Phishing is one of the most common ways attackers get into accounts, and it works by persuading a person rather than breaking software. This article explains how the main forms operate, which warning signs the Cybersecurity and Infrastructure Security Agency (CISA) highlights, and what to do after a suspicious message.
What phishing actually is
CISA describes social engineering as an attack that manipulates people to gain information or access, and phishing as one form of it. In a typical phishing attempt, an email or a fake website imitates a trustworthy organization, such as a bank or a charity, and tries to collect personal information. The technique relies on a simple fact. It is often easier to ask someone for a password than to guess or crack it. That is why the defenses below focus on habits and verification as much as on software.
CISA also notes that attackers often exploit current events, holidays or urgent problems. That timing is deliberate: a message about a shipping delay in the holiday season, a tax deadline or a news event feels plausible because the subject is already on people’s minds. The attacker does not need to know anything about the recipient, only to send enough messages that some will arrive at the right moment.
What is still uncertain is scale. The federal pages reviewed here describe methods and defenses but do not give a current count of attempts or losses, so this article does not offer one. The FTC says only that identity theft often tops the list of consumer fraud reports filed with it and other enforcement agencies.
The main variants: phishing, smishing and vishing
The labels describe the channel the attacker uses. CISA’s guidance lists these three:
| Name | Channel | What CISA says |
|---|---|---|
| Phishing | Email or malicious websites | Impersonates legitimate organizations, often exploiting current events, holidays or urgent problems |
| Smishing | SMS text messages | Texts may contain links, email addresses or phone numbers that open pages or trigger calls when tapped |
| Vishing | Voice, such as phone calls | Attackers can spoof caller ID through internet-based phone services |
Another term, spear phishing, usually refers to messages tailored to a specific person or organization. The sources reviewed for this article did not define it, so treat that description as general usage rather than an agency definition.
The common thread is borrowed trust. A text that appears to come from a delivery service, a call that seems to come from a bank’s number, or an email that mimics an employer all lean on familiarity.
Which warning signs does CISA point to?
CISA lists several signals that a message may not be what it claims:
- Urgent or emotionally charged language, especially threats of serious consequences if you do not respond right away.
- Requests for personal or financial information.
- Shortened links you cannot inspect.
- Sender addresses or links that look almost right, such as a lookalike domain with one swapped letter. CISA’s own example replaces a letter in a well-known retailer’s name.
- Links whose real destination does not match the text displayed.
- Generic greetings, missing contact details in a signature, or unexpected attachments, particularly ones that create urgency.
One older sign is now unreliable. CISA states that good grammar and spelling no longer rule out phishing, because artificial intelligence can produce polished messages. Readers who want background on why such tools write fluently without understanding or verifying anything can read what large language models can and cannot do. The practical lesson is that a clean, professional-looking message proves nothing about who sent it.
How do you check whether a message is real?
CISA’s core advice is not to use the contact path the message offers. According to CISA, if a message might be genuine, do not click its links or call its numbers. Go to the company’s website by searching for it or typing the address yourself, or contact the person through a method you already know.
The same logic applies to texts and calls. Because CISA notes that caller ID can be spoofed, hanging up and calling a number you already trust is safer than relying on what the screen shows.
This is the same logic behind checking unfamiliar claims before sharing them. The habits overlap with those described in how to check a viral claim before sharing: pause, identify the original source and confirm it independently.
What should you do with a suspicious message?
CISA’s recommended sequence is three words: recognize, resist, delete. Recognize the warning signs. Resist clicking links or attachments that seem too good to be true or that ask for personal information. Delete the message, without replying, clicking anything or using an “unsubscribe” link, since that last step can confirm that your address is active.
A short worked example shows how the checks fit together. Suppose a text says a package could not be delivered and asks you to tap a link within a few hours to reschedule. Applying the agencies’ guidance:
- The text creates urgency, which is a listed warning sign.
- It contains a link you cannot verify, another listed sign.
- If you are expecting a package, you would open the carrier’s app or type its website address yourself, rather than tapping.
- If you are not expecting one, there is even less reason to trust it.
- You would report and delete the text.
No step in that process requires you to decide whether the message looks convincing.
Where do you report phishing?
Several channels exist, and using them helps others as well as you. CISA lists these routes: the “report” option near a sender’s name or address in many email and messaging services, the “report spam” button in email programs, and its own Report a Cyber Issue page. CISA Central can be reached at 1-844-Say-CISA. The FTC takes fraud reports through ReportFraud.ftc.gov and identity theft reports through IdentityTheft.gov.
On its identity-theft page, the FTC says it has no criminal jurisdiction but serves as a clearinghouse for identity theft reports in its Consumer Sentinel database, which supports law enforcement investigations. In other words, a report does not mean the FTC will resolve your individual case. It does mean the information may be used by investigators.
What if you already clicked or shared information?
Acting quickly matters, though the steps are mostly familiar. CISA’s guidance for suspected victims includes:
- If the account is through work or school, notify the appropriate personnel, such as network administrators.
- Contact your financial institution immediately and close any compromised accounts.
- Change any exposed passwords, using a unique password for each account.
- Watch for signs of identity theft.
- Consider reporting the incident to the police and the FTC.
A fuller walk-through of credit freezes and fraud alerts appears in what to do after a data breach, which covers the same follow-up measures.
Which protections reduce the damage?
No habit eliminates the risk, but a few layers make a successful phishing attempt less costly. CISA recommends strong, unique passwords with a password manager, multifactor authentication, and prompt software updates. It also mentions security tools such as email filters and built-in anti-phishing features. Multifactor methods differ in strength. A code sent by text can itself be requested by a scammer who persuades you to read it aloud, while passkeys are designed so that there is nothing to hand over. The trade-offs are laid out in two-factor authentication and passkeys.
One caution about older advice: CISA’s longer guide suggests checking that a site uses HTTPS and shows a padlock before submitting information. That check can help, but the padlock indicates an encrypted connection, not that the site’s owner is trustworthy, so it should not replace verifying the address yourself.
Reading the signals, not the polish
Phishing succeeds by exploiting trust, urgency and routine, and the polish of a message is no longer evidence of legitimacy. The most reliable defense described by federal agencies is a change of path: when a message asks for action, leave it and reach the organization through a website or number you already know. Pair that with unique passwords, a second sign-in step and a habit of reporting what you receive, and most attempts end with a deleted message.
This article provides general information, not personalized security, legal or financial advice.
Sources: Cybersecurity and Infrastructure Security Agency; Federal Trade Commission
