Phishing

Phishing is a cyberattack technique in which an attacker impersonates a trustworthy person, organization, or system in order to trick a target into revealing sensitive information, such as login credentials or financial details, or into taking a harmful action, such as installing malware or transferring money. The name is a deliberate play on fishing, reflecting the attacker’s strategy of casting out bait, usually a convincingly disguised message, and waiting for a victim to take it. Despite being one of the oldest tricks in the cybercriminal playbook, phishing remains one of the most common starting points for successful cyberattacks, because it targets human judgment rather than a technical weakness in software.

Common Forms of Phishing

The most familiar form of phishing arrives as mass email, sent to large numbers of potential victims at once, impersonating a bank, delivery company, government agency, or other familiar organization and urging the recipient to click a link, verify account details, or open an attachment. A more targeted and typically more dangerous variant, called spear phishing, is carefully researched and customized to a specific individual or organization, often referencing real coworkers, projects, or recent events to appear far more convincing than a generic mass message. Whaling refers to spear phishing specifically aimed at senior executives or other high-value targets, since successfully deceiving someone with significant authority or financial access can yield a much larger payoff for the attacker.

Phishing has also expanded well beyond email. Smishing uses deceptive text messages, often claiming a package delivery problem or a suspicious account login, to trick victims through their phones. Vishing uses phone calls, sometimes employing voice-cloning technology to impersonate a real person’s voice convincingly, to pressure a victim into revealing information or taking action over the phone. Attackers increasingly combine multiple channels in a single campaign, for example sending an email that references a phone call the victim is about to receive, to make the overall deception feel more coordinated and credible than any single message would on its own.

Recognizing and Defending Against Phishing

Phishing messages often share common warning signs, including a false sense of urgency designed to pressure quick action without careful thought, requests for sensitive information that a legitimate organization would not normally ask for through that channel, mismatched or slightly altered sender addresses and web links that look almost, but not quite, like the real organization’s actual domain, and generic greetings in messages that claim to be personally addressed. Hovering over a link to preview its actual destination before clicking, and contacting an organization directly through a known, trusted channel rather than one provided in a suspicious message, are both effective habits for catching many phishing attempts before any damage is done.

Organizations defend against phishing through a combination of technical measures, including email filtering systems that automatically flag or block suspicious messages, multi-factor authentication that limits the damage even if a password is successfully stolen, and ongoing employee training, often including simulated phishing tests, to help staff recognize and report suspicious messages before they cause harm. Because phishing specifically targets human decision-making rather than a technical system flaw, security experts generally agree that a well-trained, appropriately skeptical workforce remains one of the single most effective defenses against it, even as the technical sophistication of phishing campaigns continues to increase.

A Long and Costly History

The term phishing dates back to the mid-1990s, when early internet attackers tricked users into revealing account passwords by posing as system administrators, and the technique has grown enormously in scale and sophistication alongside the growth of email and online banking in the decades since. High-profile phishing campaigns have been linked to some of the largest and most damaging data breaches and financial losses in corporate history, with attackers often using phishing as the initial foothold that then allows them to move deeper into a victim’s network, install additional malware, or steal far more valuable data than the original message alone appeared to be seeking.

The rise of generative AI has introduced a new wrinkle, letting attackers produce highly convincing, grammatically flawless phishing messages at far greater scale and speed than earlier attackers could manage by hand, and letting them more easily mimic a specific person’s actual writing style. Security researchers and technology companies have responded by developing better automated detection systems, more aggressive email filtering, and expanded authentication standards designed to make it harder for a forged message to appear to come from a legitimate sender in the first place, though the fundamental cat-and-mouse dynamic between attackers and defenders continues to evolve on both sides.

Frequently Asked Questions

What is the difference between phishing and spear phishing? Ordinary phishing sends the same generic deceptive message to a large number of potential victims at once, while spear phishing is specifically researched and customized to target one particular person or organization, often referencing real details to appear far more convincing and personal.

What should someone do if they suspect they clicked a phishing link? They should avoid entering any further information on the resulting page, disconnect the device from the network if malware installation is suspected, change passwords for any accounts that may have been exposed using a separate, trusted device, and report the incident to their organization’s security team or the relevant service provider as soon as possible.

Why does phishing remain effective despite widespread awareness of it? Attackers continually refine their techniques, making messages more convincing, more personalized, and better timed to exploit a moment of distraction or urgency, and because phishing exploits ordinary human trust and decision-making rather than a fixable technical flaw, even well-informed people can occasionally be deceived by a sufficiently well-crafted attempt.

Editorially reviewed by Specialty Digest Editorial TeamLast reviewed November 2, 2026Researched and drafted with AI assistanceReport an issue