Phishing is a type of online fraud in which criminals send messages that pretend to come from a trusted organisation or person, in order to trick the recipient into revealing passwords, card numbers or one-time codes, installing malware, or sending money. The messages arrive by email, text message, phone call, social media or messaging apps, and they usually point to a fake website that copies the look of a real bank, payment app, delivery company or government agency.
Phishing is the most common entry point for account takeover, identity theft and many forms of payment fraud. It is a kind of social engineering, because it attacks people rather than computer systems, and it usually relies on spoofing to make the message look genuine. The term, a play on "fishing", has been in use since the mid-1990s.
Phishing in plain terms
Phishing is like a fake letter that looks exactly like one from your bank, down to the logo and the signature. It tells you something urgent has happened, perhaps that your account is locked, and asks you to "confirm your details" by visiting a website. The website looks real, but it belongs to the criminal, and whatever you type goes straight to them.
The trick works because it pushes you to act before you think. A fisherman does not need every fish to bite. Criminals send millions of messages, and only a few people need to respond for the scheme to pay.
Forms of phishing
- Bulk email phishing. Mass messages copying banks, payment apps, streaming services or tax authorities, sent to huge lists in the hope that some recipients are customers.
- Spear phishing. Messages written for one person or organisation using details gathered from social media or earlier breaches. When aimed at senior executives it is often called whaling.
- Smishing. Phishing by text message, such as fake parcel delivery fees or toll charges, increasingly sent through messaging apps.
- Vishing. Voice phishing by phone, often a caller pretending to be the bank's fraud department who asks for a one-time password or urges the victim to move money to a "safe account".
- Quishing. QR codes on posters, parking meters or letters that lead to a fake payment page.
- Business email compromise. Messages from a hacked or lookalike supplier or executive address asking for an urgent transfer or a change of bank details. See business email compromise.
Some criminal kits now sit between the victim and the real website, passing everything through in real time. These "adversary-in-the-middle" pages can capture a password and a text-message code together, which is why simple two-step logins are no longer enough on their own.
Scale and impact
The FBI's Internet Crime Complaint Center recorded phishing and spoofing as the most reported category of internet crime in its 2024 report, with 193,407 complaints, out of total reported losses of about $16.6 billion across all crime types. In the UK and EU, regulators and banks link a large share of authorised push payment fraud to phishing calls and texts. Generative artificial intelligence has made phishing messages more fluent and personalised, and cloned voices are now used in some vishing attempts.
For businesses, a single successful phishing email can lead to a data breach, ransomware or a diverted supplier payment, which is why regulators treat phishing resilience as part of cybersecurity risk and operational risk.
Defences for organisations
Banks and payment firms defend on several layers:
- Email authentication. The SPF, DKIM and DMARC standards let receiving mail servers check that a message really comes from the domain it claims, which makes exact-domain spoofing much harder.
- Phishing-resistant login. Hardware security keys and passkeys built on the FIDO2 standards tie a login to the real website, so a fake site cannot reuse it. They are stronger than two-factor authentication by text message.
- Payment checks. Strong customer authentication with dynamic linking ties the approval to a specific amount and payee, and payee checks such as verification of payee warn when the name does not match the account.
- Monitoring. Behavioral analytics and device fingerprinting flag a login from an unknown device or a session that behaves like a criminal rather than the customer.
- Takedowns and training. Firms report fake domains for removal, register lookalike domains themselves and train staff with simulated phishing.
Advice for individuals
Government agencies such as the UK's National Cyber Security Centre give consistent advice: be suspicious of urgency, do not click links in unexpected messages, open the bank's app or type its address yourself instead, and never share a one-time code. A bank will not ask a customer to move money to a "safe account". Suspicious emails can be forwarded to national reporting services, such as [email protected] in the UK, and losses in the US can be reported to the FBI's Internet Crime Complaint Center. Anyone who has entered details on a fake site should contact their bank at once, change passwords and turn on stronger authentication.