What Is Phishing? Meaning, Types, Examples and Signs

What is phishing? Learn what phishing means, how a phishing attack works, the main types from smishing to quishing, warning signs and what to do if you clicked.

What is phishing? Phishing is a type of cyber attack in which criminals impersonate a trusted company, institution or person, usually by email, text message, phone call, social media or a fake website, to trick you into handing over passwords, payment details or one-time codes, sending money, or installing malware. It works by deceiving people rather than by breaking technology.

This guide explains what phishing means, where the odd spelling comes from, how a phishing attack unfolds step by step, the main types you will meet, the warning signs, what to do if you already clicked, and how organizations defend themselves and their customers.

What is phishing? The meaning in plain words

At its core, phishing is fraud by impersonation. The attacker pretends to be someone you already trust (your bank, a delivery company, a streaming service, your IT department or your manager) and creates a reason for you to act quickly. The action they want is almost always one of four things:

• Enter credentials on a fake login page, such as an email, banking or cloud account.
• Hand over payment data, including card numbers and the one-time codes that approve transactions.
• Send money directly, for example by paying a fake invoice or buying gift cards.
• Run malicious software by opening an attachment or installing an "app" or "update".

People use "phishing attack" and "phishing scam" almost interchangeably. Security teams tend to say phishing attack when the goal is to break into an organization, while consumer guides say phishing scam when the goal is to steal money or personal data from individuals. The word is also sometimes misspelled "phising", but it always refers to the same thing.

What is phishing in cyber security?

In cyber security, phishing is classed as a form of social engineering: manipulating people into doing something that weakens security. It matters because it is one of the most common ways attackers get their first foothold. A single stolen password can open a mailbox, and a compromised mailbox can be used to send more convincing phishing to colleagues, customers and suppliers. That is why phishing appears in almost every security awareness program and incident response plan.

What is "phish"? Where the word comes from

"Phishing" is a play on fishing: the attacker casts out bait and waits for someone to bite. According to a Computerworld history of the term, it was coined around 1996 by hackers stealing America Online (AOL) accounts and passwords. The "ph" reflects the hacker habit of swapping "f" for "ph", a nod to phone phreaking, the earlier culture of manipulating telephone networks. In that early slang, the stolen accounts themselves were called "phish" and were even traded among hackers.

What is a phishing attack? How it works step by step

Most phishing campaigns, whether they target one person or millions, follow a similar sequence:

1. Pick a brand and a goal. Attackers choose an organization people trust and interact with often, such as a bank, a courier, a marketplace or a software platform, and decide what they want to steal.
2. Build the infrastructure. They register a lookalike domain (for example examp1e.com instead of example.com), clone the real login or payment page, and often use a ready-made "phishing kit" that forwards captured data to them in real time.
3. Write the lure. The message copies the brand's logo, tone and layout and invents a reason to act: a locked account, a failed payment, a parcel on hold, a security alert or a document waiting to be signed.
4. Deliver it. The lure goes out by email, SMS, messaging app, social media, search or social ads, phone call or QR code.
5. Hook the victim. Urgency, fear or reward pushes the target to click without checking. The fake page looks right, so they enter their details.
6. Harvest and cash out. Stolen passwords are tested on other services, card data is used immediately, and one-time codes are relayed live to approve transactions or new device logins.
7. Move on. Phishing pages are short-lived by design. When one is blocked or taken down, the attacker spins up another domain and repeats the process, which is why fast detection and removal matter.

Main types of phishing

These are the variants you are most likely to encounter.

Email phishing

The classic form: mass emails that impersonate a well-known brand and link to a fake login or payment page, or carry a malicious attachment. Our guide on how to spot a phishing email covers the details.

Spear phishing

A targeted attack on a specific person or team, using details gathered from social media, company websites or earlier breaches to make the message believable. Read more in what is spear phishing.

Whaling

Spear phishing aimed at senior executives or people with authority over money and data. Lures often involve legal matters, board documents, acquisitions or urgent payments.

Smishing (SMS phishing)

Phishing delivered by text message or chat apps, commonly about parcels, banks, road tolls or taxes. Short links and small screens make the destination harder to inspect. See phishing links and texts.

Vishing (voice phishing)

Phone calls from someone posing as a bank's fraud team, tech support, the police or a tax office. It is often paired with a text asking you to call a "security line" run by the scammer.

Clone sites and lookalike domains

Copies of real websites hosted on domains that differ by a character, a hyphen or a different extension. Some use homoglyphs, characters from other alphabets that look identical to Latin letters. Learn how these are built in typosquatting and homoglyph domains explained.

Social media and ad phishing

Fake brand profiles, fake "customer support" accounts that reply to complaints, and paid ads that place a phishing site above the real one in search results or social feeds.

QR code phishing ("quishing")

A QR code in an email, letter, poster or sticker that leads to a phishing page. Because you cannot read a QR code by eye, it hides the destination, and on a phone the page opens outside the protections of a work email system. The US Federal Trade Commission warns that scammers hide harmful links in QR codes, including stickers placed over legitimate codes on parking meters.

Phishing examples you may recognize

These are generic, composite examples of common patterns, not real cases.

• The locked account. "We detected unusual sign-in activity. Your account will be suspended in 24 hours unless you verify your identity." The button leads to a cloned login page on a domain like example-account-security.example.
• The unpaid invoice. An email with a PDF or a "shared document" link claims an invoice is overdue. The document asks you to sign in to view it, capturing your work email password.
• The parcel fee. A text says a parcel is held until you pay a small redelivery or customs fee. The payment page then asks for the one-time code your bank sends, which the attacker uses to approve a larger payment.
• The helpful support agent. You complain about a company on social media, and an account using its logo replies within minutes, sending you a link to "resolve your case".
• The urgent request from the boss. A message that appears to come from a senior manager asks you to buy gift cards or pay a new supplier today and keep it confidential.

Warning signs of a phishing message

No single sign proves a message is phishing, but several together should make you stop:

• Urgency or threats: deadlines, suspensions, fines, or "final notice" language.
• Requests for sensitive data: passwords, card numbers, one-time codes or identity documents. Legitimate companies do not ask you to send these through a link in an unexpected message.
• A sender or link that does not match: a display name that says your bank but an address or domain that does not belong to it.
• Generic greetings such as "Dear customer" from a company that normally uses your name.
• Unexpected attachments or shared files, especially ones that ask you to log in or enable content.
• Offers that are too good to be true: refunds, prizes or investment returns you did not expect.
• Pressure to keep it secret or to switch to a different channel, such as a private chat or a phone number provided in the message.

Poor spelling and grammar used to be a reliable clue, but the US Cybersecurity and Infrastructure Security Agency notes that AI tools now let scammers write polished messages, so rely on the other signs.

What to do if you clicked a phishing link

What you do next matters more than the click itself. Act quickly:

1. Stop. Close the page and do not enter anything else.
2. If you entered a password, change it immediately by typing the real website address yourself, not through the message. Change it anywhere else you reused it, and turn on multi-factor authentication.
3. If you entered card or bank details, call your bank using the number on your card or its official app, block the card and ask about any recent transactions.
4. If you downloaded or opened a file, disconnect from the network, run a full scan with up-to-date security software, and if it is a work device, contact your IT or security team straight away.
5. Watch your accounts for password-reset emails, new devices or forwarding rules you did not create.
6. Report it so others are protected (see below).

At work, report first and worry later. A quick report lets the security team block the sender and the link before others click. In the US, the FTC also points people who shared personal information to IdentityTheft.gov for recovery steps.

How to report phishing

• Phishing emails: use your email app's report button, and in the US forward to the Anti-Phishing Working Group at reportphishing@apwg.org. In the UK, forward suspicious emails to the NCSC's Suspicious Email Reporting Service at report@phishing.gov.uk.
• Phishing texts: in both the US and the UK, forward the message to 7726, according to the FTC and the NCSC.
• Fraud and losses: in the US, report at ReportFraud.ftc.gov. In England, Wales and Northern Ireland, use Report Fraud, which replaced Action Fraud in December 2025; in Scotland, call Police Scotland on 101.
• Phishing websites: report the page to Google Safe Browsing and Microsoft so browsers start warning other visitors.

For a fuller walkthrough by country and channel, see how to report a scam.

How organizations defend against phishing

No single control stops phishing. Effective programs layer people, technology and fast response.

Training and a culture of reporting

Short, regular training that uses realistic examples helps staff recognize lures. Just as important is making reporting easy, with a single button in the mail client, and thanking people who report, including those who clicked.

Email authentication: SPF, DKIM and DMARC

These standards let receiving mail servers check whether a message claiming to come from your domain really did. A DMARC policy set to quarantine or reject stops criminals from sending email that uses your exact domain. It does not stop lookalike domains, but it closes the easiest door.

Phishing-resistant authentication

Passwords and SMS codes can both be phished. CISA recommends phishing-resistant MFA based on FIDO/WebAuthn, such as security keys and passkeys, because they will not authenticate on a fake domain.

Brand monitoring and takedowns

Training cannot stop criminals from cloning your website to target your customers. That threat lives outside your network, on lookalike domains, hosting accounts, social profiles and ads. Defending against it means monitoring for new lookalike domains and cloned pages, then getting them removed quickly through hosting providers, registrars, Cloudflare, browser blocklists such as Google Safe Browsing and Microsoft SmartScreen, and national CERTs. Our step-by-step guide to the phishing site takedown process shows what that looks like in practice.

How Phishvoid helps

Phishvoid detects lookalike domains and cloned login pages that impersonate brands and works to get them taken down through hosting providers, Cloudflare, registrars, DMCA notices, browser blocklists and CERTs. We act only with written authorization from the brand owner, and one all-inclusive subscription covers unlimited takedowns.

Found a fake site using a brand's name? Report a phishing site to us. If you are responsible for a brand, book a free exposure scan to see which lookalike domains and clones are already out there.

FAQ

What is phishing in simple terms?

Phishing is when a criminal pretends to be someone you trust, such as a bank, a company or a colleague, to trick you into giving away passwords, payment details or money, or into installing malware.

What is the difference between phishing and spam?

Spam is unwanted bulk messaging, often just advertising. Phishing is deliberately deceptive: it impersonates a trusted sender to steal data or money. Some spam is phishing, but not all spam is.

Can I get hacked just by opening a phishing email?

For most people, simply opening an email is low risk on an up-to-date device. The danger comes from clicking links, opening attachments, enabling content or replying with information. Keep your software updated to close the rare flaws that do not need a click.

Why is phishing spelled with "ph"?

It is a hacker-style twist on "fishing", likely influenced by "phreaking", the earlier practice of hacking telephone systems. The term dates to the mid-1990s.

Is smishing the same as phishing?

Smishing is phishing sent by SMS or chat app. Vishing is phishing by voice call. Both are types of phishing that use a different channel.

How can a company stop phishing sites that copy its brand?

Monitor for new lookalike domains and cloned pages, publish a strict DMARC policy, and have a takedown process ready so fake sites are reported to hosts, registrars and browser blocklists as soon as they appear.