What Is Phishing?

Email phishing — the classic: a fake message from your 'bank,' 'IT department,' or 'shipping carrier' with a link to a lookalike login page.

Spear-phishing — a targeted attack using personal details (your name, your boss's name, your project) to seem more legitimate.

Whaling — spear-phishing aimed at executives, usually for wire-transfer fraud.

Smishing — phishing via SMS. 'Your USPS package can't be delivered, click here to update.' Hugely common in 2025–2026.

Vishing — phishing by phone call. 'This is Microsoft Support, your computer has a virus.'

Quishing — phishing using QR codes (often placed over real codes in restaurants, parking meters, etc.)

Clone phishing — a near-perfect copy of a real email you previously received, but with a swapped link.

Business Email Compromise (BEC) — attacker impersonates a vendor or executive to redirect a real invoice payment.

Universal red flags:

• Urgency — 'Your account will be closed in 24 hours.'
• Mismatched sender — display name says 'PayPal' but the email is from a random domain.
• Suspicious links — hover (don't click) and check the actual URL. `paypa1.com` is not `paypal.com`.
• Generic greeting — 'Dear Customer' from a service that knows your name.
• Unexpected attachments — invoices, shipping labels, or zip files you weren't expecting.
• Requests for credentials — legitimate services almost never ask for your password by email.

AI-generated phishing in 2026 has eliminated the old 'bad grammar' tell. Don't rely on that signal anymore.

1. Don't enter credentials if the page looks suspicious — close the tab.
2. If you already entered your password, change it immediately at the real site, and anywhere you reused it.
3. Enable 2FA on the affected account if it isn't already.
4. Run a malware scan in case the page dropped a payload.
5. Watch for follow-up attacks — successful phishers often immediately try other angles.
6. Report it — forward suspicious emails to `reportphishing@apwg.org` and to the impersonated company.

• Use a password manager — it auto-fills only on the real domain, so a lookalike won't trigger autofill (a huge tell).
• Enable 2FA everywhere — preferably with an authenticator app or hardware key, not SMS.
• Treat unsolicited links and attachments with suspicion, even from people you know.
• Verify payment changes out-of-band — a phone call to a known number, not the one in the email.
• Use a VPN with threat protection (NordVPN, Surfshark) that blocks known phishing domains at DNS level.
• Keep your browser updated — modern Chrome, Edge, Safari, and Firefox flag known phishing sites.