Why Phishing Still Works
Despite decades of awareness campaigns, phishing remains one of the leading causes of data breaches and account compromises. The reason is straightforward: phishing attacks social engineering rather than technical vulnerabilities. It doesn't matter how strong your password is if you're tricked into typing it into a fake website. Attackers have also become significantly more sophisticated — AI-generated text has eliminated the typo-riddled emails of the past, making modern phishing messages far harder to spot.
Types of Phishing You Should Know
Email Phishing
The classic form. Attackers send mass emails impersonating trusted brands (banks, delivery services, popular software platforms) to harvest credentials or distribute malware. Volume is the strategy — even a low success rate across millions of emails yields results.
Spear Phishing
Targeted attacks directed at a specific individual or organization. The attacker researches their target — using LinkedIn, social media, and public records — to craft a convincing, personalized message. These are far more dangerous and harder to detect.
Smishing and Vishing
Smishing uses SMS text messages, often claiming to be delivery notifications, bank alerts, or government agencies. Vishing uses voice calls — increasingly with AI-generated voices to impersonate people you know or authoritative figures like IT staff or bank representatives.
Quishing
An emerging tactic using malicious QR codes, often placed in physical locations or embedded in documents. Scanning the code takes the victim to a phishing site or triggers a download.
Red Flags to Watch For
- Urgency and pressure: "Your account will be suspended in 24 hours" or "Immediate action required" are classic manipulation tactics designed to bypass careful thinking.
- Mismatched or lookalike domains: The display name might say "PayPal" but hovering over the link reveals paypa1-secure.com. Check URLs carefully.
- Generic greetings: "Dear Customer" instead of your actual name is a signal the sender doesn't know you.
- Requests for sensitive information: Legitimate organizations will never ask for your password, full Social Security number, or CVV code via email.
- Unexpected attachments: An invoice or document you weren't expecting is a common delivery mechanism for malware.
Practical Defenses
Use Multi-Factor Authentication (MFA) Everywhere
Even if a phisher successfully steals your password, MFA adds a second barrier they typically can't bypass. Use an authenticator app (like Authy or Google Authenticator) rather than SMS-based MFA where possible, as SIM swapping can bypass SMS codes.
Verify Out-of-Band
If you receive an urgent email from your bank, IT department, or a colleague asking you to do something unusual — don't reply to the email. Contact them through a known phone number or a separate communication channel to confirm the request is legitimate.
Use a Password Manager
Password managers only auto-fill credentials on the exact domain they were saved for. If you land on a convincing fake site, your password manager won't offer to fill in your credentials — a powerful passive defense against phishing.
Keep Software Updated
Phishing emails sometimes link to exploit pages that target browser or plugin vulnerabilities. Keeping your browser, OS, and plugins current closes these attack vectors.
What to Do If You've Been Phished
- Change your password for the affected account immediately.
- Revoke any active sessions from the account's security settings.
- Enable or review MFA on the account.
- Check for any rules or forwarding set up in your email (attackers often configure these silently).
- Report the phishing attempt to the impersonated organization and your email provider.
Acting quickly after a phishing incident dramatically limits the potential damage. The most important thing is not to panic but to move methodically through these steps.