What is phishing and how do you spot a phishing email?
Phishing is the most common way attackers steal credentials and money. Here is what the attack looks like and how to catch it before you click.
Phishing is a cyberattack where a criminal sends a fake message, almost always an email, to trick you into handing over a password, payment details, or access to your systems. CISA classifies it as the leading initial-access technique used before ransomware and data breaches. Spotting one before you click is the single most effective defence available to a non-technical person.
What exactly happens in a phishing attack?
The attacker impersonates a trusted sender, such as your bank, a courier, or your IT department, and includes a link or attachment designed to steal something. The payload can be a fake login page that captures your password, or a malicious file that installs software on your machine.
The mechanics are straightforward. You receive the email, trust the sender name, click the link, and either type credentials into a page the attacker controls or trigger a file that runs code on your device. The FBI's Internet Crime Complaint Center consistently ranks phishing as the top reported cybercrime by victim count.
How do you spot a phishing email?
Check four things in order: the sender's actual email address (not just the display name), the destination URL before you click it, the tone of urgency, and whether the request was expected at all. None of these checks requires technical skill.
Display names are trivially faked. An email can show "PayPal Support" in your inbox while the real sending address is something like noreply@paypa1-billing.com. Hover over any link before clicking: the URL that appears in the bottom of your browser is the real destination. If the domain looks misspelled, contains extra words, or uses a country-code suffix that doesn't fit the brand, treat it as hostile.
| Warning sign | What to look for | Why it matters |
|---|---|---|
| Mismatched sender domain | Display name says "Microsoft" but address ends in @micros0ft-help.net |
Attackers spoof display names freely |
| Urgent or threatening tone | "Your account will be closed in 24 hours" | Pressure reduces the time you spend thinking |
| Suspicious link destination | Hover reveals a domain that doesn't match the brand | The real URL is always in the link, not the text |
| Unexpected attachment | A file you didn't request, especially .exe, .zip, or Office files |
Attachments are the most common malware delivery method |
| Generic greeting | "Dear Customer" instead of your name | Bulk phishing campaigns rarely personalise |
What is spear phishing and is it harder to detect?
Spear phishing is a targeted version of the attack where the criminal researches you specifically, using your name, job title, recent activity, or a colleague's name to make the message credible. It is significantly harder to catch on instinct alone.
NIST's glossary defines spear phishing as phishing that targets a specific individual or group. A spear phishing email might reference a real project you're working on, appear to come from your actual manager's email address (sometimes through a compromised account), and ask for something plausible like an invoice approval. The generic-greeting check fails here. Verify any unexpected financial or access request through a separate channel, such as a phone call, before acting.
Does multi-factor authentication stop phishing?
Partially, but not completely. Multi-factor authentication (MFA), meaning a second proof of identity beyond your password such as a code sent to your phone, stops credential-stuffing attacks cold. Against sophisticated phishing it can still be bypassed.
A class of attacks called adversary-in-the-middle (AiTM) phishing uses a relay server that sits between you and the real website, capturing both your password and your live MFA session token in real time. Microsoft documented this technique extensively in its threat intelligence coverage of AiTM phishing campaigns. Hardware security keys that implement the FIDO2 standard are the only MFA type that is technically resistant to AiTM, because the key cryptographically binds authentication to the legitimate domain.
What should you do if you clicked a phishing link?
Act immediately and in this order: disconnect the device from the network if you entered credentials, change the compromised password from a different device, notify your IT or security team, and report the email to your organisation's abuse address or directly to CISA's phishing reporting portal.
If you only clicked but did not enter anything, the risk is lower, but malicious pages can still attempt drive-by downloads, meaning code that tries to install itself without you choosing to download a file. Running an up-to-date endpoint security tool and keeping your browser patched reduces that risk substantially. CISA recommends reporting phishing attempts to phishing@us-cert.gov as well as to the impersonated organisation.
Common questions
Can a phishing email infect your computer just by opening it?
In rare cases involving unpatched email clients, yes, but usually no. Most phishing attacks require you to click a link or open an attachment. Keeping your email client and operating system fully patched closes the gap.
What is the difference between phishing and smishing?
Phishing uses email. Smishing is the same social-engineering trick delivered by SMS text message. The detection principles are identical: check the sender, verify links before tapping, and treat unexpected urgency as a red flag.
How do attackers get my email address to target me?
Most addresses come from data breaches, which are incidents where a company's user database is stolen and later sold or published online. You can check whether your address appears in known breach data at Have I Been Pwned, which is maintained by security researcher Troy Hunt.
