What phishing actually is

Phishing is a form of social engineering in which an attacker impersonates a trusted person or organization — your bank, your IT department, a shipping carrier, a supplier, or even a colleague — in order to trick you into handing over credentials, money, or access. It is not fundamentally a technical attack against your computer; it is a psychological attack against your judgment, delivered through a technical channel.

Email remains the most common delivery method because it is cheap to send at scale and easy to make convincing, but phishing is no longer confined to the inbox. Attackers now routinely use text messages (smishing), voice calls (vishing), and messaging apps such as WhatsApp or Teams to reach the same goal: get you to act before you think.

The old stereotype of phishing — broken English, mismatched logos, a prince offering an inheritance — describes an attack style that has largely disappeared. Today's campaigns use real corporate branding lifted directly from the target's own website, cloned login pages that are near pixel-perfect copies of the real thing, and narratives built around plausible, time-pressured business events: an invoice that is suddenly overdue, a password that has 'expired,' a shipment stuck in customs, or an executive who urgently needs a favor.

Because visual cues have become unreliable, spotting a spelling mistake or a slightly-off logo is no longer a dependable defense. What still works reliably is recognizing the underlying pattern: a message that manufactures urgency or fear, and in the same breath asks you to hand over a credential, a one-time code, a payment, or access to a system. That combination — pressure plus a request — is the real signature of phishing, regardless of how polished the message looks.

• Treat urgency as a signal to slow down, not to speed up.
• Separate the channel (how convincing it looks) from the request (what it is actually asking you to do).
• When in doubt, verify through a channel you initiated yourself — call the bank using the number on your card, not the number in the message.