Phishing
Phishing is when someone sends a fake message (usually an email, text, or website link) designed to trick you into giving up personal information like passwords or credit card numbers.
These messages often look like they come from a trusted source, such as your bank or a popular company. Learning to spot phishing is one of the most important things you can do to protect yourself online.
Phishing, explained at three levels
At home
Phishing is when a scammer sends you a message pretending to be someone you trust, like your bank or a delivery company, hoping you'll click a link and enter your personal information. The message might look very real, but it's a trap designed to steal your data. Always double-check before clicking links in unexpected messages.
At work
In the workplace, phishing is one of the top ways attackers gain access to company systems. Employees may receive emails that appear to come from IT, a manager, or a vendor, asking them to click a link or provide login credentials. Organizations combat this with email filters, security awareness training, and simulated phishing tests.
At home
Phishing comes in several forms: standard email phishing casts a wide net, spear phishing targets specific individuals, and smishing uses text messages. Recognizing the signs (urgent language, mismatched URLs, unexpected attachments) helps you avoid falling for increasingly sophisticated attempts.
At work
Professionally, phishing represents a significant business risk because a single compromised employee account can lead to data breaches, financial fraud, or ransomware deployment. Security teams implement email authentication protocols like SPF, DKIM, and DMARC alongside user training to reduce the organization's phishing attack surface.
At home
Advanced users understand that phishing attacks can bypass basic defences through techniques like homograph attacks using lookalike domain names, or by compromising legitimate email accounts to send convincing messages. Using hardware security keys for authentication makes phishing nearly impossible to succeed even if you accidentally click a bad link.
At work
At an enterprise level, advanced phishing campaigns may involve business email compromise where attackers impersonate executives to authorize wire transfers. Security teams deploy advanced threat protection, analyze email headers and URLs in sandboxed environments, and use threat intelligence feeds to identify emerging phishing campaigns targeting their industry.
Real-world examples
At home
Nadia received a text message claiming her streaming account was suspended and she needed to click a link to reactivate it. She noticed the URL didn't match the real company's website, so she opened the app directly instead and confirmed her account was fine. It was a phishing attempt.
At work
Thomas, a finance director, received an email that appeared to be from the CEO requesting an urgent wire transfer. Because the company had phishing awareness training, Thomas called the CEO directly to verify and discovered the email was fraudulent, preventing a $50,000 loss.
Common confusions
- It's a popular misconception that phishing only happens through email. Phishing can come through text messages, phone calls, social media, and even fake websites.
- It's easy to assume you can always spot a phishing message. Sophisticated phishing attempts can be nearly indistinguishable from legitimate communications.
- It's tempting to think phishing only targets individuals. Phishing is the starting point for many large-scale corporate data breaches.
For analysts
Business analysts should factor phishing risk into any project that involves user-facing communications or authentication flows. When designing processes that send emails or request login credentials, consider how an attacker might mimic those communications. Including anti-phishing measures in requirements helps protect both the organization and its customers.
History & origin
The term phishing appeared in the mid-1990s when hackers used fake AOL messages to steal user credentials. The name is a play on 'fishing,' because attackers cast out bait hoping someone will bite. Phishing has since evolved into one of the most common and effective cyberattack methods worldwide.