincing campaigns
Phishing extends well beyond email, including spear phishing, whaling, smishing (SMS), vishing (phone calls) and clone phishing
Urgency, unusual requests and mismatched links are the most useful red flags; AI-written messages have made spelling and grammar unreliable as a test

Security Education: This article describes cyber threats for defensive awareness and education purposes only. Understanding how attacks work helps organizations and individuals protect themselves. Never use this information for unauthorized access or malicious purposes.

Phishing is one of the most common online crimes. In 2025 the FBI’s IC3 logged 191,561 phishing and spoofing complaints, the largest category among more than 1 million complaints it received that year (IC3 2025 Internet Crime Report). The Anti-Phishing Working Group (APWG), an industry and law-enforcement coalition, counted 3.8 million phishing attacks worldwide in 2025 (APWG Q4 2025 report). Understanding how these attacks work is the first step toward protecting yourself, your family and your organization.

How Phishing Works

The FBI defines phishing/spoofing as “the use of unsolicited email, text messages, and telephone calls purportedly from a legitimate company requesting personal, financial, and/or login credentials.” In practice it is a social engineering attack: criminals impersonate someone you trust and craft a message designed to create urgency, fear or curiosity, so you act before thinking it through.

A typical attack follows a predictable pattern. The attacker sends a message pretending to be a bank, employer, government agency or popular online service. The message links to a fake website that looks almost identical to the real one. When the victim enters a username and password, the attacker captures them, sometimes in real time. More advanced kits sit between the victim and the real site, relaying the login and capturing the one-time code or session cookie as well, which is why ordinary text-message codes do not fully protect an account.

Not every phishing attack wants a password. Some try to get the victim to open a malicious attachment, approve a payment, buy gift cards, read out a security code, or call a fake support number.

Phishing has also become a service industry. Criminal platforms sell or rent fake login pages, email templates and hosting, so a scammer does not need to build anything. In April 2025, for example, the FBI published an industry alert listing phishing domains linked to users of one such platform, LabHost (IC3 2025 report, Appendix E). Our article on phishing kits explains how these markets work.

Types of Phishing Attacks

Phishing has evolved well beyond simple email scams. These are the main categories:

Email phishing is the most widespread form. Attackers send mass emails impersonating well-known technology companies, retailers, delivery firms or banks, typically warning about account suspension, unauthorized access or missed payments. Learn to spot them in our guide on recognizing phishing emails.

Spear phishing targets specific people using details gathered from social media, company websites or data breaches. Because the message references real names, projects or events, it is far more convincing. Our spear vs. bulk phishing comparison explains the difference.

Whaling is spear phishing aimed at executives and other senior decision-makers, often with fake legal notices, board documents or urgent wire-transfer requests. See our guide to whaling and CEO fraud.

Smishing uses text messages instead of email: fake package-delivery notices, bank alerts, unpaid-toll demands or prize notifications with malicious links. In April 2024 the FBI reported receiving more than 2,000 complaints about smishing texts posing as road-toll collectors (FBI PSA). Read more in our smishing guide.

Vishing involves phone calls or voicemails from attackers posing as tech support, the IRS, a bank’s fraud department or law enforcement, pressuring victims to share information or pay. AI voice cloning makes this harder to spot: in May 2025 the FBI warned that cloned voices “can sound nearly identical” to the real person (FBI PSA). See our vishing guide.

Clone phishing copies a legitimate email the victim has already received, swaps the links or attachments for malicious ones, and resends it, either from a lookalike address or from a compromised account. Our clone phishing article has examples.

Red Flags That Indicate Phishing

No single sign proves a message is phishing, and a well-made lure may show none of them. These are the most useful indicators:

Urgency and pressure. Phrases like “Your account will be closed in 24 hours” or “Immediate action required” are designed to bypass your critical thinking. Requests to keep something secret, or to skip normal procedures, are a related warning sign.

Unusual requests. A request for your password, a security code, a payment, gift cards or a change of bank details deserves extra scrutiny, whoever it appears to come from.

Mismatched links and senders. Hover over links (or long-press on a phone) to see the real destination, and check the full sender address, not just the display name. A link that claims to go to your bank but points to an unrelated domain is a clear sign of phishing. A padlock or “https” only means the connection is encrypted; phishing sites use them too.

Generic greetings. “Dear Customer” or “Dear User” can suggest a mass campaign, although targeted attacks will use your name.

Unexpected attachments. ZIP files, executables, HTML files or Office documents that ask you to enable macros should be treated with great caution.

Spelling and grammar. Errors still appear in some phishing, but they are no longer a reliable test. In a 2024 study by Fred Heiding, Bruce Schneier and colleagues, fully AI-generated spear-phishing emails were clicked by 54% of recipients, the same rate as emails written by human experts (Heiding et al.).

What to Do If You Receive a Phishing Message

Do not click links, scan codes or open attachments in suspicious messages. Instead, go to the organization’s website or app directly, or call a number you already have.

Report it. Most email services have a built-in “Report phishing” option. The FTC also recommends forwarding phishing emails to the APWG at reportphishing@apwg.org, forwarding scam texts to 7726 (SPAM), and reporting the attempt at ReportFraud.ftc.gov. If you lost money, also file a complaint at ic3.gov. At work, use your organization’s report button or security contact. Our phishing reporting guide covers each channel.

If you think you have already fallen for a phishing attack, act quickly: change the password for the affected account (and anywhere you reused it) from a device you trust, turn on multi-factor authentication, check for email forwarding rules or recovery details you did not set, and watch your financial statements. If you sent money, call your bank immediately. Our guide on account recovery after a hack walks through the full process.

The Scale of the Problem

Phishing affects individuals, small businesses and large organizations alike. Reported losses from phishing and spoofing complaints reached $215.8 million in 2025, and phishing is often the first step in larger frauds: business email compromise, which commonly begins with a spoofed or compromised mailbox, accounted for $3.05 billion in reported losses (IC3 2025). For organizations, IBM and the Ponemon Institute’s Cost of a Data Breach Report 2026 puts the global average cost of a data breach at $4.99 million, a figure that covers all industries and all causes, not phishing alone.

Attackers go where the logins and money are. In Q2 2026, SaaS and webmail services were the most-targeted sector, at 29.1% of phishing attacks tracked by APWG member Crane Authentication (APWG Q2 2026 report). More figures are in our phishing statistics and trends article.

Building Your Defenses

Awareness matters, but it is not enough on its own. An eight-month randomized experiment with more than 19,500 employees at UC San Diego Health found that annual awareness training had no significant link to whether people failed phishing tests, and that embedded training reduced failure rates by only about 1.7 percentage points (Ho et al., IEEE S&P 2025). The strongest protection combines good habits with technical safeguards:

Use a password manager. A password manager creates a unique password for every account, so one stolen password does not unlock others. Its autofill also will not offer your saved login on a lookalike domain, a useful warning, although it cannot stop you from typing a password into a fake site yourself.
Turn on multi-factor authentication, preferably passkeys or security keys. CISA calls this phishing-resistant MFA “the gold standard,” while noting that any MFA is better than none (CISA).
Keep software updated. Some malicious links and attachments try to exploit known flaws in browsers, plugins and operating systems.
Keep your browser’s built-in phishing protection turned on, and do not click through security warnings.
Verify unusual requests through a second channel before acting.

Phishing will keep evolving, but the core defense stays the same: pause before you click, verify before you trust, and report anything suspicious.