Types of Phishing Attacks & How to Avoid Them

Phishing attacks are scams where cybercriminals impersonate trusted people or organizations to trick victims into handing over passwords, financial details, or other sensitive information. Understanding the different types of phishing, from email and spear phishing to smishing, vishing, and deepfake scams, matters because each variant uses a slightly different trick, and recognizing the pattern is the fastest way to avoid falling for one.

Key Takeaways

• Phishing is a social engineering tactic that tricks people into revealing sensitive information by impersonating a trusted source.
• Common types include email phishing, spear phishing, whaling, smishing, vishing, clone phishing, pharming, and business email compromise (BEC).
• Phishing works by exploiting human psychology, urgency, and trust, not by breaking through technical defenses.
• Warning signs include spelling errors, unusual sender addresses, suspicious links, unexpected attachments, and urgent requests for information or payment.
• The best defenses combine MFA, email filtering, security awareness training, and quick reporting if something looks off.

Phishing remains one of the most common attack vectors referenced by CISA, NIST, and the Verizon Data Breach Investigations Report (DBIR), which consistently ranks it among the top methods behind confirmed data breaches.

Types of Phishing Attacks

Phishing didn’t stay a single trick for long. As spam filters, browser warnings, and employee training got better at catching the obvious email scam, attackers branched out into text messages, phone calls, social media, search results, and even AI-generated video, so there would always be some channel where the target’s guard was down. That’s why phishing today isn’t one attack, it’s a whole family of related techniques. Here’s a breakdown of the ones you’re most likely to encounter.

1. Email Phishing

Definition: Email phishing is the most common and widely recognized form of phishing attack, where attackers send mass emails designed to appear as if they come from trusted organizations.

How it works: Attackers impersonate banks, e-commerce platforms, or workplaces, and the emails usually urge recipients to click a link or download an attachment tied to a fake account issue, payment failure, or refund.

Example scenario: You get an email that looks like it’s from your bank, warning that your account has been locked, with a link to “verify your identity” that leads to a fake login page.

Warning signs: Urgent account or payment language, generic greetings, and links that don’t match the sender’s real domain.

Prevention tips: Never click links in unexpected account emails, type the organization’s URL directly into your browser instead, and enable email filtering.

2. Spear Phishing

Definition: Spear phishing takes the traditional phishing model and adds personalization, targeting specific individuals rather than sending the same message to thousands of people.

How it works: Attackers research their targets, job roles, social media profiles, professional networks, and even hobbies, then craft a tailored email that references real details to feel highly convincing.

Example scenario: You receive an email that looks like it’s from your boss, mentioning a project you’re actually working on and asking you to review an attached file.

Warning signs: A request that feels slightly off in tone, unusual urgency from someone senior, or an attachment you weren’t expecting.

Prevention tips: Verify unusual requests through a separate channel (a call or a message on a known number), and be cautious with how much work information you share publicly.

3. Whaling

Definition: Whaling is a specialized version of spear phishing aimed specifically at senior executives like CEOs, CFOs, and board members.

How it works: Because executives have access to sensitive information and financial authorizations, attackers design messages to look like critical business communication, such as a request to approve a wire transfer.

Example scenario: A CFO receives what looks like an urgent email from the CEO requesting an immediate, confidential wire transfer for a “time-sensitive deal.”

Warning signs: Requests for secrecy, unusual urgency, and financial requests that bypass normal approval steps.

Prevention tips: Require secondary verification for any financial request, regardless of who appears to be asking, and train executives specifically on whaling tactics.

4. Smishing (SMS Phishing)

Definition: Smishing uses SMS text messages instead of emails to carry out phishing scams.

How it works: Messages pretend to come from banks, courier companies, or well-known brands, typically claiming an account is locked or a delivery needs action, with a malicious link attached.

Example scenario: You get a text saying, “Your bank account has been locked. Click here to unlock it,” with a link to a fake bank login page.

Warning signs: Unexpected texts about accounts or deliveries, shortened or unfamiliar links, and requests to act immediately.

Prevention tips: Don’t tap links in unexpected texts, and contact the organization directly using a number from its official website or app.

5. Vishing (Voice Phishing)

Definition: Vishing, short for voice phishing, uses phone calls to trick victims into revealing confidential information.

How it works: Scammers pose as bank officials, government agents, or tech support representatives, then ask for account numbers, security codes, or other personal details under the guise of verifying identity.

Example scenario: You get a call from someone claiming to be your bank’s fraud department, reporting suspicious activity and asking you to confirm your card number.

Warning signs: Unsolicited calls asking for sensitive details, pressure to act immediately, and requests to stay on the line while you “verify” information.

Prevention tips: Hang up and call the organization back using the number on its official website, never one provided by the caller.

6. Clone Phishing

Definition: Clone phishing involves taking a legitimate, previously delivered email and creating a nearly identical copy.

How it works: The cloned email typically claims to be a “resend” or “updated version” of the original and contains a malicious link or infected attachment, relying on the recipient’s existing trust in that thread.

Example scenario: You receive what looks like a follow-up to an email thread you were already part of, but the attachment has been swapped for a malicious file.

Warning signs: A duplicate-feeling email you’ve already responded to, or a slightly altered sender address on a familiar thread.

Prevention tips: Verify unexpected “resends” with the original sender directly, and check attachment file types before opening.

7. Pharming

Definition: Pharming is a deceptive form of phishing that doesn’t rely on baiting the user to click a bad link.
How it works: Attackers manipulate the underlying internet infrastructure, such as the Domain Name System (DNS), to redirect users from legitimate websites to malicious ones without their knowledge.

Example scenario: You type in your bank’s correct address, but due to DNS poisoning or malware on your device, you land on a fake site that looks identical to the real one.

Warning signs: A login page that looks slightly different, unexpected certificate warnings, or a site behaving unusually after typing a familiar address.

Prevention tips: Use DNS filtering, keep devices updated, and watch for browser security warnings rather than dismissing them.

8. Social Media Phishing

Definition: Social media phishing uses platforms like Facebook, Instagram, LinkedIn, or X to lure victims.

How it works: Scammers send fake friend requests, offer too-good-to-be-true giveaways, or impersonate real accounts to solicit money or personal information.

Example scenario: A fake profile mimicking a colleague sends you a direct message asking for a “quick favor” involving gift cards or a money transfer.

Warning signs: Unusual requests from known contacts, newly created profiles, and offers that seem too generous to be real.

Prevention tips: Verify unexpected requests through another channel, and report and block suspicious accounts immediately.

9. Search Engine Phishing (SEO Poisoning)

Definition: Search engine phishing, also known as SEO poisoning, involves fake websites that rank highly in search engines.

How it works: These sites mimic real banks, tax filing services, or online stores, luring users who click through search results without checking the actual URL.

Example scenario: You search for “download latest tax forms” and click a well-ranked result that turns out to be a fake site prompting you to log in or download malware.

Warning signs: A URL that doesn’t match the organization’s known domain, and login prompts on a page you reached through search rather than typing the address directly.

Prevention tips: Navigate to official government or company sites directly rather than through search results when handling sensitive tasks.

10. Business Email Compromise (BEC)

Definition: Business Email Compromise (BEC) is one of the most financially damaging forms of phishing attacks.

How it works: Attackers impersonate senior executives, vendors, or trusted business contacts to deceive employees into transferring money or sensitive information, often without any obvious red flags like malicious links.

Example scenario: An employee receives an urgent request, framed as a confidential business deal, asking them to wire funds to a new account immediately.

Warning signs: Last-minute changes to payment details, pressure to bypass normal approval processes, and requests for secrecy.

Prevention tips: Require a verified second channel (phone call to a known number) for any change in payment instructions, no exceptions.

The year is 2026, and phishing attacks are not going anywhere. Despite the growing sophistication of cybersecurity defenses, phishing in cybersecurity continues to be one of the most effective tactics for cybercriminals. It’s cheap, it’s easy to execute, and more importantly, it still works. Before diving into the different types of phishing attacks, let’s understand why this form of phishing cybercrime remains a serious problem.

What Is Phishing?

At its core, phishing is a technique used by attackers to trick people into giving up sensitive information, like passwords, credit card numbers, or personal details. Cybercriminals pose as trustworthy entities, usually via email, messages, or fake websites, to lure victims into a trap.

Why Phishing Still Works in 2026

Even with better technology and smarter users, phishing attacks are thriving, for a few connected reasons.

• Human psychology: Phishing doesn’t just target systems, it targets people. No firewall or antivirus can fully protect against someone clicking a convincing link under pressure. The Verizon DBIR has repeatedly found that the human element is a factor in the large majority of confirmed breaches.
• AI-generated phishing: Attackers now use generative AI to write flawless, personalized phishing emails at scale, removing the spelling and grammar mistakes that used to be an easy tell. Google’s threat intelligence teams and Microsoft’s Digital Defense Report have both flagged AI-assisted phishing as a fast-growing trend.
• Credential theft: Stolen credentials from past breaches feed directly into future phishing campaigns, letting attackers craft messages that reference real account details and appear far more credible.
• Remote work: Distributed teams communicate primarily through email, chat, and video, which gives attackers more channels to impersonate colleagues and fewer opportunities for an in-person “does this look right?” check.
• Cloud applications: As more business runs through cloud platforms like Microsoft 365 and Google Workspace, a single successful phishing attempt can expose email, files, connected apps and other sensitive data all at once, raising the payoff for attackers. IBM’s Cost of a Data Breach research consistently finds that breaches involving stolen or phished credentials take longer to detect and cost more to contain.

Plus, attackers are constantly adapting, using AI, deepfakes, and even SMS and voice phishing to keep their scams believable.

Despite the different forms it can take, most phishing in cybersecurity shares a few common features.

Social Engineering Tactics

At the heart of most phishing attacks lies social engineering. Rather than trying to hack into systems by force, cybercriminals manipulate human behaviour. They play on natural emotions like curiosity (“You’ve won a prize!”), fear (“Your account has been compromised!”), or a sense of urgency (“Immediate response needed!”). When people are emotional or rushed, they’re much more likely to ignore warning signs and make quick, unthinking decisions. Social engineering is so effective because it targets the human, not the machine, and in phishing in cyber security, humans are often the weakest link.

Use of Urgency and Fear

A big part of social engineering in phishing attacks is creating a false sense of urgency. Attackers often craft messages that say things like, “Confirm your identity within 24 hours or your account will be suspended,” or “Suspicious activity detected, act now!” When people feel they have limited time to act, they’re far less likely to double-check links or verify the request. Fear and pressure cloud judgment, which is exactly what the attacker wants. It’s a deliberate tactic used in almost every form of phishing cybercrime today.

Spoofed Emails, Fake URLs, and Lookalike Domains

Modern phishing attacks are incredibly convincing. Cybercriminals now create spoofed emails that look nearly identical to legitimate messages from banks, retailers, or even internal company departments. They also craft fake websites and domains that closely mimic the real ones, sometimes with only a tiny difference in the URL (like using a “1” instead of an “l”). All it takes is one wrong click on a fake link to land on a malicious site that steals login credentials, credit card numbers, or other sensitive information. The sophistication of spoofing techniques makes it harder than ever to spot a phishing attempt at a glance.

Other Common Characteristics

A few more patterns show up again and again across phishing attempts:

• Unexpected attachments: Attachments that arrive without prior context or explanation.
• Brand impersonation: Messages that closely copy the logos, colors, and tone of a well-known company.
• Fake login pages: Pages designed to capture credentials the moment they’re entered.
• Generic greetings: Greetings like “Dear Customer” instead of your actual name.
• Requests for sensitive information: Requests for information that a legitimate organization would never ask for over email or text.

Phishing Indicators Checklist

• Unexpected attachments: Attachments that arrive without prior context or explanation.
• Brand impersonation: Messages that closely copy the logos, colors, and tone of a well-known company.
• Fake login pages: Pages designed to capture credentials the moment they’re entered.
• Generic greetings: Greetings like “Dear Customer” instead of your actual name.
• Requests for sensitive information: Requests for information that a legitimate organization would never ask for over email or text.

Emerging and Advanced Phishing Techniques

As cybersecurity gets better, phishing cybercrime gets smarter.

Deepfake Phishing (AI-generated Video/Audio)

Imagine getting a video call from your boss asking you to wire money, but it’s actually a deepfake. Attackers are now using AI to create convincing fake videos and audio recordings.

QR Code Phishing (Quishing)

People trust QR codes, but malicious QR codes can lead you straight to phishing websites. Scammers leave fake codes on posters, restaurant menus, and even parking meters.

AI-powered Chatbot Phishing

Fake customer support chatbots are another emerging threat. You think you’re chatting with your bank, but you’re actually giving sensitive info to an AI-controlled phishing bot.

Multi-vector Phishing

Attackers are no longer sticking to one channel. They might send an email, follow up with a text, and then message you on LinkedIn, all to build trust and make the scam more believable.

Browser-in-the-Browser (BitB) Attacks

BitB attacks fake an entire browser login popup window inside a webpage, mimicking a familiar sign-in prompt (like a Google or Microsoft login) so convincingly that users type their credentials directly into the attacker’s page.

OAuth Consent Phishing

Instead of stealing a password, attackers trick users into granting a malicious app permission through a legitimate-looking OAuth consent screen, gaining ongoing access to email or files without ever needing a login.

MFA Fatigue Phishing

Attackers who already have a stolen password bombard a user with repeated MFA push notifications until, out of frustration or confusion, the user approves one, letting the attacker in.

AI-generated Personalized Phishing Emails

Generative AI now lets attackers produce highly personalized, error-free phishing emails at scale, pulling in real details scraped from social media or previous breaches to make the message feel authentic.

Spotting phishing attacks isn’t always easy, but there are telltale signs to watch out for.

Spelling and Grammar Errors

While phishing emails are getting better, many still contain odd wording, typos, or grammar mistakes that a legitimate organisation wouldn’t tolerate.

Unexpected Requests for Personal Information

Legitimate organisations almost never ask for passwords, PINs, or sensitive data over email or text.

Hovering Over Suspicious Links

Always hover your mouse over a link before clicking. If the URL looks strange or doesn’t match the supposed sender, it’s probably a phishing attempt.

Unusual Sender Addresses

Look carefully at email addresses. A small variation, like “paypa1.com” instead of “paypal.com”, is a classic sign of phishing cybercrime.

Additional Warning Signs

• Suspicious attachments: Attachments you weren’t expecting, especially with unusual file extensions.
• Fake login pages: Pages that look almost right but load slowly or have small visual glitches.
• Urgent payment requests: Requests asking you to skip normal approval steps.
• Requests to bypass normal procedures: Requests to approve something “off the books” just this once.

Quick-Reference Checklist: Is This Message Phishing?

• Does the sender address exactly match the real organization?
• Does the link destination match what’s expected when you hover over it?
• Is there unnecessary urgency or pressure to act fast?
• Is the message asking for information it shouldn’t need?
• Would the real organization normally contact you this way?

Tools and Techniques to Prevent Phishing

A proactive defence strategy is key to protecting yourself from different types of phishing attacks.

Email Filtering and Spam Blockers

Good email filters can catch a lot of phishing attempts before they ever reach your inbox.

Multi-Factor Authentication (MFA)

Even if an attacker gets your password, MFA can block them by requiring a second form of verification, like a text code or an authentication app.

Anti-Phishing Browser Extensions

Several tools can warn you when you’re about to visit a known phishing site, adding an extra layer of security.

Security Awareness Training

Education is one of the most powerful defences. Companies that regularly train employees about phishing attacks see fewer incidents.

Password Managers

Password managers only autofill credentials on the correct, saved domain, which means they simply won’t fill in a login form on a lookalike phishing site, a quiet but effective safeguard.

DNS Filtering

DNS filtering blocks connections to known malicious domains at the network level, stopping a user from ever reaching a phishing or pharming site, even if they click the link.

Secure Email Gateway (SEG)

A Secure Email Gateway inspects inbound and outbound email for malicious links, attachments, and spoofing patterns before messages ever land in an employee’s inbox.

Endpoint Detection and Response (EDR)

EDR tools monitor devices for suspicious behavior after a phishing link is clicked, helping catch malware execution or credential theft that slips past the initial filters.

Zero Trust Security

A Zero Trust approach assumes no login should be trusted by default, pairing strong authentication with continuous verification, so a single phished credential is far less likely to grant broad access.

These layered defenses reflect guidance from CISA, NIST, and the OWASP Phishing Prevention Cheat Sheet, all of which recommend combining technical controls with ongoing user education rather than relying on any single safeguard.

What to Do If You Fall for a Phishing Scam

Even the most careful person can slip up. If you think you’ve been phished, act fast.

• Disconnect compromised devices from the network: Stop any malware or ongoing data theft immediately.
• Take immediate action on the affected account: Run a virus scan and note exactly what information was shared.
• Enable MFA immediately: Enable multi-factor authentication on any account that doesn’t already have it, especially if a password may have been exposed.
• Change passwords and check for breaches: Use strong, unique passwords and tools like HaveIBeenPwned to check for exposure.
• Report to IT/security teams: If you’re at work, report the incident right away so the security team can take steps to limit the damage.
• Report the phishing email to the email provider: This helps improve filtering for others and may aid any investigation.
• Monitor financial and online accounts: Closely monitor accounts over the following weeks for any signs of unauthorized activity.

Real-World Examples of Phishing Attacks

Phishing attacks show up in familiar, everyday scenarios, often close enough to the real thing to catch even careful users off guard.

Fake Microsoft 365 Login Page

Attackers replicate the Microsoft 365 login screen almost exactly, sending links via email that redirect users to the fake page, capturing usernames and passwords the moment they’re entered.

Banking Impersonation Email

A message designed to look like it’s from a major bank warns of suspicious account activity, urging the recipient to “verify” their identity through a link that leads to a credential-harvesting site.

Fake Courier Delivery SMS

A text claiming a package couldn’t be delivered asks the recipient to click a link and pay a small fee, leading to a fake payment page that captures card details.

CEO Impersonation Email (BEC)

An email appearing to come from a company’s CEO asks an employee in finance to process an urgent, confidential wire transfer, relying entirely on authority and urgency rather than any malicious link.

QR Code Phishing Campaign

A fake QR code placed over a legitimate one on a parking meter or poster redirects scanners to a malicious site that prompts them to enter payment or login details.

Phishing is the best-known social engineering attack, but it’s part of a broader family of tactics that all rely on manipulating people rather than breaking through technical defenses. Smishing and vishing are really just phishing delivered over text and phone calls instead of email. Pretexting relies on a fabricated scenario, like posing as IT support, to build trust before asking for information. Baiting dangles something enticing, a free download or a “found” USB drive, to lure a victim into compromising themselves. Business Email Compromise (BEC) blends several of these techniques together, using impersonation and authority rather than a malicious link at all. Understanding how these attacks differ helps in choosing the right defenses for each.