What is Phishing? Attack Types and Prevention Guide

Phishing is a cyberattack in which someone sends a fraudulent message — usually email — that appears to come from a trusted source to trick the recipient into revealing sensitive information or running malicious code. The goal is almost always one of three things: steal login credentials, capture financial details, or get malware onto a device. Because so much phishing arrives by email and relies on forged sender identities, it is blunted directly by email authentication: SPF, DKIM, and DMARC.

When you need to separate the false identity signal from the harmful request itself, use the phishing vs spoofing classifier. It labels a message as spoofing, phishing, both, or neither without treating an authentication result as proof of intent.

If the question is whether a person was lured by a message or instead redirected after using a familiar address, see pharming versus phishing. The distinction separates message-led social engineering from a technical redirection investigation.

How does phishing work?

Phishing attacks rely on deception and social engineering to push a victim into acting before they think. A typical campaign moves through five stages:

The typical flow of a phishing attack.

• Crafting the message. Attackers mimic a real organization using a spoofed From: address, familiar logos, and urgent language ("Your account is locked"). Domains that have not published a DMARC policy are the easiest to impersonate.
• Targeting victims. Messages go to harvested or purchased lists — either in bulk, or tailored to a specific person, which is known as spear phishing.
• Delivering the payload. The message pushes one action: clicking a link to a fake login page, opening an attachment that installs malware, or replying with sensitive details.
• Exploiting weaknesses. Phishing succeeds when authentication is missing or misconfigured, letting spoofed mail slip past filters, and when users aren't trained to spot the signs.
• Cashing in. Once the victim engages, the attacker harvests data for identity theft, fraud, or a wider network breach — often using the compromised account to phish others.

For example, a message posing as PayPal might urge you to "verify your account" through a link to a lookalike site that quietly captures your password the moment you type it.

If the question is whether a person was lured by that message or instead redirected after using a familiar address, see pharming versus phishing. The distinction helps separate message-led social engineering from a technical redirection investigation.

Common types of phishing

Phishing is an umbrella term. The variants worth knowing:

• Bulk phishing — generic messages blasted to huge lists, betting on volume.
• Spear phishing — a targeted message crafted for one person or team, using details that make it convincing.
• Whaling — spear phishing aimed at executives, often to authorize a wire transfer or share payroll data.
• Clone phishing — a legitimate email the victim already received, copied and re-sent with the links or attachments swapped for malicious ones.
• Smishing and vishing — the same tactics delivered by SMS or voice call instead of email.

Why phishing is a problem

Phishing is the entry point for a large share of serious breaches, and the damage compounds:

• Data breaches. Stolen credentials or malware expose personal and corporate data, leading to financial loss or identity theft.
• Financial fraud. Harvested details are used to drain accounts, make unauthorized purchases, or trigger fraudulent invoices.
• Network compromise. A single malicious attachment can plant ransomware or a backdoor for a much larger intrusion.
• Reputation damage. When attackers spoof your domain, your customers receive the scam — eroding trust in your brand, especially without DMARC or BIMI to prove which mail is genuinely yours.

How to defend against phishing

Stopping phishing takes both technical controls and trained people — neither is enough alone.

Combating phishing requires technical and human defenses.

• Authenticate your email. Publish SPF, DKIM, and a DMARC policy at enforcement (p=quarantine or p=reject) so receivers reject mail that forges your domain. Add MTA-STS to force encrypted delivery between servers.
• Filter aggressively. Modern mail gateways score sender reputation, link destinations, and content anomalies to quarantine suspicious messages before they reach an inbox.
• Match the next step to the task. Use the spam versus phishing guide when you need to classify a message, then compare anti-phishing software when you need to choose the control layer, deployment model, and operating workload.
• Train users. Teach people to distrust unexpected urgency, hover over links before clicking, and verify any request for money or credentials through a second channel.
• Harden configuration. Correct MX records, PTR records, and TLS reduce the routing weaknesses attackers abuse.
• Monitor continuously. Read your DMARC reports to spot who is trying to send as your domain, and tighten policy as you confirm your legitimate sources.

If you are coordinating owners, controls, reporting, exercises, incident handoffs, and measurement, use the anti-phishing program operating model instead of treating software or annual training as the whole program.

If a message slips through and someone clicks, act fast — the follow-up steps are in what to do if you clicked a phishing link. You can also test a suspicious address with the phishing link checker before opening it, and confirm your own domain is locked down with the Email Security Score.

Related reading

• What to do if you clicked a phishing link
• What are DMARC, DKIM, and SPF?
• What is spear phishing?