Phishing Awareness

You're half-focused, coffee in hand, going through your inbox between meetings. An email from "IT Support" says your password expires in two hours. There's a button. You click it.

That's the whole attack, most of the time. No hacking-movie theatrics, just a button and two seconds of not thinking. It works on careful people constantly, because phishing isn't really a tech problem. It's a psychology problem that happens to arrive by email.

Here's what it actually is, why it's so common, and the habits that make you a much harder target.

What Phishing Actually Is

Phishing is a type of social engineering. An attacker pretends to be someone you trust — a bank, a coworker, your own IT department — to get you to hand over information, click a bad link, or send money. The name comes from "fishing": attackers cast bait to a lot of people at once, and they only need a small percentage to bite.

That's the math that makes this profitable. An attacker doesn't need to fool you specifically. They need to fool 1% of 10,000 people, and that's a good day for them.

The Numbers Are Bigger Than People Assume

APWG recorded over 3.8 million phishing attacks worldwide in 2025. Verizon's 2026 Data Breach Investigations Report found that 62% of breaches involve a human element. The FBI's IC3 unit reported $3.05 billion in Business Email Compromise losses in 2025 alone.

The number that matters most, though, comes from KnowBe4: organizations that run regular security training see phishing simulation click rates drop from 33.1% down to 4.1%. That's not a small improvement. Phishing isn't unbeatable — it's just underestimated.

The Different Flavors of Phishing

"Phishing" covers a family of tricks that all lean on the same move: impersonation plus urgency. The common ones:

• Email phishing: mass fraudulent emails impersonating a known brand
• Spear phishing: the same idea, but personalized with your name, job, or a real project
• Whaling: spear phishing aimed at executives
• Smishing: phishing by text message
• Vishing: phishing by phone call, now often boosted with AI voice cloning
• Clone phishing: a copy of a real email you already got, with the link swapped out
• Social media phishing: fake friend requests, DMs, "you've won" links
• Business Email Compromise: impersonating an executive or vendor to redirect a payment
• Quishing: malicious QR codes that skip email filters entirely because the link is hidden inside an image

Different delivery method, same underlying trick.

What a Phishing Email Actually Looks Like

Most phishing emails give themselves away if you slow down for five seconds:

• A sender address that's almost right, like amaz0n-support@amaz0n-secure-verify.com
• A subject line meant to scare you into moving fast
• A generic greeting like "Dear Valued Customer" instead of your name
• Grammar or spelling mistakes a real company wouldn't send
• A link where the visible text doesn't match where it actually goes
• An attachment you didn't ask for
• Any request for your password, PIN, or one-time code

One of these alone might be nothing. Two or three together usually isn't a coincidence.

Fake Websites Use the Same Tricks

• HTTP instead of HTTPS, or no padlock icon
• Typosquatting, like paypa1.com instead of paypal.com
• A subdomain trick, like paypal.security-verify.com, which isn't actually PayPal
• Pop-ups asking for personal information
• URL shorteners that hide the real destination
• A login page asking for way more than a login should require

Worth repeating: the padlock icon does not mean a site is safe. It only means the connection is encrypted. Attackers get valid certificates for fake sites all the time.

Why People Fall For It

Phishing isn't really targeting your inbox. It's targeting a handful of mental shortcuts everyone has. The usual ones, often stacked together:

Authority (I'm your boss, or the IRS), urgency (act in the next ten minutes), fear (your account will be suspended), curiosity (you have to see this), greed (you've won something), sympathy (a disaster relief appeal), scarcity (limited spots), trust (I'm a coworker or a known brand), and impersonation (I am literally someone else).

A common example: an email that looks like your CEO, saying they're stuck in a meeting and need you to buy gift cards right now for a client. That's authority and urgency together, betting you won't stop to call and check.

The Attack That Fooled Almost Everyone

In 2017, a phishing email invited people to "view a Google Doc" shared by someone they knew. The link led to a real Google permissions screen, for a fake third-party app named "Google Docs." Approving it gave the attacker access to the victim's Gmail and contacts, which then sent the same invite to everyone in their address book. It spread in minutes.

What made it work is that none of the usual red flags were there. No fake domain, no fake login page. The attacker used Google's own real infrastructure. The lesson here isn't "check the URL" — it's to be careful with unexpected permission requests, even on platforms you already trust.

What Actually Helps

None of this requires being paranoid about every email. It just takes a few habits:

1. Pause before you click. Urgency is manufactured, not a reason to hurry.
2. Verify through a second channel. If your "boss" asks for something unusual, call them instead of replying to the email.
3. Hover over links before clicking to see where they actually go.
4. Never give out a password, PIN, or MFA code, no matter who's asking.
5. Turn on multi-factor authentication wherever it's available.
6. Use a password manager with unique passwords per site.
7. Keep your software updated.
8. Report suspicious messages instead of just deleting them.

If You've Already Clicked

It happens to careful people too. Speed matters more than embarrassment:

1. Disconnect from the network if you think there's malware involved.
2. Change your passwords from a different, clean device.
3. Turn on or check MFA on the affected accounts.
4. Run a malware scan.
5. Report it to IT or security right away.
6. Keep an eye on your financial accounts.
7. Watch for signs of identity theft.
8. Restore from backups if anything got encrypted or altered.

The biggest mistake usually isn't clicking. It's not telling anyone afterward.

The Point of All This

You're not the weak point in security. You're often the best detection system a company has, because you can notice context a spam filter can't. The goal isn't to be suspicious of every email you get. It's to slow down for the few seconds that the risky ones actually deserve.