Phishing Explained: Types, Examples and How to Spot It

Phishing is when scammers pretend to be a company or person you trust, by email, text or phone, to trick you into giving up passwords, account numbers or other personal information.

The aim is to take your money or your identity.

This guide covers the definition, the main types, real examples, how to spot one and what to do if you clicked. It follows the FTC, NIST, CISA and the Anti-Phishing Working Group. Checked on October 22, 2026.

The short answer

Phishing is a type of social engineering attack. It works by getting you to act, not by breaking into a computer.

Avoid links and attachments in messages you did not expect. Contact the company through a phone number or website you know to be real.

A phishing email can be forwarded to reportphishing@apwg.org. A phishing text can be forwarded to 7726. Report it to the FTC at ReportFraud.ftc.gov either way.

Phishing definition

NIST's glossary describes phishing as an effort to get sensitive data, such as bank account numbers, by pretending to be a legitimate business or reputable person in a fraudulent email or on a website.

The FTC describes it plainly: you get emails, texts or calls that seem to come from people you know, but scammers want you to click a link or give personal information such as a password.

Phishing meaning and what type of attack it is

The name is a play on fishing: the scammer sends bait and waits for someone to bite. Phishing counts as a social engineering attack.

CISA describes social engineering as an attacker relying on human contact to gather or compromise information. The attacker may seem respectable, and may use a false sense of urgency to get you to open an attachment without examining it.

Types of phishing

Phishing examples

Scammers use ordinary reasons to contact you. The FTC gives these examples of what phishing messages say.

How to spot a phishing email

The FTC and CISA point to the same set of warning signs. A single one of these signs is enough reason to stop and check.

Stronger checks

Check the full sender address and domain, not just the display name. Look at where a link really goes without opening it, and question unexpected urgency or requests for credentials.

Verify odd payment requests through a different channel that you trust. The FTC notes that some phishing schemes are sophisticated, so a familiar logo does not prove a message is genuine.

Phishing email meaning

A phishing email is a message designed to look like it came from a company or person you trust, so that you click a link, open an attachment or reply with personal information.

The FTC says scammers launch thousands of phishing attacks every day, and they are often successful.

Phishing link checker

Before you click, look at where a link goes. On a computer, hover over it to read the address. On a phone, press and hold the link. Our advice: if the address does not match the company, do not click.

A link checker can help, but a clean result is not proof that a page is safe, and a familiar-looking domain is not a guarantee either. I did not test any link checker.

CISA's guidance suggests hovering over a link to see whether its destination matches the text. If it does not match, the link may be malicious.

The FTC's advice is simpler and stronger: type the company's real address yourself, or call a number you know.

What to do if you think it is phishing

1. Do not click links or download attachments in the message.
2. Find the company's real website or phone number yourself.
3. Call that company, using a number you know to be correct, and tell them about the message.
4. Report it, then delete the message.

The FTC says to check it out and report it, then delete the message. Reporting helps because the FTC and the Anti-Phishing Working Group use reports to fight scammers.

Where to report phishing

Channel	Forward or send to	Also report to
Email	reportphishing@apwg.org	ReportFraud.ftc.gov
Text message	7726 (SPAM)	ReportFraud.ftc.gov
Phone call or other	Not applicable	ReportFraud.ftc.gov

The routes come from the FTC's phishing guidance and are for the United States. If you live elsewhere, report the incident to your country's cybercrime authority and contact your bank or service provider directly.

If you lost money or gave away personal information, tell your bank and see our identity theft guide.

What to do if you clicked

The right response depends on what happened. Pick the case that fits.

The FTC says to change a compromised password right away and not reuse it, and suggests two-factor authentication. HHS cybersecurity guidance says to keep anti-malware software and system patches up to date.

The FTC warns that if you gave out your Social Security number or date of birth, scammers could try to steal your identity. Follow our guide on what to do after identity theft, and check our breach guides for passwords.

How big is the problem

APWG's Q2 2026 report counted 1,069,681 phishing attacks, up 10.1 percent from 971,181 in the first quarter. June 2026 on its own reached 425,808, the highest monthly figure since April 2023.

APWG counts unique phishing websites as attacks, not every individual phishing message. The same report says smishing rose 40 percent and vishing 20 percent from Q1 to Q2 2026.

The report also says wire-transfer business email compromise attacks increased 88 percent, and that the average amount requested was $61,732, up 45 percent. Check the APWG's reports page for later figures.

Phishing is often the first step of bigger attacks. Our guide to what ransomware is and our guide to business email compromise show where a stolen login can lead.

Spear phishing, whaling and clone phishing

Phishing comes in several styles. Spear phishing targets one person or a small group with personal details. Whaling is spear phishing aimed at senior executives.

Clone phishing copies a real message you already received and resends it with a harmful link or attachment.

These are common usage and not formal standards, but the pattern matters. The more a message knows about you, the harder it is to dismiss.

Fake websites and look-alike domains

A phishing email usually leads to a fake website that looks like the real one.

The address is the giveaway, and attackers work hard to make it look right. One trick uses characters from other alphabets that look identical to English letters.

I tested it. The first name in each pair below uses ordinary letters.

The second replaces the first letter with a Cyrillic letter that looks the same on screen. The way the domain system sees it is shown on the right.

Name as shown	Ordinary letters only	Seen by the domain system
paypal.com	Yes	paypal.com
pаypal.com	No	xn--pypal-4ve.com
apple.com	Yes	apple.com
аpple.com	No	xn--pple-43d.com

On screen the pairs look the same, but they are different domains. Browsers often show the encoded form to protect you, though not always. Do not rely on your eyes. Type the address yourself or use a saved bookmark.

Check how a message was sent

Email carries hidden details, called headers, that show where a message came from. I wrote a made-up example and parsed it.

The sender line says Payroll Team, but the sender domain uses the digit one in place of a letter L. The reply address leads to a third domain, and the technical return path leads to a fourth.

From domain:      examp1e-corp.com
Reply-To domain:  mailbox-secure.net
Return-Path domain: bulk-sender.example
Authentication-Results: spf=fail; dkim=none; dmarc=fail

Three different domains in one message is a warning sign, and failing authentication checks is another.

This sample is invented to show the pattern, not taken from a real attack. In most mail programs, you can view the original message or its headers from a menu.

What SPF, DKIM and DMARC are

Three standards help receiving servers judge whether a message is really from the domain it claims.

SPF lists which servers may send for a domain, and DKIM adds a cryptographic signature. DMARC tells receivers what to do when a message fails those checks.

RFC 7489 describes DMARC as a way for a domain owner to express policy and preferences for message validation, disposition and reporting, with handling that ranges from no action through altered delivery up to rejection.

Google's sender guidelines require senders to Gmail accounts to set up SPF or DKIM, and its requirements for senders of 5,000 or more messages a day are stricter.

If you run a domain, set these up so criminals cannot easily pretend to be you.

How to tell if you got phished

You may not know right away. These signs, from our experience of typical cases, suggest it happened.

• You entered a password on a page you reached from a message.
• You opened an attachment you did not expect.
• You called a number or followed instructions from a stranger.
• Your accounts show sign-ins, password reset emails or forwarding rules you did not set up.

If any of these fit, act quickly. Change the password for that account, then for any account that shares it.

Turn on multifactor authentication, check for forwarding rules and report the message. Our guide to changing your password after a breach has the steps.

Tools that help

Spam filters and browser warnings catch many attacks, but not all.

A password manager helps because it fills credentials only on the exact site address that you saved, so a look-alike domain gets nothing. That is a useful side effect of using one.

For organizations, email authentication, link scanning, and reporting buttons all help. Training works best when it is short, frequent and blame-free.

Frequently asked questions

What is phishing?

It is a scam in which someone pretends to be a trusted company or person by email, text or phone to get your information or money.

Phishing is what type of attack?

A social engineering attack. It relies on tricking people, not on breaking into systems.

How do I report a phishing email?

Forward it to reportphishing@apwg.org and report it to the FTC at ReportFraud.ftc.gov.

How do I report a phishing text?

Forward it to 7726, then report it to the FTC at ReportFraud.ftc.gov.

Why do phishing messages create urgency?

CISA says attackers may use a false sense of urgency or importance so that you act without examining the message.

What is clone phishing?

An attacker copies a genuine email you already received and resends it with a harmful link or attachment.

How can I spot a fake website?

Check the address carefully. Look-alike letters from other alphabets can fool the eye, so type the address or use a bookmark.

What are SPF, DKIM and DMARC?

Email checks that help receivers decide whether a message really comes from the domain it claims.

A quick checklist

• Skip links and attachments you did not expect.
• Check the sender's address and look for urgency.
• Phone the company using a number you know is real.
• Send phishing emails and texts to the reporting channels.
• Enable two-factor authentication.

Up nextWhat to do after identity theftThink scammers already have your details? Read our guide to what to do after identity theft.→