What Is Phishing? How to Spot and Avoid the Most Common Cyberattack

What phishing is

Phishing is a type of social-engineering attack where a criminal impersonates a trustworthy person or organization, your bank, an employer, a delivery company, a popular service, to trick you into doing something harmful: revealing a password, entering card details, clicking a malicious link, or approving a payment. The name is a play on 'fishing': the attacker casts out bait (a convincing message) and waits for someone to bite. It is behind a huge share of all data breaches, because it targets people, not software.

How a phishing attack works

The classic version: you get an email that looks like it is from a service you use, saying something urgent, 'your account will be suspended,' 'suspicious login detected,' 'your package could not be delivered.' It urges you to click a link, which leads to a fake login page that looks identical to the real one. You type your password, and it goes straight to the attacker. Because the page and email look authentic, and the message creates panic, even careful people can be caught in a rushed moment.

The red flags

Most phishing shares telltale signs: a sense of urgency or fear ('act now or lose access'), a request to click a link and log in or 'verify' details, a sender address that is slightly off ([email protected]), generic greetings ('Dear customer'), unexpected attachments, spelling or grammar oddities, and links whose real destination (hover to check) does not match the supposed sender. Any message pressuring you to act fast and enter credentials or payment info deserves suspicion by default.

The variants to know

Phishing has cousins. Spear phishing targets a specific person with personalized detail (your name, employer, a real project), far more convincing. Whaling targets executives. Smishing is phishing by SMS text (fake delivery or bank texts). Vishing is voice phishing, a phone call impersonating your bank or 'tech support.' Increasingly, AI is used to write flawless, personalized messages and even clone voices, so the old advice of 'look for bad grammar' is no longer enough on its own.

How to protect yourself

A few habits defeat most phishing. Never click a login link in an unexpected message, instead, go to the site directly by typing the address or using a bookmark. Verify surprising requests through a separate channel (call the company using a number from their official site, not the message). Use a password manager, since it will not auto-fill your password on a fake look-alike domain, a built-in warning. Enable two-factor authentication (ideally passkeys or a security key, which are phishing-resistant) so a stolen password alone is not enough. And slow down: urgency is the attacker's main weapon.

What to do if you slipped

If you think you entered your password on a phishing site, act fast: change that password immediately (and anywhere you reused it), enable or check two-factor authentication, and watch the account for unauthorized activity. If it was financial, contact your bank. Report the phishing message (most email apps and companies have a report option) to help protect others. Everyone gets fooled eventually, what matters is reacting quickly to limit the damage.

Related on Skillo

See also: What is a password manager and why you need one, What are passkeys and how do they work?.

Sources

• Phishing - Wikipedia

Published date reflects the original event date (2026-01-21). This article is original Skillo editorial written from the sources above; facts were verified in September 2026.