What Is Phishing? The Plain-English Explainer (and How to Spot It Before You Click)

CodexFuse Team · 2026-10-27T03:18:37.450Z · 15 min read

Phishing is a scam message that pretends to be someone you trust. This plain-English guide explains what it is, the four forms it takes, and what to do if you already clicked.

Phishing is a scam message that pretends to be someone you trust — your bank, a delivery company, your boss, a streaming service — so that you hand over a password, a payment detail, or a click that installs malware. The message itself is only the bait. The damage happens when you follow it: on the fake login page it links to, in the attachment it asks you to open, or in the reply you send with the information it asked for. If a strange email just landed in your inbox and you want to know what phishing is, this guide explains it in plain English: what it is, the four forms it takes, how to spot one, and exactly what to do if you already clicked.

Phishing is not rare or exotic. It is the most common form of cybercrime in the world, and an estimated 3.4 billion phishing emails are sent every single day, according to the cybersecurity glossary published by Teldat. The same glossary puts phishing behind 16 percent of all data breaches. The good news is that phishing follows patterns, and once you know them, most attempts are easy to see through. For the step-by-step detection scan, our guide on how to spot a phishing email walks through six checks that still work in 2026.

What is phishing?

Phishing is a form of social engineering, which means it attacks people rather than computers. Instead of breaking into a system, the attacker sends a message that looks like it comes from a company or person you already trust, and asks you to do something small and normal-looking: confirm your account, view an invoice, collect a refund, reset a password. The message leads to a counterfeit login page that captures whatever you type, or to an attachment that installs malware, or simply to a reply that hands over the details directly. Microsoft describes a phishing email as a fraudulent message designed to trick you into sharing personal information, such as passwords or financial details, often using urgent language, fake links, or malicious attachments.

The word itself is a clue to how it works. Phishing is a variation of fishing: the attacker casts a lure — a believable message — and waits for someone to bite. The term was first recorded in 1995, in the cracking toolkit AOHell, according to Wikipedia, and it may have been used even earlier in the hacker magazine 2600. What has changed since then is scale. Phishing attacks among businesses rose from 72 percent in 2017 to 86 percent in 2020 and reached 94 percent in 2023, according to figures cited by Wikipedia. Generative AI has made the problem worse, because it lets attackers write clean, convincing, personalized messages at very low cost — which is why a well-written email now proves nothing at all.

The reason phishing keeps working is that it targets the one part of security that cannot be patched: human judgment. Firewalls, encryption, and even multi-factor authentication can all be bypassed by a single convincing message, because the victim opens the door themselves. More than 60 percent of all breaches involve human actions, according to the Verizon Data Breach Investigations Report for 2025, cited by Teldat — and phishing is the entry point for most ransomware, business email compromise, and credential theft campaigns. That is also why the average phishing breach costs an organization 4.88 million dollars, according to Teldat: one stolen password can unlock an entire network.

How does phishing actually work?

Almost every phishing attack follows the same four steps, whatever channel it arrives on. Knowing the steps makes the attack visible while it is still harmless.

1. The lure. You receive a message that looks like it comes from a trusted source: a bank warning about suspicious activity, a delivery notice for a package, an invoice you do not recognize, a message about a refund or a prize. The story is designed to make you act fast, before you think.
2. The hook. The message contains a link, an attachment, or a reply request. The link leads to a page that looks exactly like the real login page of your bank or email provider. The attachment carries malware. The reply asks for the detail directly.
3. The harvest. If you enter your username and password on the fake page, the attacker captures them in real time. Some attacks relay your login to the real site, so the page even seems to work — while the attacker keeps your session.
4. The payoff. The stolen credentials are used to take over your account, reset passwords on other accounts that use the same email address, steal money, or send phishing from your account to your contacts. Credentials that are not used immediately are sold on to other criminals, and often end up on the dark web, where stolen credentials end up for sale.

Notice what is missing from those four steps: there is no hacking of your computer in the usual sense. The attacker never has to break your password. You hand it over, believing you are logging in to a service you already use. That is why the Federal Trade Commission says scammers are after your passwords, account numbers, and Social Security number — those three things open your email, your bank, and your other accounts, and they can be sold on to other criminals if they are not used right away.

What are the four forms of phishing?

Phishing is not only email. The same trick now arrives on every channel you read messages on. The four forms below cover nearly everything you will see, and the defense is the same for all of them: do not use anything inside the message — go to the company yourself.

Two of these deserve a little more attention. Smishing works because a text message feels personal and urgent, and because a phone screen hides the full web address of the link you are about to tap. Quishing — phishing through QR codes — is growing for the same reason: the UK National Cyber Security Centre warns that criminals increasingly put QR codes in phishing emails to get you onto a scam site from your phone, where the address is harder to check. If a message asks you to scan a code to fix an account problem, treat it exactly like a suspicious link.

What are the main types of phishing attacks?

Within those four forms, attackers run a few distinct plays. They differ in how much the attacker knows about you — and the more they know, the harder the message is to spot.

• Mass phishing. The same fake bank, delivery, or account notice is sent to millions of addresses at once. Most people ignore it; a small share click, and that is enough.
• Spear phishing. The message is aimed at one person or one organization, using details gathered about them first — your job title, your manager's name, a project you work on — so it feels genuine. Spear phishing is the version that gets past careful people.
• Whaling. Spear phishing aimed at executives and other people who can approve payments or release data. The prize is bigger, so the attacker spends more time on the lure.
• Impersonation. A message that looks like it is from a colleague, a friend, or a family member, often asking for money, gift cards, or a quick favor. The trust you have in the person does the attacker's work for them.
• Business email compromise. A targeted message that pretends to be a senior manager or a supplier, usually asking finance staff to pay an invoice or change bank details. It rarely contains a link at all, which makes it hard for filters to catch.

The common thread is impersonation: every type works by borrowing someone else's credibility. That is also the weakness. If you check the message through a channel the attacker does not control — the company's real website, a phone number from your card or a statement, a colleague in person — the impersonation falls apart.

How can you spot a phishing message?

You do not need to memorize a long checklist to catch most phishing. Microsoft lists five spot-checks that cover nearly every attempt, and they take seconds to run.

• Suspicious sender. The email address may be slightly misspelled or unfamiliar, even when the display name looks right. The display name can say anything; the address after it is the truth.
• Urgent or threatening language. Scammers create panic to pressure you into acting quickly — an account will be closed, a payment will fail, a fine is coming.
• Generic greetings. Phrases like "Dear Customer" instead of your name, from a company that knows your name, are a red flag.
• Suspicious links or attachments. Hover over a link to check where it really goes before you click. On a phone, press and hold. Unexpected attachments may contain malware.
• Requests for personal or financial details. Real companies you do business with will not ask for passwords, account numbers, or payment details by email.

One old rule no longer works: bad spelling. Both the US Cybersecurity and Infrastructure Security Agency and the UK National Cyber Security Centre point out that AI tools now let scammers write clean, convincing text, so a well-written email proves nothing. And pressure is the tell that survives every improvement in the attacker's writing. The National Cyber Security Centre groups the pressure tactics into five kinds: authority (claims to be from your bank, a government office, or your manager), urgency (act within 24 hours or lose access), emotion (wording meant to make you panic or feel hopeful), scarcity (an offer in short supply), and current events (tied to tax season, a big event, or the news). If a message leans on any of these, slow down. For the full detection system, including the SPEAR test for targeted messages, see our guide on the six checks that still work in 2026.

What should you do if you already clicked a phishing link?

Clicking is not the end of the story. The damage depends on what you did after the click, and every step below limits it. Work through them in order, right now.

1. Change the password immediately — on the real site. Go to the company's real website yourself, never through the link in the message, and change the password. If you use the same password anywhere else, change it there too.
2. Turn on two-factor authentication. If you have not already, switch it on for the affected account and for your email account. It stops the stolen password from being enough on its own.
3. If you opened an attachment, run a full security scan. Update your security software first, then run a full scan. Do not open any other attachments from the same sender.
4. If you gave out card, bank, or Social Security details, call your bank. The FTC points US readers to IdentityTheft.gov for a personal recovery plan. Call your bank as well, and watch for charges you do not recognize.
5. Check whether your address was already exposed. Run your email through an email breach checker to see whether your address appears in a known data breach, and change any password that appears in one.
6. Report the message, then delete it. In Gmail, open the message and choose Report phishing from the More menu. In Outlook, select the message, then Report, then Report phishing. If it pretends to be Apple, forward it to [email protected]. In the United States, you can also forward phishing emails to [email protected], or report the attempt to the FTC at ReportFraud.ftc.gov.
7. If it was your work email, tell your IT team. A clicked link on a work account can be the start of an attack on the whole organization. Reporting it is not embarrassing; it is the job.

If the account in question is your email account itself, treat it as the most urgent case of all. A scammer with your email password can read your mail, reset passwords for other accounts that use that address, and send phishing from your account to your contacts. Change the password, turn on two-factor authentication, sign out other sessions, and check your forwarding rules — and if the account is Gmail, our guide on how to recover a hacked Gmail account walks through the recovery steps.

How do you report phishing?

Reporting does two things at once: it trains your provider's filter so the next copy is caught, and it warns the provider and the authorities that the scam is running. The steps depend on where the message arrived.

After reporting, delete the message so you cannot click it by accident later. Do not reply to it, and do not click any link inside it — including the unsubscribe link, which in a phishing message is just another way to confirm your address is active.

Is phishing illegal — and why does it keep working?

Yes. Phishing is fraud: obtaining money or information by deception, and in many cases identity theft, wire fraud, or unauthorized computer access on top of it. The people behind it are rarely caught, because the messages are sent at enormous scale from infrastructure that is rented, spoofed, and moved constantly. Cloudflare notes that attackers use domain spoofing, fake websites, and generative AI to run phishing over email, SMS, phone calls, and social media — and that the messages now come from trusted infrastructure that can pass spam checks and reach the inbox.

It keeps working for a simple reason: it is cheaper than hacking. Breaking into a system takes skill, time, and luck. Sending a million convincing messages costs almost nothing, and only a tiny fraction of recipients need to click. The defense is equally simple, and it is the same one every source in this guide repeats: never trust a message about your account. If a message says there is a problem, go to the company's website yourself or call a number from your card, a statement, or the official site, and ask. The thirty seconds that takes is the whole defense.

Sources

• Microsoft Security, "What Is a Phishing Email?" — microsoft.com/en-us/security/business/security-101/what-is-phishing-email
• Canary Mail Blog, "Phishing Emails: How to Spot and Report Them (2026)" — canarymail.io/blog/phishing-emails
• Wikipedia, "Phishing" — en.wikipedia.org/wiki/Phishing
• Cloudflare, "What Is a Phishing Attack?" — cloudflare.com/learning/access-management/phishing-attack
• Teldat, "What Is Phishing?" (cybersecurity glossary) — teldat.com/glossary/what-is-phishing-types-threats-protection
• Hong Kong InfoSec, "Phishing" — infosec.gov.hk/en/knowledge-centre/phishing

Frequently Asked Questions

What is phishing in simple terms?

Phishing is a scam message that pretends to be someone you trust — your bank, a delivery company, or your boss — so that you hand over a password, a payment detail, or a click that installs malware. The name comes from "fishing": the attacker casts a believable lure and waits for someone to bite. The message is only the bait; the damage happens on the fake login page it links to, in the attachment it asks you to open, or in the reply you send.

What is the difference between phishing and spam?

Spam is any unwanted bulk email: newsletters you never asked for, ads, and dubious offers. Most of it is just annoying. Phishing is a kind of spam with a specific goal — getting something from you that a criminal can use, like a password or a payment detail. The FTC puts it this way: at best spam is annoying, at worst it is pushing scams or malware. All phishing is spam, but most spam is not phishing.

Can you get phished just by opening an email?

Usually not. The harm comes from clicking a link, opening an attachment, or replying with information. Opening a message can still tell the sender your address is active if it loads remote images, which is one reason to block trackers or turn off remote content. If you only opened the message and did nothing else, report it and delete it — you are almost certainly fine.

What should I do if I clicked a phishing link?

Change the password right away on the real site — never through the link in the message — and change it anywhere else you use the same one. Turn on two-factor authentication if you have not already. If you opened an attachment, update your security software and run a full scan. If you gave out card, bank, or Social Security details, call your bank, and US readers can get a personal recovery plan at IdentityTheft.gov. Then report the message in your email app and delete it.

How do I report a phishing email?

In Gmail, open the message and choose Report phishing from the More menu. In Outlook, select the message, then Report, then Report phishing. If it pretends to be Apple, forward it to [email protected]. In the United States, you can also forward phishing emails to [email protected], or report the attempt to the FTC at ReportFraud.ftc.gov. In the UK, forward suspicious emails to [email protected].