Skip to content
Knowledge Hub/Article
Article

What Is Phishing? Types, Warning Signs and Defenses

Phishing arrives by email, text message, phone call and QR code. We cover its types, the warning signs, layered defenses and what to do after a click.

Oğuzhan Gerçek··9 min read
What Is Phishing? Types, Warning Signs and Defenses

Short answer: Phishing is a social engineering attack in which the attacker poses as a trusted organization or person and uses email, text messages, phone calls or QR codes to steal sensitive information such as passwords, get malware installed, or trigger a money transfer. When it targets a specific person or organization it is called spear phishing; when it goes after senior executives, whaling. Business email compromise (BEC), which relies on fake payment instructions, belongs to the same family. No single control stops phishing: email authentication and filtering, phishing-resistant MFA, endpoint protection and employees who report suspicious messages work together. If someone has clicked a link, report it at once, change the password and end active sessions.

What is phishing?

One of the definitions in the NIST glossary describes phishing as a technique for trying to acquire sensitive data, such as bank account numbers, through a fraudulent solicitation in an email or on a website, in which the perpetrator masquerades as a legitimate business or a reputable person. The joint phishing guidance from CISA, the NSA and the FBI names two goals: stealing login credentials for initial network access, and deploying malware to disrupt systems, escalate privileges or maintain persistence.

According to MITRE ATT&CK, all forms of phishing are electronically delivered social engineering; the technique sits under the Initial Access tactic as T1566. We cover the techniques beyond phishing in our social engineering article and the wider threat picture in our cybersecurity article; a short definition of cybersecurity is in our glossary.

How common is phishing?

In Verizon's 2026 Data Breach Investigations Report (DBIR), which examines more than 22,000 confirmed data breaches, 16% of breaches began with phishing, the same share as the year before. According to the full report, phishing also makes up 44% of AI-assisted initial access vectors. In the 2025 report of the FBI's Internet Crime Complaint Center (IC3), phishing/spoofing was the most reported crime type, with 191,561 complaints.

APWG, which tracks phishing sites, counted 1,069,681 attacks in the second quarter of 2026, up 10.1% on the first quarter. In this count, each unique phishing site is one attack.

Types of phishing

  • Mass phishing: The same fake message goes out to many people. As the UK's National Cyber Security Centre (NCSC) describes it, the links lead to sites that host malware or try to get passwords or money out of the user.
  • Spear phishing: The attacker uses information about the employees and the company to make the message more convincing.
  • Whaling: In NIST's definition, phishing that targets high-ranking members of organizations.
  • Business email compromise (BEC): According to the IC3, it targets businesses that regularly make wire transfers and people who work with suppliers; email accounts, phone numbers or virtual meeting applications are compromised to push through unauthorized transfers of funds. In 2025 the IC3 received 24,768 BEC complaints, with adjusted losses of about $3.05 billion.
  • Smishing and vishing: In the FBI's definitions, smishing uses SMS or MMS text messages and vishing uses voice, which may include AI-generated voices. According to the 2026 DBIR, the median click rate in phishing simulations is 40% higher in mobile-centric vectors such as voice and text messaging than in email.
  • QR code phishing (quishing): According to an FBI alert from January 2026, the malicious link is hidden inside a QR code. A victim who scans it with a phone moves outside the email controls that protect the corporate computer, and the QR image slips past URL inspection and sandboxing.

AiTM: phishing that gets around MFA

In AiTM (adversary-in-the-middle) phishing, the attacker places a proxy server between the user and the real sign-in page. The campaign Microsoft described attempted to target more than 10,000 organizations from September 2021 onward. The proxy captures both the password and the session cookie; once the attacker loads the cookie into their own browser, they skip authentication even when MFA is enabled. Microsoft stresses that this is not a vulnerability in MFA: the attacker takes over a session already authenticated on the user's behalf, whatever sign-in method the user chose. The compromised mailboxes were then used for BEC attacks on other targets.

The fix is to make authentication itself phishing-resistant. According to CISA, the only widely available phishing-resistant authentication is FIDO/WebAuthn; app-based one-time codes are vulnerable to phishing, and SMS is also exposed to SIM swap attacks. We cover the methods in our MFA article and the identity infrastructure in our identity management service.

How to spot a phishing email

The common signs on CISA's list are:

  • Urgent or emotionally appealing language, especially messages that claim dire consequences for not responding immediately
  • Requests to send personal and financial information
  • Untrusted shortened URLs
  • Incorrect email addresses or links (CISA's example: amazan.com)

Hunting for spelling mistakes is no longer enough: according to the FBI, generative AI can correct the human errors that might otherwise give a fraud away. The IC3 recommends checking the sender's address carefully, especially on a mobile device. When in doubt, follow the NCSC's advice: don't use the number or address in the message; contact the organization through the details on its official website.

How to protect against phishing

According to the NCSC, mitigations often lean too heavily on users spotting phishing emails, yet spotting them all is hard and spear phishing is harder still. The four layers the NCSC recommends are:

  1. Keep messages away from users: SPF, DKIM and DMARC make your domain harder to spoof; we explain how to set them up in our business email article. Email should be filtered before it reaches users. In Microsoft Defender for Office 365, Safe Links also checks links at the time of click, and Safe Attachments opens attachments in a virtual environment before delivery; in Gmail, Security Sandbox does the same job.
  2. Make reporting easy: The process should be clear, simple and quick, and people who report should hear back promptly about what was done.
  3. Limit the impact of messages that get through: With MFA, a stolen password alone is not enough. Well-configured devices and endpoint protection can stop malware from installing even after a click. CISA recommends blocking macros by default and restricting users' administrative rights, and a proxy can block access to known phishing sites.
  4. Respond quickly: Some messages will always get through. Incident response plans should be practiced before an incident occurs; we explain who watches the alerts in our SIEM and SOC article.

Security awareness training and phishing simulations

NIST SP 800-50 Rev. 1, published in September 2024, brings smishing and vishing exercises in alongside phishing. According to the guide, organizations start by measuring the current click rates of user groups or work roles, then track click-through and reporting. If real brands are used in the bait, the legal team should be involved, and employees should be told that exercises are run at random. In NIST's words, these activities should not be punitive, and no employee should be called out for their response.

The NCSC adds that no training, simulations included, can teach users to spot every phishing attempt. In a no-blame culture, employees who report freely become an early warning system.

What to do if someone clicks

According to the NCSC, users should feel able to come forward even after they have clicked, and should know in advance how to report, because a compromised device may cut them off from their normal means of communication. The next steps are:

  1. Disable the account or change the password: Microsoft's guidance recommends disabling the account until the investigation is complete; if that isn't possible, reset the password. Don't send the new password by email, because the attacker may still have access to the mailbox.
  2. End active sessions: Revoking sessions immediately invalidates access gained with the stolen credentials. In an AiTM attack the attacker holds the session cookie, so this step matters as much as the password change.
  3. Remove what the attacker left behind: Review MFA methods added to the account, applications granted consent and mail forwarding.
  4. Isolate the device: According to CISA, isolating the affected workstation helps stop malware from spreading through the network.
  5. If money was sent, call the bank: The IC3 advises contacting your financial institution immediately and requesting a recall of the funds.

If the incident affects personal data, we cover notification readiness in our 72-hour article. We handle detection and response in our security operations service and the email platform in our collaboration and messaging service.

Frequently asked questions

What does phishing mean? Phishing is an attack in which someone pretends to be a trusted organization or person and uses a fake message to ask for a password, card details or a money transfer.

How can you tell if an email is phishing? The main signs are urgent language, requests for personal or financial information, shortened links and domain names with swapped letters. If in doubt, call the organization on a number you have looked up yourself.

I clicked a phishing link. What should I do? Report it to your IT or security team right away and change your password. Active sessions should be ended, and if you downloaded a file, the device should be disconnected from the network.

Does MFA prevent phishing? Not every kind of MFA does. One-time codes and session cookies can be stolen through a fake page, whereas FIDO/WebAuthn-based methods are phishing-resistant.

Sources