An email lands in your inbox. It looks like it is from your bank, and it says there is a problem with your account — click here to fix it immediately. Your heart skips. You almost click. That moment of urgency, that flash of worry, is exactly what the sender was counting on. This is phishing, and it is the most common cyberattack in the world.

Phishing works not by breaking through technology but by tricking people. That is what makes it so dangerous and so widespread — and also why, once you know the signs, it becomes surprisingly easy to spot. This guide explains what phishing is, the warning signs to look for, the common types you will encounter, and exactly what to do when a suspicious message arrives. It is one of the practical skills at the heart of everyday cybersecurity.

What is phishing, really?

Phishing is an attempt to trick you into revealing sensitive information — passwords, card numbers, personal details — or into installing harmful software, by pretending to be someone you trust. The name is a play on “fishing”: the attacker dangles bait and waits for someone to bite.

The crucial thing to understand is that phishing targets you, not your device. Instead of hacking a system, the attacker manipulates a person into handing over the keys willingly. They impersonate a bank, a delivery company, a colleague, a government agency, or a familiar website, and they craft a message designed to make you act before you think. This approach is called social engineering — hacking the human rather than the machine — and it is a favourite tool of the same criminals described in our guide on how hackers steal information.

Because it relies on human psychology rather than technical flaws, phishing works on everyone — new users and experts alike. The defence is not a better device; it is a trained eye.

Why phishing works: the psychology

Phishing messages are engineered to bypass your careful, rational thinking and trigger an instant reaction. They lean on a handful of emotional levers, and recognizing them is half the battle.

Urgency is the most common. “Your account will be suspended in 24 hours.” “Immediate action required.” Panic makes people click before they check. Fear works the same way — a warning about suspicious activity or a security breach pushes you to react. Greed and curiosity pull in the other direction: you have won a prize, there is a refund waiting, someone shared a document with you. And authority lends false weight — a message that appears to come from your boss, the tax office, or a well-known company feels risky to ignore.

Whenever a message makes you feel a sudden strong emotion and pushes you to act right now, that is precisely the moment to slow down. The feeling of pressure is itself the warning sign.

How to spot a scam email easily

You do not need technical skills to catch most phishing. You need a short checklist and the habit of pausing. Here are the signs that give scams away.

Check the sender’s real address, not just the name. The display name can say anything. Look at the actual email address behind it. Scammers use addresses that are close but wrong — a public email service instead of a company domain, or a lookalike with extra characters or subtle misspellings. A real bank does not email you from a random address.

Be suspicious of generic greetings. “Dear Customer” or “Dear User” instead of your name often signals a mass scam. Legitimate companies you have accounts with usually know your name.

Hover over links before clicking. On a computer, resting your cursor over a link shows the real destination. If the visible text says one thing but the address points somewhere unrelated or strange, do not click. On a phone, press and hold to preview.

Watch for urgency and threats. Any message demanding you act immediately or face consequences deserves extra scrutiny. Real organizations rarely threaten you into instant action by email.

Look for odd language. Spelling mistakes, clumsy grammar, and awkward phrasing are common in scams. Professional companies proofread their emails; many scammers do not.

Distrust unexpected attachments. An attachment you were not expecting — especially one urging you to open it — can carry harmful software. When in doubt, do not open it.

Beware requests for sensitive information. No legitimate bank, company, or agency will email you asking for your password, full card number, or verification codes. That request alone is a red flag.

No single sign is proof on its own, but two or three together almost always mean a scam. When you feel unsure, trust the doubt.

To see how the signs stack up, picture a typical scam email. The display name reads “PayPal Security,” but the actual address is something like service@paypal-secure-alerts.com — not PayPal’s real domain. It opens with “Dear Valued Customer” instead of your name. The message warns that your account has been “limited due to unusual activity” and that you must “verify within 24 hours” or lose access — urgency and fear in one sentence. There is a button saying “Verify Now,” but hovering reveals a link to an unrelated web address. And a line asks you to confirm your password and card details on the page. Every one of those is a red flag, and together they are unmistakable. Once you have consciously spotted a few, the pattern jumps out at you automatically.

The common types of phishing

Phishing comes in several flavours, and knowing them helps you recognize the pattern wherever it appears.

Email phishing is the classic mass version — the same scam blasted to millions, hoping a small fraction bite.

Spear phishing is targeted. The attacker researches you and personalizes the message, perhaps referencing your employer or a real colleague, which makes it far more convincing. A version aimed at executives is sometimes called “whaling.”

Smishing is phishing by text message — a fake delivery notice, a bank alert, a prize — often with a link to a fake site.

Vishing is voice phishing: a phone call from someone pretending to be your bank, tech support, or a government office, pressuring you to reveal information or grant access.

Clone phishing copies a real message you have seen before, swapping a genuine link for a malicious one so it looks completely familiar.

Across all of them the goal is identical — impersonate trust, create pressure, and harvest information. Only the channel changes.

It is also worth knowing that phishing has grown more sophisticated. The clumsy, typo-ridden scam still exists, but attackers increasingly use artificial intelligence to write flawless, personalized messages, and even to clone voices for convincing phone scams. This means “bad grammar” is no longer a reliable filter on its own — the structural signs, like a wrong sender address, unexpected requests, and manufactured urgency, matter more than ever. The broader skill of judging what to trust online is covered in our guide on how to identify reliable information and avoid scams, which pairs naturally with spotting phishing.

What happens if you fall for it

Understanding the stakes explains why this matters. If you enter your details into a phishing site, the attacker now has them. They may drain an account, make purchases, or sell the information. If the stolen credential is a password you reuse elsewhere, every account sharing that password is suddenly exposed — which is exactly why unique passwords matter so much. In other cases, clicking a link or opening an attachment installs malicious software that can spy on you or lock your files.

Phishing is also the first step in many larger breaches. A single employee tricked into revealing a password can open the door to an entire company’s systems. This is why protecting your personal data and treating your login details as valuable are core habits, not optional extras.

What to do when you get a phishing message

Having a simple plan removes the panic that scammers rely on.

Do not click, reply, or open attachments. Engaging at all can confirm your address is active or trigger a download. Do not share any information. When you are unsure whether a message is genuine, verify through a channel you trust — go directly to the company’s official website or app, or call the number on the back of your card, rather than using any contact detail in the suspicious message itself. That single habit defeats most phishing.

If a message is clearly a scam, report it — most email services have a “report phishing” option, and reporting helps protect others — then delete it. And if you think you already fell for one, act quickly: change the password on the affected account immediately, change it anywhere else you reused it, and enable two-factor authentication so a stolen password alone is not enough. If financial details were exposed, contact your bank right away to watch for fraud.

Speed limits the damage. The sooner you lock things down, the less an attacker can do.

Conclusion

Phishing is the art of impersonating trust to trick you into handing over what an attacker could never simply steal. It is the world’s most common cyberattack precisely because it targets people rather than machines — no firewall stops a message that convinces you to click willingly. But that same fact is empowering: because phishing works on psychology, a calm, informed person is its worst enemy.

The signs are learnable and consistent. Watch the real sender address, not the display name. Be wary of generic greetings, urgent threats, odd language, and unexpected attachments. Hover to see where links truly lead, and never trust an email that asks for a password or a verification code. Above all, notice the feeling of pressure — that manufactured urgency is the tell that someone wants you to act before you think.

When something feels off, slow down and verify through a channel you trust, never through the message itself. Report it, delete it, and if you slipped, change your passwords and turn on two-factor authentication without delay. Master these habits and you neutralize the most common threat online. Phishing depends entirely on catching you off guard — and now, you will not be. For the bigger picture of staying safe, our guide on what cybersecurity is ties it all together.