What is phishing?
Quick answer
Phishing is a type of cyberattack in which criminals send deceptive messages, usually emails, texts or calls, pretending to be a trusted organization such as a bank, delivery company or employer. The goal is to trick people into revealing sensitive information such as passwords or card numbers, sending money, or opening harmful files or links.
Why “phishing”?
The word is a play on “fishing”: attackers cast out bait and wait for someone to bite. The “ph” spelling comes from early hacker slang, and the term was used in the mid-1990s about scams targeting AOL users.
Common types
| Type | How it works |
|---|---|
| Email phishing | Mass emails pretending to be from well-known companies |
| Spear phishing | Personalized messages aimed at a specific person or company |
| Smishing | Phishing by SMS text message, such as fake parcel delivery alerts |
| Vishing | Voice phishing by phone, sometimes using cloned voices |
| Business email compromise | Fake messages from a “boss” asking for urgent payments |
| QR code phishing | Fake QR codes leading to bogus sites; see how to scan a QR code |
Warning signs
- Urgency or threats: “Your account will be closed today!”
- Requests for passwords, codes or payment details
- Sender addresses or links that don’t match the real company
- Unexpected attachments
- Offers that seem too good to be true
- Generic greetings like “Dear customer”
Hovering over a link (without clicking) on a computer can reveal its real destination; see what URL stands for.
How to protect yourself
- Don’t click links in unexpected messages; go to the company’s website or app directly.
- Turn on two-factor authentication for important accounts.
- Use a password manager and a unique password for each account.
- Keep software updated.
- When in doubt, contact the organization using a phone number or website you already trust.
If you’ve been caught
Change affected passwords right away, contact your bank if financial details were shared, and report the message, for example to your email provider or national cybersecurity agency. If you need to change a Microsoft password, see how to change your Microsoft account password.
A VPN doesn’t stop phishing on its own; see what VPN stands for.
Still curious?
Jump to a random question from the archive.