What is phishing? How to recognize a fake message

Phishing is a scam in which a message pretends to come from someone you trust, such as a bank, a delivery company, an employer or a friend, to trick you into giving away a password, a payment or personal details, or into opening something harmful. It arrives by email, text, phone call, social media or even a QR code. It works on people, not on computers, which is why spotting it is a skill anyone can learn.

In short

• Phishing is impersonation plus a push: a message that borrows a trusted name and hurries you into acting.
• Its forms differ by channel and target: email, texts (smishing), calls (vishing), QR codes, and messages tailored to one person (spear phishing).
• The surest defense is to never act through the message itself: go to the company by a route you already know.

Where does the word come from?

Phishing is "fishing" for passwords, with a spelling borrowed from "phreaking", the older hobby of hacking telephone networks. The scam grew up on AOL, then the largest online service in the US, in the mid-1990s: people posed as AOL staff in chat messages and asked members for their passwords, and the term was in print by 1997, according to Wikipedia's history of phishing. Thirty years on, the trick is the same and the scale is not. The Anti-Phishing Working Group, an industry body that tracks it, observed 1,003,924 phishing attacks in the first three months of 2025 alone.

It is also the most reported online crime in the United States. In its 2025 Internet Crime Report, the FBI's Internet Crime Complaint Center counted 191,561 complaints of phishing and spoofing, more than any other kind among roughly a million complaints. The direct losses filed under phishing were modest, about $216 million, because phishing is usually the way in, not the theft itself: the money is lost later, through business email fraud, fake investments or a drained account.

What kinds of phishing are there?

Name	How it arrives	What's different about it
Phishing	Email	Sent to many people at once, hoping a few bite
Spear phishing	Email or message	Tailored to one person or team, using real names, roles or recent events
Whaling	Email	Spear phishing aimed at senior executives
Business email compromise	Email from a real or lookalike account	Poses as a boss or supplier and asks for a payment or a change of bank details
Smishing	Text message	A short link, often about a parcel, a toll or an account problem
Vishing	Phone call	A live voice or a recording, often claiming to be your bank's fraud team
Quishing	QR code	A code on a poster, parking meter or email that opens a fake site; [[how-do-qr-codes-work

Phishing is one of the main ways into accounts and companies, alongside stolen passwords and unpatched software, which the note on hacking sets out. It differs from long-con fraud such as a pig butchering scam, which builds a relationship over weeks before asking for money; phishing usually wants you to act within minutes.

What does a fake message look like?

Every phishing message has the same parts, and each part leaves clues. Take an imaginary email from "Northwind Bank", a made-up name:

Part of the message	What the fake does	What to check
Sender	Shows a display name like "Northwind Security"	The actual address behind the name, and whether its domain is the bank's real one
Subject	Creates urgency: an account locked, a payment failed, a sign-in from a new device	Real companies rarely threaten a deadline of hours
Greeting	Often generic, "Dear customer", though tailored attacks use your name	A name proves little: names leak easily
Story	Something needs fixing, refunding or confirming	Whether you were expecting anything of the kind
Link or button	Shows trusted words but points somewhere else	Where the link really goes, before you tap it
The ask	Sign in, confirm your card, read out a code, pay an invoice	Banks and big services don't ask for passwords or one-time codes

Lookalike web addresses are the heart of most fakes, so learn to read one. Who owns a web address is decided by the end of its name, just before the first single slash, not by its beginning. In a made-up address such as northwindbank.com.account-check.example/login, the words "northwindbank.com" come first, but reading back from the slash, the last two pieces are account-check.example: that is the site's owner, and anyone could have registered it. Swapped letters, extra words and hyphens, such as northwind-bank-secure, are other common tricks.

How is AI changing phishing?

The old advice was to look for bad spelling and clumsy grammar. That advice is wearing out. In a December 2024 public warning, the FBI said criminals use generative AI to correct the human errors that used to give scams away, and to translate scams fluently for victims in other countries. AI also makes spear phishing cheap: a tool can write a different, personal message for each of thousands of targets, drawing on what they've posted publicly.

Voice is the next front. Short recordings of someone's voice, from a video or a voicemail, can be enough to clone it, and scammers use cloned voices of relatives or executives to ask for urgent payments; a deepfake video call takes the same idea further. The FBI counted more than 22,000 complaints involving AI in 2025, with reported losses above $893 million. Its suggestion for families is simple: agree a secret word or phrase that a real relative in trouble would know.

How can you spot and stop a phishing attempt?

A short checklist covers most cases:

• Pause at urgency. Pressure to act now, a threat, a prize or a refund is the most reliable sign of all.
• Go around the message. If it claims to be your bank, open the bank's app or type its address yourself, or call the number on your card. The FTC's advice is to contact the company through a phone number or website you know is real, not one in the message.
• Read the real address, of the sender and of any link, before trusting the name on display.
• Never share a one-time code. A code texted to you is the key to your account; nobody legitimate asks you to read it back.
• Check payment changes by phone. A supplier's "new bank details" by email should always be confirmed on a number you already have.
• Turn on multi-factor sign-in, and use passkeys where offered. A passkey only works on the genuine site, so it can't be typed into a fake one.

If you have already clicked or replied, act quickly: change the password from the real site, and on any account that used the same one; tell your bank if you shared card or account details; and run your security software if you opened an attachment. Then report it. Most email apps have a "report phishing" button, and many countries run a national reporting service; in the US the FTC suggests forwarding phishing email to reportphishing@apwg.org and texts to 7726. Reports help get fake sites taken down for everyone. Because email was built without any check on who the sender really is, as how email works explains, filters catch much but never all, and the last check is yours. Phishing will exist for as long as messages cross the internet from strangers.

Check yourself

• Without looking back: which part of a web address tells you who owns the site, and how do you find it?
• Why are phishing losses in crime reports smaller than the damage phishing causes?
• Why has "look for spelling mistakes" become weak advice?

Sources

• How to recognize and avoid phishing scams — Federal Trade Commission, Consumer Advice
• 2025 Internet Crime Report — FBI Internet Crime Complaint Center, 2026
• Criminals use generative artificial intelligence to facilitate financial fraud — FBI Internet Crime Complaint Center, 2024
• Phishing Activity Trends Reports — Anti-Phishing Working Group, 2025
• Phishing — Wikipedia