# What is Phishing? Attack Types and Prevention Guide

> What phishing is, how the attack works step by step, the main types, and how SPF, DKIM, and DMARC plus user training stop it.

Phishing is a cyberattack in which someone sends a fraudulent message — usually email — that appears to come from a trusted source to trick the recipient into revealing sensitive information or running malicious code. The goal is almost always one of three things: steal login credentials, capture financial details, or get malware onto a device. Because so much phishing arrives by email and relies on forged sender identities, it is blunted directly by email authentication: [SPF](/learning/what-is-spf), [DKIM](/learning/what-is-dkim), and [DMARC](/learning/what-is-dmarc).

## How does phishing work?

[Phishing attacks](/resources-post/the-ultimate-guide-to-preventing-phishing-attacks-expert-tips-and-strategies) rely on deception and [social engineering](/resources-post/10-ways-to-protect-yourself-from-social-engineering-attacks) to push a victim into acting before they think. A typical campaign moves through five stages:

![Five-step flow of a phishing attack, from crafting a deceptive email to stealing data.](/images/figures/what-is-phishing-fig1.webp)
*The typical flow of a phishing attack.*

- **Crafting the message.** Attackers mimic a real organization using a [spoofed](/learning/what-is-spoofing) `From:` address, familiar logos, and urgent language ("Your account is locked"). Domains that have not published a DMARC policy are the easiest to impersonate.
- **Targeting victims.** Messages go to harvested or purchased lists — either in bulk, or tailored to a specific person, which is known as [spear phishing](/learning/what-is-spear-phishing).
- **Delivering the payload.** The message pushes one action: clicking a link to a fake login page, opening an attachment that installs malware, or replying with sensitive details.
- **Exploiting weaknesses.** Phishing succeeds when authentication is missing or misconfigured, letting spoofed mail slip past filters, and when users aren't trained to spot the signs.
- **Cashing in.** Once the victim engages, the attacker harvests data for identity theft, fraud, or a wider network breach — often using the compromised account to phish others.

For example, a message posing as PayPal might urge you to "verify your account" through a link to a lookalike site that quietly captures your password the moment you type it.

## Common types of phishing

Phishing is an umbrella term. The variants worth knowing:

- **Bulk phishing** — generic messages blasted to huge lists, betting on volume.
- **Spear phishing** — a targeted message crafted for one person or team, using details that make it convincing.
- **Whaling** — spear phishing aimed at executives, often to authorize a wire transfer or share payroll data.
- **Clone phishing** — a legitimate email the victim already received, copied and re-sent with the links or attachments swapped for malicious ones.
- **Smishing and vishing** — the same tactics delivered by SMS or voice call instead of email.

## Why phishing is a problem

Phishing is the entry point for a large share of serious breaches, and the damage compounds:

- **Data breaches.** Stolen credentials or malware expose personal and corporate data, leading to financial loss or identity theft.
- **Financial fraud.** Harvested details are used to drain accounts, make unauthorized purchases, or trigger fraudulent invoices.
- **Network compromise.** A single malicious attachment can plant ransomware or a backdoor for a much larger intrusion.
- **Reputation damage.** When attackers spoof your domain, *your* customers receive the scam — eroding trust in your brand, especially without DMARC or [BIMI](/learning/what-is-bimi) to prove which mail is genuinely yours.

## How to defend against phishing

Stopping phishing takes both technical controls and trained people — neither is enough alone.

![Checklist of five phishing defenses: authentication protocols, filters, training, secure configuration, and monitoring.](/images/figures/what-is-phishing-fig2.webp)
*Combating phishing requires technical and human defenses.*

- **Authenticate your email.** Publish SPF, DKIM, and a DMARC policy at enforcement (`p=quarantine` or `p=reject`) so receivers reject mail that forges your domain. Add [MTA-STS](/learning/what-is-mta-sts) to force encrypted delivery between servers.
- **Filter aggressively.** Modern mail gateways score sender reputation, link destinations, and content anomalies to quarantine suspicious messages before they reach an inbox.
- **Train users.** Teach people to distrust unexpected urgency, hover over links before clicking, and verify any request for money or credentials through a second channel.
- **Harden configuration.** Correct [MX records](/learning/what-is-an-mx-record), [PTR records](/learning/what-is-a-ptr-record), and TLS reduce the routing weaknesses attackers abuse.
- **Monitor continuously.** Read your [DMARC reports](/resources-post/how-to-understand-dmarc-reports) to spot who is trying to send as your domain, and tighten policy as you confirm your legitimate sources.

If a message slips through and someone clicks, act fast — the follow-up steps are in [what to do if you clicked a phishing link](/resources-post/what-to-do-if-you-clicked-on-a-phishing-link). You can also test a suspicious address with the [phishing link checker](/tools/phishing-link-checker) before opening it, and confirm your own domain is locked down with the [Email Security Score](/tools/email-security-score).

## Frequently asked questions

### What's the difference between phishing and spear phishing?

Bulk phishing is sent to as many people as possible with a generic lure. Spear phishing targets a specific individual and uses real details — your name, role, a recent project — to make the request believable. Spear phishing has far higher success rates, which is why executives and finance staff are the most common targets.

### Can SPF, DKIM, and DMARC stop all phishing?

No — but they close the most damaging gap. Together they stop attackers from sending mail that appears to come from *your* domain, which protects your customers and brand. They can't stop an attacker who registers a lookalike domain or phishes from a compromised third party, so you still need filtering and user training as the other layers.

### Is it dangerous just to open a phishing email?

Opening the email itself is usually safe on a modern, updated mail client. The risk comes from *acting* on it — clicking a link, entering a password, opening an attachment, or approving a login prompt. If you only opened and closed it, delete and report it; no further action is needed.

### How can I tell if an email is a phishing attempt?

Watch for mismatched or lookalike sender domains, unexpected urgency or threats, links whose real destination differs from the visible text, requests for credentials or payment, and small grammar or formatting errors. When in doubt, contact the supposed sender through a channel you already trust rather than replying.

### Does my domain need DMARC even if we're a small business?

Yes. Attackers don't skip small domains — an unprotected small business is easier to impersonate than a hardened enterprise. Publishing DMARC at enforcement is free, and it stops criminals from spoofing your domain to phish your own customers and partners.

## Related reading

- [What to do if you clicked a phishing link](/resources-post/what-to-do-if-you-clicked-on-a-phishing-link)
- [What are DMARC, DKIM, and SPF?](/resources-post/what-are-dmarc-dkim-and-spf)
- [What is spear phishing?](/learning/what-is-spear-phishing)