What is phishing? Definition + 8 common types + how to spot and avoid scams (2026)

Phishing is a cyberattack where scammers impersonate trusted entities (banks, tech companies, government agencies, or even people you know) via email, text, phone call, or message to trick you into revealing sensitive data like passwords, credit card numbers, or one-time login codes. Phishing caused $12.5 billion in reported losses in 2025 (FBI IC3) and is the #1 starting point for data breaches and ransomware attacks. The 8 main types are email phishing, smishing (SMS), vishing (voice call), spear phishing, whaling, QR code phishing, AI voice cloning, and deepfake video phishing. The good news: 95% of phishing attacks have visible red flags you can spot with training.

What is the definition of phishing?

Phishing is a form of social engineering where an attacker sends a fraudulent message designed to trick a human into:

1. Revealing sensitive information — passwords, credit card numbers, SSN, banking credentials, MFA codes
2. Installing malware — clicking a link or opening an attachment that installs ransomware, info-stealers, or remote access trojans
3. Taking a harmful action — wiring money, changing payment details, approving a fraudulent transaction

The word "phishing" is a play on "fishing" — attackers cast bait (the message) hoping someone will "bite" (click, reply, or call).

Phishing is the #1 attack vector for cyberattacks — it was the initial access point in 68% of data breaches in 2025 (Verizon DBIR), up from 54% in 2024.

What are the 8 main types of phishing?

1. Email phishing (the classic)

Mass emails impersonating trusted brands — PayPal, Apple, Microsoft, Amazon, banks, IRS, USPS, FedEx, LinkedIn, etc.

Example 2025 attacks:

• "Your Apple ID has been locked. Click here to verify." → fake Apple login page
• "Your package couldn't be delivered. Pay $1.99 redelivery fee." → fake USPS page
• "Your tax refund of $1,847 is pending. Click to claim." → fake IRS page
• "Unusual activity on your account. Verify immediately or it will be suspended." → fake bank login

These are sent to millions of recipients at a time. The conversion rate is low (~0.1%) but the volume makes it profitable.

2. Smishing (SMS phishing)

Text messages impersonating brands or individuals. Surged in 2024-2026 because people trust texts more than email.

Common 2025-2026 smishing scams:

• "USPS: Your package is held. Pay $0.99 fee: [short URL]" → fake USPS page, steals credit card
• "[Bank]: Your card was charged $499. If not you, click here." → fake bank page, steals credentials
• "[Boss name]: I'm in a meeting, can you send me gift cards?" → BEC fraud (grew 200% in 2025)
• "Hi [your name], I have a new number. Save it." → leads to WhatsApp, romance/pig-butchering scam

3. Vishing (voice phishing)

Phone calls impersonating banks, tech support, government agencies.

Common 2025-2026 vishing scams:

• "Hi, this is Sarah from Chase fraud prevention. We noticed suspicious activity..." → asks for card number + PIN
• "Hi, this is Microsoft Support. We've detected viruses on your computer..." → asks for remote access
• "Hi, this is the IRS. You owe back taxes. Pay immediately or face arrest..." → fake tax payment
• "Hi, I'm calling about your car's extended warranty..." → the classic (still active)

4. Spear phishing (targeted)

Personalized phishing aimed at specific individuals or organizations. Uses real personal data (from breaches or social media) to make the message convincing.

Example: "Hi Marcus, saw your LinkedIn post about the iPhone 18 launch. I've got a contact at Apple who's offering pre-release units. Want in? [link]" → the "Marcus" and "iPhone 18" details are pulled from LinkedIn + public breaches.

5. Whaling (executive targeting)

Spear phishing aimed at C-suite executives or high-net-worth individuals. Often uses deepfake audio of the CEO instructing the CFO to wire money.

Example: CFO receives a call that sounds exactly like the CEO, asking for a $4.2M wire to a new vendor. By the time the fraud is discovered, the money is gone. (Losses from this type grew 280% in 2025.)

6. QR code phishing ("quishing")

Phishing delivered via malicious QR codes. Surged in 2024-2026 as QR codes became ubiquitous for restaurants, parking, menus, and authenticator apps.

Common attacks:

• Fake parking meter QR codes → steals credit card
• Restaurant menu QR codes that download malware → steals contact list + SMS
• "Scan to verify your account" → fake Microsoft 365 login
• QR codes on packages / flyers / stickers → lead to credential harvesting pages

7. AI voice cloning phishing

Attackers use AI to clone a person's voice from short audio samples (as little as 15 seconds of voice from a social media video). Then they call the victim's family or coworkers pretending to be the victim in distress.

Example 2025 attack: A teenager in Arizona received a call that sounded exactly like her mom, saying she'd been kidnapped and demanding $1M ransom. The mom was safe — it was a clone of her voice from a TikTok video.

8. Deepfake video phishing

Real-time video deepfakes of executives during Zoom calls. The CFO sees the CEO on video saying "wire $5M to this vendor." It looks like the CEO. It sounds like the CEO. But it's a deepfake.

Notable 2025 incident: A Hong Kong company wired $25M after a deepfake video call with the "CFO" (BBC, Feb 2024). Similar attacks hit Ferrari and several UK energy firms in 2025.

What are the 7 red flags of phishing?

Spot the attack by looking for these 7 signs:

1. Urgency or threats — "Your account will be closed in 24 hours." "Legal action will be taken." Real organizations give you time.

2. Generic greetings — "Dear Customer" or "Dear User." Real companies use your name.

3. Mismatched URLs — hover over links (don't click!) and check if the URL matches. "appleid-verify.com" is not apple.com.

4. Spelling and grammar errors — many phishing emails have unusual phrasing, wrong names of products, awkward sentences. (Though AI-generated phishing has reduced this red flag.)

5. Requests for sensitive info — banks and government agencies never ask for passwords, SSN, or PINs via email/text/phone.

6. Unexpected attachments — invoices you didn't expect, "delivery confirmation" PDFs, "voice message" attachments.

7. Pressure to act outside normal channels — "Don't call the main number. Use this one." "Don't tell anyone about this."

If you see ANY of these red flags, treat the message as suspicious.

How do you protect yourself from phishing?

Technical defenses (do these first):

1. Enable multi-factor authentication (MFA) on all accounts — even if your password is phished, attackers can't log in without the second factor
2. Use a password manager — auto-fills credentials only on legitimate sites (won't fill on phishing sites)
3. Use email filtering — most modern email providers (Gmail, Outlook) catch 99%+ of phishing, but some still get through
4. Keep software updated — patches vulnerabilities that phishing emails exploit
5. Use anti-phishing browser extensions — Avast, Bitdefender, Norton all offer browser plugins that warn about phishing sites
6. Enable "Click-to-call" protection — many banks offer this to prevent vishing

Behavioral defenses (training):

1. Slow down — phishing works because people react quickly. Take 10 seconds before clicking.
2. Verify via a second channel — if your "bank" emails you, call the number on the back of your card (not the number in the email).
3. Hover before you click — hover over links to see the actual URL. Most email clients let you do this.
4. When in doubt, delete — better to miss a legitimate email than click a malicious one.
5. Report phishing — use the "Report Phishing" button in Gmail, the "Report Message" add-in in Outlook, or forward to reportphishing@apwg.org

Family defenses (especially for elderly parents):

1. Set up a "verify with me" code word with elderly family members — any caller (even if it sounds like a grandchild) must provide the code word
2. Install ad blockers — they block many phishing malvertising attacks
3. Limit what seniors post on social media — name, birthday, and grandkids' names are common password/secret-question answers
4. Use Apple's Ask to Buy / Google Family Link for younger family members' purchases

How do you report phishing?

In the US:

• Email: forward to reportphishing@apwg.org (Anti-Phishing Working Group)
• Text/SMS: forward to 7726 (SPAM) - works on AT&T, Verizon, T-Mobile, Sprint
• FTC: report to reportfraud.ftc.gov
• FBI IC3: file at ic3.gov if you lost money
• IRS phishing: forward to phishing@irs.gov
• Bank impersonation: call the number on the back of your card (not the one in the message)

In the UK:

• Action Fraud: actionfraud.police.uk
• Suspicious emails: forward to report@phishing.gov.uk (NCSC)
• Suspicious texts: forward to 7726

In the EU:

• CERT-EU or your national CERT
• Europol: report via europol.europa.eu

What to include in your report:

• The original message (with full headers if email)
• Screenshot of the URL (if you hovered)
• Your phone number / email (if you responded)
• Any money lost (file a police report)

What should you do if you've been phished?

Immediate actions:

1. Disconnect the affected device from the internet (if you clicked a link or downloaded malware)
2. Change passwords for the affected account AND any account using the same password
3. Enable MFA on the affected account (and any account you can)
4. Contact your bank if you entered financial information — request new cards and reverse fraudulent charges
5. Run a malware scan — use Malwarebytes, Windows Defender, or your antivirus

Within 24 hours: 6. Place a fraud alert with one of the three credit bureaus 7. Check Have I Been Pwned at haveibeenpwned.com 8. File a report at ic3.gov (US) or your local fraud agency

Within a week: 9. Consider identity theft protection (Aura, LifeLock, Identity Guard) 10. Review all financial accounts for suspicious activity 11. Document everything for potential law enforcement follow-up

What is the bottom line on phishing?

Phishing is a social engineering attack that uses fake messages (email, SMS, voice, video) to trick you into revealing data, installing malware, or sending money. It caused $12.5B in losses in 2025 and is the #1 attack vector for data breaches. The 8 main types are email phishing, smishing, vishing, spear phishing, whaling, QR code phishing, AI voice cloning, and deepfake video. The 7 red flags — urgency, generic greetings, mismatched URLs, grammar errors, requests for sensitive info, unexpected attachments, and pressure to use unofficial channels — catch 95% of attacks. Defense is layered: enable MFA everywhere, use a password manager, slow down before clicking, and verify via a second channel when something feels urgent.

---

For related security topics, see our What is a data breach FAQ and our Snowflake breach analysis.