Social Engineering & FraudMANIPULATIVE

Phishing

What it is

Mass-distributed fraudulent messages, usually email, that impersonate a trusted organization to trick recipients into clicking a malicious link, opening an attachment, or entering credentials on a counterfeit site.

How it works

Phishing works by borrowing trust the recipient already extends to a brand, employer, or institution and attaching it to a request the real organization would rarely make. The message copies logos, signature blocks, and the cadence of routine notifications, so the recipient processes it on autopilot rather than with scrutiny. The lure usually pairs a mild threat or reward (a suspended account, an unpaid invoice, a tax refund) with a deadline, which is Cialdini's authority and scarcity principles compressed into one screen. Because it is sent at volume, the attacker needs only a small response rate: the FBI recorded phishing and spoofing as the most-reported internet crime type of 2023, and Verizon's 2024 breach report found that the median time from opening a phishing email to clicking its link was under a minute. Dhamija, Tygar, and Hearst showed in 2006 that even attentive users struggle to tell a well-made counterfeit site from the real one, because the cues they rely on (padlocks, logos, plausible-looking addresses) are exactly the cues attackers copy.

Real-world examples

•The term dates to mid-1990s AOL, where attackers posing as staff messaged users for their passwords and billing details; the "ph" spelling follows the older hacker term "phreaking".
•In March 2016 a message styled as a Google security alert led Hillary Clinton campaign chair John Podesta to a counterfeit login page, exposing years of email; in September 2020 Microsoft reported that state-backed groups had targeted both the Trump and Biden campaigns with phishing.
•The 2013 Target breach began with a phishing email to a heating-and-cooling contractor, whose stolen network credentials opened a path to systems handling roughly 40 million payment cards.
•Phishing kits sold on criminal forums let low-skill operators clone a bank or webmail login page in minutes; Google researchers tracking such kits in 2016-2017 identified more than 12 million potential victims in a single year.
•QR-code phishing ("quishing") moves the same lure onto a printed sticker or an emailed image so that mail filters cannot read the link and the victim scans it on a phone with fewer security cues.

Ethical guidelines

●Phishing is fraud and, in most jurisdictions, a crime; there is no legitimate use outside authorized, consented security testing.
●Simulated phishing inside an organization is defensible only when employees know that simulations occur, the exercise is designed to teach rather than to shame, and results are never used to punish individuals.
●Security teams should avoid lures that exploit personal crises (bonuses, layoffs, health news) even in simulations; the damage to trust outlasts the lesson.
●Organizations that send legitimate email should stop training customers to click: avoid unannounced links, use consistent sender domains, and adopt DMARC so their brand is harder to counterfeit.

How to defend against it

►Do not use the link in the message. Open a new tab and type the organization's address yourself, or use the app you already have installed; if the alert is real, it will be waiting there.
►Read the sender domain character by character, from the right: the part immediately before the first single slash is the real domain, and "paypal.com.security-check.net" is not PayPal.
►Treat urgency plus a request for credentials, payment, or a download as the signature of the attack; legitimate organizations tolerate a delay while you verify.
►Turn on phishing-resistant multi-factor authentication (passkeys or hardware security keys) for email, banking, and password-manager accounts; a stolen password alone then buys the attacker nothing.
►Use a password manager and let it autofill. It fills credentials only on the exact domain they were saved for, so a counterfeit page gets nothing.
►Report the message to your IT team or forward it to reportphishing@apwg.org and file at reportfraud.ftc.gov, then delete it; reporting is what gets counterfeit sites taken down.

From the Defense Playbook

Prebunking (Self-Inoculation)takes practice

Expose yourself in advance to a weakened, clearly labelled dose of a manipulation technique together with its refutation, so that when the full-strength version arrives you recognize the move instead of being carried by it.

Out-of-Band Verificationminutes

Confirm any request that arrives through one channel (email, text, chat, a phone call) by reaching the supposed sender through a different channel you already trusted before the request existed.

The Callback Ruleminutes

When anyone contacts you claiming to be your bank, a government agency, a utility, or a company you deal with, hang up and call back on the number printed on your card, statement, or the organization's official website, never the number they gave you.

Multi-Factor Authentication and Passkeysminutes

Turn on a second factor for every account that matters and prefer phishing-resistant forms (passkeys or hardware security keys), so that a password typed into a fake page or talked out of you on the phone is not enough to take the account.

Every playbook entry states how strong its evidence is and when not to use it. Browse the full playbook.

References

Dhamija, R., Tygar, J. D., & Hearst, M. (2006). Why Phishing Works. Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI 2006), 581-590 · link
Usability study showing that even attentive users misjudge counterfeit sites because attackers copy the very cues users rely on.
Federal Bureau of Investigation, Internet Crime Complaint Center (2024). Internet Crime Report 2023. FBI IC3 · link
Phishing/spoofing as the most-reported crime type of 2023; overall reported losses exceeding 12.5 billion dollars.
Verizon (2024). 2024 Data Breach Investigations Report. Verizon Business · link
Median time to click a phishing link under one minute; human element involved in roughly two-thirds of breaches.
Thomas, K., Li, F., Zand, A., Barrett, J., Ranieri, J., Invernizzi, L., Markov, Y., Comanescu, O., Eranti, V., Moscicki, A., Margolis, D., Paxson, V., & Bursztein, E. (2017). Data Breaches, Phishing, or Malware? Understanding the Risks of Stolen Credentials. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS 2017) · link
Scale of phishing-kit victimization (about 12.4 million potential victims in one year) and the account-hijacking risk of phished credentials.

Last reviewed 2026-09-07

Suggest a correction

Detect Phishing in any text

Paste any message, email, or article into our free Manipulation Detector to see if Phishing or other techniques are being used on you.

Try the Detector Free Create Free Account

Social Engineering: Why Smart People Fall for It

Social engineering does not target stupidity. It targets helpfulness, deference, and time pressure, which are the same habits that make people good at their jobs. Here is how the attacks are built and which procedures actually stop them.

7 min read

The Disinformation Playbook: How Campaigns Are Built and Where They Break

Disinformation campaigns follow a recognizable sequence: seed, launder, amplify, and let real people carry it the rest of the way. A field guide to the stages, drawn from the research, with the defences that work at each one.

8 min read