What is phishing? How it works, and how to recognise it

Phishing is an attempt to get you to hand over something valuable — a password, a one-time code, a payment, or permission to install software — by pretending to be a person or organisation you already trust.

That is the whole of it. Everything else about phishing is decoration: the branding, the pretext, the channel it arrives through, the particular emergency it invents this month. Those change constantly. What sits underneath them has been the same for thirty years.

Understanding that distinction is what makes the difference between memorising a list of red flags that expires within a year, and having a defence that still works against an attack that has not been invented yet.

Why it works

Phishing does not attack a system. It attacks a judgement call, and it picks the moment when your judgement is cheapest.

The message arrives while you are between two other things. It looks like something you were half-expecting — a delivery, an invoice, a password reset, a message from your manager. It asks for one small action that would take fifteen seconds. Nobody is fooled by a phishing email they read carefully. They are fooled by one they glance at.

This is also why "just be careful" fails as advice. Carefulness is a resource that runs out, and phishing is specifically timed to arrive when yours has.

The scale of it

The Anti-Phishing Working Group recorded 1,003,924 phishing attacks in the first quarter of 2025 alone — its largest quarterly figure since late 2023. Payment and banking targets together accounted for 30.9% of them.

Those numbers are worth holding lightly, though. Reported phishing is a fraction of attempted phishing, and attempted phishing is cheap enough that volume is not really the constraint. The useful takeaway is not that the number is large but that it is stable: this technique keeps being used because it keeps working.

The four things every phishing message wants

Strip away the branding and the story, and every phishing attempt is asking for one of four things. This is the most durable thing you can learn about the subject, because a new pretext is easy to invent and a fifth category is not.

The forms it takes

Phishing is named after email because that is where it started, but attackers follow attention, and attention moved to phones. The same attack now arrives through whichever channel you are least defended on.

• Email phishing — the original, still the highest volume, and the form most likely to be filtered before you see it.
• Smishing — text message. Shorter, so there is less to inspect, and link previews are harder to check on a phone.
• Vishing — a phone call, increasingly with a cloned voice. Live conversation removes your time to think.
• Quishing — a QR code, which hides the destination behind an image your eye cannot parse.
• Spear phishing — targeted at you specifically, using real details about your life or job.

Attackers are sending millions of emails a day containing QR codes, according to the APWG, precisely because a QR code defeats the "hover the link and read the destination" habit that a decade of security training built.

How to actually defend against it

The instinct is to get better at spotting fakes. That is a losing race — fakes improve, and generative tools removed the spelling mistakes that used to do half the work of detection for us.

The winning move is structural: stop acting from inside unexpected messages.

1. Verify through a channel you chose. Not the link, not the phone number in the message. Type the address yourself, or use the number on the back of your card. This single habit neutralises almost every variant, because the entire attack depends on you using the path the attacker supplied.
2. Treat urgency as a reason to slow down. The deadline exists to stop you doing what you are doing right now: thinking about it. The feeling of pressure is itself the signal.
3. Use phishing-resistant authentication. A passkey cannot be handed to a fake site, because it will not present itself to the wrong domain. This moves the problem out of the realm of human vigilance entirely.
4. Use a password manager. It will not autofill your bank password on a lookalike domain, which makes it a rather good phishing detector that never gets tired.

If you think you have already fallen for one

Speed matters far more than thoroughness. Change the password on the affected account first, then any account sharing that password, then turn on two-factor authentication, then review recent account activity. A password changed within the first ten minutes usually ends the incident.

The full sequence, including what to do if you entered card details or opened a downloaded file, is in I clicked a phishing link — what should I do?