What is phishing, and how do you stop falling for it?

How a phishing attack works

Almost every phishing message has the same four parts. A bait: a bank, a delivery company, your boss, a tax office, a streaming service. A pressure: your account is locked, a payment failed, a parcel is held, someone is in trouble. A hook: a link to a page that looks like the real login, an attachment, a phone number, a QR code. And a cash-out: your login is used or sold, your card is charged, or a wire goes out.

The pressure is the part that matters. The FTC lists the stories that keep coming back: suspicious activity or log-in attempts on your account, a problem with your payment information, a request to confirm personal details, an invoice you do not recognise, a government refund, a coupon. None of them has to be believable for long. It only has to be believable for the ten seconds in which you tap.

The fake page is usually a copy of a real login, and it can pass a second factor too. CISA describes the common version: the victim types a username, a password and the six-digit code from an authenticator app into a page the attacker controls, and the attacker uses all three at once on the real site. A code that you type into a page is a code you can give away.

Types of phishing: email, text, phone, QR and more

The channel changes, the mechanism does not. Someone is pretending to be a sender you would act on.

Two of these are worth a longer look. BEC has no malware and often no link: it is a believable email and a changed account number, which is why it is expensive. Vishing and smishing matter because people read a text on a phone, a small screen that hides the address, and answer a call without the time they would give an email. The same idea with a cloned voice or a fake video call is covered on its own page.

How big phishing is: the numbers

Nobody counts every phishing message, because most are never reported. What exists are three partial counts, and they measure different things.

Phishing sites. The Anti-Phishing Working Group counted 1,069,681 unique phishing attacks in the second quarter of 2026, up 10.1% from 971,181 in the first. June alone had 425,808, the highest month since April 2023. That is a count of reported phishing sites, not emails. A single site can be advertised through thousands of different links. In that quarter 941 different brands were impersonated, and half of them five times or fewer, so the lures are not limited to the famous names.

Where they are heading. From the first quarter to the second, APWG reports smishing up 40%, and wire-transfer BEC attacks up 88%, with the average attempted theft up 45% to $61,732. The same report says that webmail and SaaS logins were 29.1% of all phishing in the quarter, so the thing most often targeted is the account that resets all your other accounts: your email.

Victims who file a complaint. In the FBI's 2025 Internet Crime Report, phishing and spoofing was the most reported crime type: 191,561 complaints out of 1,008,597 in total. The reported loss for that category was $215,843,126. That looks small next to the rest, and the likely reason is classification: the label covers the unsolicited message itself. The same report lists business email compromise at $3.05 billion, tech and customer support fraud at $2.13 billion, and investment fraud at $8.65 billion. Many scams in those categories open with a message, but the report does not say how many.

The count of complaints fell by about a third, and the dollars rose more than eleven times. Complaints are not attacks, so this does not show that phishing got rarer. It shows that fewer people filed under this label and that the reported losses per complaint grew. People over 60 reported about $7.7 billion across all crime types in 2025.

In breaches at companies. Verizon's 2026 Data Breach Investigations Report has phishing as the way in for 16% of breaches, behind vulnerability exploitation at 31%, and finds the human element in 62% of breaches. The same report says click rates in simulations that used text messages and voice calls were a median 40% higher than for email. The channels people check on a phone are where that gap shows.

What phishing leads to

The first consequence is the one people expect: the login or the card is used. The one people underrate is that your email is the master key. Whoever reads your inbox can click "forgot password" on your bank, your cloud storage and your social accounts, so one captured webmail login is many accounts.

• Money out. A card used for purchases, a bank transfer to a "safe account", a company wire sent to the wrong IBAN. Wires and crypto transfers are the hard ones to pull back, and a card can usually be blocked.
• Identity theft. The FTC says phishing can lead to identity theft, and that the stolen details may also be sold on to other scammers. Credentials do end up in dark-web collections, and what an email check will and will not show you has its own page.
• Malware. An attachment or a fake "update" installs a program. The worst case for a personal computer is a stealer that copies the logged-in browser, which defeats a new password because the stolen session is already open.
• Company breaches. One employee login is how many break-ins start, up to and including ransomware. The Verizon figure above is the share of breaches that began this way.
• Collateral. Your hijacked account then sends the next wave to your contacts. The same trick, a fake login page, is also used against people who go looking for dark web sites: dark web scams.

How to spot a phishing message

The old advice, to look for bad spelling, is out of date. CISA now says that some phishing emails have perfect grammar and spelling in the era of AI, so the other signs are what to look for. Those signs are in the situation, not the wording:

• You did not ask for it. A reset email you never requested, a parcel you never ordered, an invoice from a company you never dealt with.
• It is in a hurry. A deadline of hours, a threat of closure, a "final notice".
• It wants something a real company would not ask for by message. A password, a full card number, a one-time code, a gift card, a "safe account".
• The address is wrong. CISA's own example is a look-alike such as amaz a n.com. On a phone, hold the link to see the real address before you open it. The name in front of the address is free text, and the address behind it is not.
• The link is shortened or the page is slightly off. A login page on a domain that is not the company's, a padlock that proves only that the connection is encrypted, not that the site is honest.

If the message passes none of those but still feels off, treat that as the check. A legitimate message survives you opening the site yourself.

How to protect yourself from phishing

Protection works in layers. You will eventually click something, so the aim is that a click alone cannot cost you the account.

1. Go in through the front door. If the message might be real, the FTC says to contact the company with a phone number or website you know is real, not the information in the message. Type the address, use the app, or call the number on the back of the card.
2. Use a passkey or a security key where the site offers one. CISA calls FIDO/WebAuthn the gold standard because it is the phishing-resistant form of multifactor login. It will not work on a fake domain. It ranks authenticator-app codes below that, and SMS codes last, as a last resort, because those can be phished or intercepted. If an account has nothing better, an app code is still much better than no second factor.
3. Let a password manager do the typing. A manager fills a login only on the domain that is saved. When it stays empty on a page that claims to be your bank, that is a warning, not a bug. The tools page covers the options.
4. Never read a code to anyone. A bank, a tech company or the police will not ask you for the code they just texted you. Anyone who does is the attacker, logging in as you at that moment.
5. Protect the email account first. It is the reset path for the rest, so it gets the strongest login you have and a recovery method that is not itself a phone number you share.
6. Keep the device updated and backed up. The FTC's four basics are security software on the computer, automatic updates on the phone, multifactor authentication, and backups. A backup does not stop phishing, but it turns a malware infection into an annoyance instead of a loss.
7. Slow down any request that moves money. For companies: confirm any change of bank details by calling a number from your own records, and require a second person for wires. That is the only reliable defence against BEC, because the email itself can be perfect.

Threat modelling helps when you are the target rather than the crowd. What is OPSEC covers deciding who would want your accounts and what they would have to know to get in.

What to do if you already clicked or typed something

Do the steps that match what you actually did. Most clicks alone do nothing, and panicking in the wrong order costs more than the click did.

Then report it, because that is how the fake pages get taken down. Forward a phishing email to the Anti-Phishing Working Group at reportphishing@apwg.org, forward a phishing text to 7726 (SPAM), and report it to the FTC at ReportFraud.ftc.gov. Your mail app's own "report phishing" button works too.