What is phishing?

Phishing is the crime type reported to the FBI's Internet Crime Complaint Center more than any other, and it's the usual first step in account takeover and payment fraud. This guide explains what phishing is, how an attack works from first message to payoff, the main types and their names, and what actually stops it. For hands-on detail, it links to our deeper guides on spotting, reporting and recovering from phishing.

What is phishing?

Phishing is a form of social engineering in which an attacker poses as a trustworthy person or organization to get you to reveal sensitive information or take a harmful action. Social engineering means manipulating people rather than breaking technology. The joint CISA, NSA, FBI and MS-ISAC phishing guidance describes phishing as a technique where attackers "lure victims (typically via email) to visit a malicious site or deceive them into providing login credentials."

Official definitions agree on the core idea. NIST's glossary includes "tricking individuals into disclosing sensitive personal information through deceptive computer-based means." The FBI's 2025 IC3 report defines phishing/spoofing as "the use of unsolicited email, text messages, and telephone calls purportedly from a legitimate company requesting personal, financial, and/or login credentials."

So phishing is defined by deception and intent, not by channel. Email is the classic route, but the same scam works by text or phone.

What do phishing attackers want?

Phishing attackers want one of three things: your login credentials, a way to run malware on your device, or your money. The CISA-led guidance names the first two as the primary goals: "obtaining login credentials" for initial network access, and "malware deployment" for follow-on activity such as damaging systems or keeping a foothold.

The third goal, money, is usually reached through the first. A stolen mailbox lets a criminal read real conversations and send convincing payment requests from a real account. That's how phishing turns into business email compromise (BEC), the costliest form of email fraud.

How does a phishing attack work?

A phishing attack follows the same stages whether it targets one person or a million.

1. Pick a disguise. The attacker chooses who to impersonate: a bank, Microsoft, a delivery company, a supplier or your own CEO.
2. Build the lure. The message gives you a reason to act now, such as a locked account, an unpaid invoice, a missed delivery or a shared document.
3. Deliver it. The lure arrives by email, text, phone, QR code or a chat app. Bulk campaigns go to thousands of addresses; targeted ones go to a few.
4. Get the action. You click a link to a fake sign-in page, open an attachment, reply with details, call a number or approve a payment.
5. Cash in. The attacker signs in as you, installs malware, or collects the money. A taken-over account is then used to phish your contacts.

Here is a typical lure. This is an example, not a real message:

From: "Microsoft 365 Admin" <alerts@m365-secure-notice.example>
Subject: Action required: your mailbox will be suspended today

Your password expires in 2 hours. Messages sent to you will be
held until you verify your account.

[ Keep my password ]

The display name says Microsoft, but the address is an unrelated domain, and the button leads to a fake sign-in page. Our guide to fake Microsoft login phishing walks through this pattern in detail.

What are the main types of phishing?

The types of phishing differ by channel and by how carefully the target is chosen. The names overlap, and one attack can fit several.

Why does phishing still work?

Phishing works because it targets habits, not software. Most people handle dozens of messages a day and act on routine requests quickly. A lure only needs to look routine for a few seconds.

Attackers lean on a few reliable levers:

• Urgency. "Today", "in 2 hours", "final notice". Pressure cuts checking short.
• Authority. A message from "the CEO", "IT" or "the IRS" discourages questions.
• Familiarity. Real logos, real brand names and, after an account takeover, a real thread with a colleague.
• Plausible routine. Invoices, password expiry, shared files and delivery notices are things people genuinely get.

The FTC's phishing advice lists the stories scammers tell, including claims of "suspicious activity or log-in attempts," "a problem with your account or your payment information," and "an invoice you don't recognize." Spelling mistakes are a weaker clue than they used to be, because attackers now write with AI tools. Our guide to AI phishing emails covers what changed.

Email also makes impersonation easy by design. The SPF standard, RFC 7208, opens by noting that "any host injecting mail into the system can use any DNS domain name it wants" in the sender fields. Authentication standards narrow that gap, but only for domains that publish them and receivers that enforce them. See what email spoofing is for the details.

How common is phishing?

Phishing is the most reported crime type at the FBI's Internet Crime Complaint Center (IC3). The FBI's 2025 IC3 Annual Report logged 191,561 phishing/spoofing complaints in 2025, more than any other crime type, with $215,843,126 in reported losses. Business email compromise drew 24,768 complaints and $3,046,598,558 in reported losses in the same year.

Those are reports from victims, so they undercount. Our phishing statistics roundup puts the FBI figures next to APWG and Verizon data, with the source and year on every number.

How do you protect yourself from phishing?

You protect yourself from phishing by slowing down on any message that asks you to act, and by checking the request through a channel you already trust. Use this checklist:

1. Check the real sender address, not just the display name.
2. Treat urgency as a warning sign. Real organizations rarely need action within minutes.
3. Hover before you click and read the real link. Our guide on checking if a link is safe shows how on desktop and phone.
4. Don't sign in from a link in a message. Go to the site or app directly.
5. Verify payment or bank-detail changes by calling a number you already hold, never one in the message.
6. Turn on multifactor authentication (MFA), which asks for a second proof such as an app prompt or security key, so a stolen password alone isn't enough.
7. Report it. Use your mail app's report button. Our guide to reporting phishing covers Outlook, Gmail and the US and UK agencies.

The full list of warning signs, with three annotated examples, is in how to spot a phishing email.

How do businesses stop phishing?

Businesses stop phishing with layers, because no single control catches every message. The CISA-led guidance recommends a mix of technical and human controls, and the same pattern works for small teams:

• Filter inbound email. Scan links and attachments, and block risky file types. The guidance recommends gateway denylists for file extensions "such as .scr, .exe, .pif, and .cpl." See how spam filters work.
• Stop spoofing of your own domain. The guidance says to "ensure DMARC is set to 'reject' for sent emails." Start with what DMARC is.
• Harden sign-ins. It recommends phishing-resistant MFA (FIDO security keys or PKI), and number matching where push MFA is still used.
• Train and make reporting easy. It recommends regular training on spotting suspicious emails and on "the importance of reporting." Our awareness training guide shows how to run it without a big budget.
• Verify money movements. A callback rule for new or changed bank details defeats most BEC, whatever the email looked like.

For a full rollout order, use the small business email security checklist.

What should you do if you fall for phishing?

If you entered a password, change it at once from a trusted device, sign out other sessions and check that MFA is on. Then tell IT and report the message. If you shared card or bank details, call your bank. If you opened an attachment, disconnect the device and get it checked.

Our step-by-step guide, clicked a phishing link? what to do next, covers each case, including the mailbox forwarding rules attackers often add after a takeover.

Next steps

• Check whether your domain can be spoofed: run the free DMARC Checker or the full Email Health Check.
• Look inside a suspicious message with the Email Header Analyzer, which runs in your browser and uploads nothing.
• Agree a callback rule for payment and bank-detail changes, and write it down.
• If too much phishing reaches your inboxes, iBlockSpam filters spam, malware and phishing at the MX level before mail reaches Microsoft 365, Google Workspace or your own server. See how it works.