In phishing attacks, a threat actor pretends to be someone they’re not and uses fraudulent communication to trick a victim into sharing sensitive information or downloading malware.
Table of Contents
Phishing plays on the word fishing, referring to the way threat actors use ‘lures’ to trick their victims by impersonating legitimate entities. It is considered a social engineering attack because it uses trickery and fraudulent behavior to play on human emotions like fear, empathy, and greed.
In a phishing scheme, the attacker reaches out by email, text, phone call, or social media platform posing as a legitimate and trusted person or business. They use emotional manipulation to trick the victim into sharing sensitive personal or corporate data. The goal may be to:
- Steal personally identifiable information (PII) like usernames, passwords, credit card numbers, banking details, or sensitive corporate information they can sell or use to hack accounts or steal money
- Persuade the user to transfer money to what looks to be a reputable person or company
- Infect the user’s computer with malware or ransomware
How common are phishing attacks?
Phishing is the most common attack vector for data breaches. In the first quarter of 2025, the Anti-Phishing Working Group counted more than a million phishing attacks , the largest number since late 20231. Over 30% of those attacks targeted the online payment and financial sectors.
There are several reasons why phishing is popular among cyberattackers:
- It has a low cost: all you need to do is create an email or text message that looks like it comes from a genuine company.
- Attacks are highly successful because they exploit human emotions rather than pre-programmed technology.
- Organizations rely heavily on email, making it one of the highest threat vectors.
- It’s not always possible to catch these attacks in progress, even with security software, because a human can still choose to click a link, open a document, or share sensitive information. As per a Gartner® report, “Human errors account for approximately 76% of all security breaches. Additionally, system intrusions, basic web application attacks, and social engineering collectively represent 79% of all breaches.”
How phishing attacks started
The term phishing was first used in 1994 when a group of teens worked to manually obtain credit card numbers from unsuspecting users on AOL.
Since then, hackers have continued to invent new ways to gather details from anyone connected to the internet. By the mid 2000s, other terms like ‘spear phishing’ and ‘whaling’ came into existence to describe attacks focused specifically on executives or high-profile, highly authorized individuals.
By the 2010s, phishing attacks weren’t just happening via email or chat rooms. Threat actors were using multiple platforms, including mobile devices, social media, and messaging apps.
Today, threat actors use AI to craft messages, including phone calls and videos, appear more believable, correcting grammar and spelling mistakes, personalizing messages by gathering data from social media, and translating them into any target language. They can also create Deepfakes: highly realistic audio and video content where AI is often used to capture someone’s voice or image.
How does phishing work?
Usually, the message used to initiate a phishing attack is made to seem urgent, requiring a quick response. It may prompt the recipient to click on a link or send sensitive information to avoid an account being deactivated, for example. If the user completes the action, their data is shared with the bad actor or malware is downloaded to their computer. Phishing messages are intentionally hard to spot because they mimic the look and feel of legitimate messages, using official logos, URLs, and other features.
While most phishing messages pose as coming from a known and trusted source such as a bank, sometimes the sender is a stranger, as in the case of the early phishing attack that became known as the “Nigerian prince” scam. In it, the victim received an email from someone claiming to be a wealthy royal or official who needed help transferring money out of their country. They promised a large future reward if the receiver first sent them money or personal information. This tactic is still used today.
Technical aspects of phishing
While a phishing attack could be as simple as a fraudulent email, there are many sophisticated techniques which have developed over the years to make messages more convincing and the capture of information more effective:
- Domain spoofing: disguising an email or website to make it look like it’s from an authentic domain, for example by using a lookalike URL or typosquatted domain (a misspelling or slight variation of a legitimate website).
- Fake websites: setting up a fraudulent website designed to imitate a real one.
- Email spoofing: forging a sender’s email address, so the message looks like it is from a genuine organization.
- Fake SSL certificates: using a stolen or fraudulent security certificate to make a website appear secure, usually by showing the familiar padlock symbol.
- Fake/malicious login pages: copies of genuine login forms that capture a victim's username and password.
- Malicious links: URLs that deliver malware or redirect the user to a phishing page.
- Contact scraping: various techniques used to collect data like email addresses, employee names, or personal information to build a target list or personalize messages.
- DNS fast-fluxing: quickly rotating the IP addresses used by a malicious domain to avoid detection.
How is phishing different from other cyberattacks?
Other common types of cyberattacks are malware and spam. Here’s how phishing is different:
- Malware is a technical threat that can be installed on a system without a human responding to a fraudulent message. Phishing can be used to deliver malware, but the two are different.
- Spam refers to unsolicited bulk messaging like unwanted ads or content. Unlike phishing, spam does not include impersonation or social engineering.
Types of phishing attacks
With so many mediums available to bad actors, it’s no surprise that there are multiple types of phishing attacks today:
- Angler/Social media phishing: A bad actor reaches out to the victim via a DM on a social media platform, leading to social media phishing.
- Application/In-app phishing: Fake login screens or malicious pop-up messages appear in legitimate apps.
- Business email compromise (BEC): This highly damaging corporate form of phishing may use hacked employee email accounts to send messages or have a cybercriminal impersonate an executive or vendor to request a money transfer to a fraudulent account. Sometimes BECs can be internal, with stolen credentials used by a company insider to access the internal payment system and divert funds.
- Clone phishing: A trusted, authentic message that’s been received previously is sent again with a malicious link or dangerous attachment. Since the recipient trusted the initial message, they are more likely to believe and respond to the subsequent message.
- Email phishing: A hacker sends a legitimate-looking email designed to cause concern, worry, or intrigue and prompt the receiver to click a link or share personal data. Despite the multitudes of new platforms available to cybercriminals, email phishing remains the most prevalent. One reason is because the same message can be sent separately to many people, increasing the chances of success.
- QR code phishing/ Quishing: Quishing is a phishing variant that occurs when a QR code leads to a malicious website, for example where the user’s credentials may be captured.
- Smishing: A cybercriminal sends a text message (an SMS) asking the recipient to click on a link or to phone the sender, leading to smishing.
- Spear phishing: A hacker sends a targeted email to an organization or individual. Often someone in the financial department is targeted because they have privileged access to or authority over sensitive data. The cybercriminal may gather or buy information about their target to make the message more specific and believable.
- Vishing: A threat actor calls a landline, mobile, or VoIP phone to engage the user in a conversation, which is known as vishing.
- Whaling: Whaling is similar to spear phishing but usually targets senior executives.
Recognizing phishing attempts
With phishing being so prevalent, it is crucial for all staff to be aware of the signs of phishing messages, including:
- Suspicious sender addresses such as accounts.paypal@gmail.com, which uses ‘paypal’ in the email name but is actually a gmail address.
- Misspellings or grammatical errors in the message.
- Urgent calls to action, threats, or requests for personal information.
- No contact information on the website or in the email signature.
- Offers that are too good to be true.
- Emails with no personal name, for example “Dear Madam.”
- Shortened links.
- Mismatched domains, where the end of the email address doesn’t match the official website, for example name@amaz0n.com instead of name@amazon.com. Here, the o has been swapped for a zero.
- Attachments with an unexpected file type, especially .exe or .zip.
Case studies of successful phishing attacks
There are several phishing campaigns that have gained notoriety over recent years:
- Google Docs Phishing (2017): Victims received emails asking for them to grant access to what appeared to be a Google Doc but was a fake OAuth app. When users granted access, attackers were able to access the Gmail contacts of the users and send the message to even more victims.
- PayPal Phishing Scams (ongoing): Bad actors send emails that look like official PayPal messages warning of suspicious activity or account issues. When the recipient clicks on the link, it takes them to a fake login page where their credentials and financial details are stolen.
- Office 365 Credential Attacks (2019–Present): Emails made to look like notifications from Microsoft, usually targeting businesses. They might claim the recipient’s password has expired or they have a new voicemail, with a link leading to a fake login portal that captures corporate credentials for use in BEC attacks.
Preventing phishing attacks
While phishing is ubiquitous, there are many ways individuals and organizations can protect themselves and their businesses.
Best practices for individuals
- Inspect emails carefully before replying. Check for spelling or grammatical errors and avoid sharing financial or personal data via email. Think before opening an email attachment. Were you expecting an attachment from that person? If not, ask them directly.
- Check URLs before clicking and avoid clicking on links from unknown sources. Hover over the link to see if it appears legitimate and that it begins with ‘https’, indicating that it’s a secure site. Avoid clicking on shortened URLs, e.g. bit.ly
- Before typing sensitive data into a website, look at the URL at the top of the page. Is this the real website? Are there extra letters in the address? Are there letters swapped out for numbers like an O for a 0? Does it begin with https?
- Keep security software, apps, devices, and browsers updated.
- Use firewalls as well as anti-virus, anti-malware, and anti-phishing tools.
- Change passwords frequently and use passwords close to or longer than 20 characters. Include uppercase, lowercase, numbers, or symbols in your passwords. Don’t reuse the same password for multiple sites or applications. If you have trouble keeping track of your passwords, create one long one you will remember and lock up the rest in a password manager.
- Enable two-factor authentication (2FA) on your account.
- Use secure messaging platforms.
- Think before you click on posts from friends. If it seems like something is too good to be true, it probably is. Think before responding to a post that says your friend is in trouble and needs money. Is this how they would contact you?
- Think before clicking on a pop-up or pop-under.
- Don’t give out personal data unless you are positive about talking to someone you trust.
Best practices for organizations
- Use an email gateway to block spam emails and remove emails that contain suspicious links or attachments.
- Gartner recommends, “Invest in email security solutions machine learning (ML) capabilities to identify AI-generated phishing and quishing attempts.3” These tools help detect sophisticated attacks that traditional filters might miss.
- Use a domain-based message authentication, reporting, and conformance (DMARC) email authentication tool to stop criminals from spoofing a “from” address in an email.
- Invest in a web filter that performs malicious URL detection and content filtering
- Install an endpoint protection solution to protect the organization’s devices.
- Use AI filtering methods to spot BEC emails.
- Employ a service-integrated security solution to protect against phishing attacks that come from inside your organization.
- Make your employees aware of the dangers of phishing attacks by including them in regular phishing simulations and trainings.
What to do if you encounter phishing
If you or your organization fall prey to a phishing attempt, it is important to act quickly:
- Check financial accounts for suspicious or unexpected activity.
- Change passwords and enable 2FA.
- Run a security scan and install or update antivirus and anti-malware software.
- Notify relevant authorities, which might include a bank, social media platforms, ISP, IT department, and finance department.
- Report the attack to the Federal Trade Commission (FTC) and the Anti-Phishing Working Group.
- Register with a credit reporting agency like Equifax, Experian, or TransUnion to continue to protect against identity theft.
Stay ahead of the threat
Phishing attempts can prove devastating, leading to data breaches, financial losses, intellectual property theft, ransomware infection, or reputational damage. It is crucial for organizations to proactively protect themselves by employing layered security, remaining vigilant, and raising awareness among staff.
Where can I get help defending against phishing attacks?
Phishing remains one of the most effective—and costly—ways attackers infiltrate organizations. As social engineering techniques evolve, traditional email filters and reactive defenses simply aren’t enough. Security teams need tools that understand human behavior, detect subtle anomalies, and stop threats long before they reach an inbox. That’s where modern, AI‑powered email and collaboration security comes in.
Trend Vision One™ – Email and Collaboration Security helps organizations proactively manage human risk and defend against today’s most advanced phishing threats. Instead of relying solely on static rules or signature‑based detection, it puts people at the center of cybersecurity—analyzing communication patterns, user behaviors, email intentions, and contextual signals to uncover attacks hidden in trusted relationships.
Scott Sargeant, Vice President of Product Management, is a seasoned technology leader with over 25 years of experience in delivering enterprise-class solutions across the cybersecurity and IT landscape.
Frequently Asked Questions (FAQs)
Do phishing attacks affect small businesses differently than large enterprises?
Phishing attacks often lead to greater financial loss, downtime, and reputational damage for small businesses because they don’t have the same cybersecurity resources.
What is the difference between phishing and pharming?
Phishing tricks victims into sharing sensitive information. Pharming secretly redirects a user from a genuine website to a fraudulent one.
Can phishing attacks bypass two-factor authentication (2FA)?
Yes. It’s possible for a phishing kit to capture a one-time code or use a reverse proxy to hack a login session, essentially bypassing 2FA.
What is an example of a real-world phishing email?
A fake email from Amazon that says your account has been suspended and tells you to click on a link to verify your account would be an example of phishing.
How do cybercriminals use AI or deepfakes in phishing?
Threat actors use AI to write targeted, believable messages or create deepfake voices or videos that look and sound like someone the recipient knows.
What industries are most targeted by phishing attacks?
The industries most targeted by phishing attacks include financial services, healthcare, and retail, since they store a large amount of customer data and payment information.
How can mobile device users protect themselves from phishing?
Mobile device users should verify senders of messages, use mobile security apps, keep their devices and browsers updated, and avoid clicking suspicious links.
How long does it take for organizations to detect a phishing attack?
It can take weeks or months to detect a phishing attack, since phishing often only becomes evident after credentials are misused or suspicious activity is noticed.
What legal consequences exist for phishing attackers?
Legal consequences for phishing attackers include fines, imprisonment, seizure of assets, and even extradition.
What role does DNS security play in preventing phishing?
DNS security stops a user from accessing known malicious domains or fake sites and supports authentication protocols like DMARC, SPF, and DKIM to verify senders.