Phishing Attacks: Types, Warning Signs & How to Prevent Them

Hero Summary

Phishing is a social-engineering attack in which an attacker impersonates a trusted person or organization to trick someone into revealing credentials, approving a payment, or opening malware. It is the most-reported cybercrime type to the FBI: in 2025, the FBI's Internet Crime Complaint Center (IC3) recorded 191,561 phishing and spoofing complaints, more than any other crime category. This guide explains the main types of phishing, the warning signs, and the layered controls that reduce the risk.

Executive Summary

Phishing works because it targets people rather than software. A message that looks like it came from a bank, a colleague, a vendor, or an executive only has to persuade one employee to act. This guide covers what phishing is, the main attack types (email phishing, spear phishing, whaling, smishing, vishing, QR-code phishing, and physical and social-media variants), the warning signs that give an attack away, and the layered controls — awareness training with simulation, multi-factor authentication, email authentication, filtering, and a reporting habit — that reduce both the chance and the impact of a successful attack.

What is a phishing attack? {#what-is-phishing}

A phishing attack is a deceptive message — usually an email, text message, phone call, or web page — designed to make the recipient take an action that benefits the attacker: entering a password on a fake login page, opening a malicious attachment, approving a fraudulent payment, or sharing sensitive information. The attacker relies on trust and urgency rather than a technical vulnerability, which is why phishing remains effective even in organizations with strong perimeter defenses.

How common is phishing? {#how-common}

Phishing and spoofing was the most-reported crime type in the FBI IC3's 2025 Internet Crime Report, with 191,561 complaints and $215,843,126 in reported losses. The same report shows 193,407 complaints in 2024 and 298,878 in 2023, so the volume remains high even as individual campaigns change. Phishing is also the front door to larger incidents: business email compromise, one of the costliest cyber-enabled fraud types in the same report, typically begins with a convincing message or a compromised mailbox. See Business Email Compromise for that threat in detail.

Types of phishing attacks {#types}

Type	Channel	How it works
Email phishing	Email	A broad message impersonating a brand or service, usually with a link to a fake login page or a malicious attachment
Spear phishing	Email	A targeted message that uses details about the recipient — name, role, colleagues, current projects — to look credible
Whaling	Email	Spear phishing aimed at senior executives, or impersonating them to pressure staff into urgent action
Smishing	SMS / messaging apps	A text message with a link or instruction, often using shortened URLs to hide the destination
Vishing	Phone call	A caller impersonates a bank, help desk, vendor, or colleague and talks the victim into revealing information or taking an action
QR-code phishing ("quishing")	Printed or on-screen QR code	A QR code that opens a malicious site, bypassing link scanning because the URL is hidden inside an image
Clone phishing	Email	A legitimate, previously delivered message is copied and resent with a malicious link or attachment swapped in
Removable-media baiting	Physical	An infected USB drive is left where an employee will plug it in
Social-media phishing	Social platforms	Fake offers, surveys, or friend requests used to harvest information or deliver links

The channel changes, but the pattern is constant: impersonate someone trusted, create urgency, and get a person to act before they verify.

Warning signs of a phishing message {#warning-signs}

• Unexpected urgency or pressure — "act within the hour," threats of account closure, or a request to bypass the normal process.
• A mismatch between the display name and the real sender address, or a domain that is one character off from the genuine one.
• Links whose destination differs from the visible text — hovering over a link on desktop shows where it really goes.
• Requests for credentials, one-time codes, or payment changes by email, text, or phone.
• Unusual attachments, especially from a sender who does not normally send them.
• A change of bank details from a known vendor, delivered by message rather than through your normal verification process.
• Generic greetings combined with specific demands, or the opposite: unusually specific details that suggest the sender researched the target.

A useful rule for employees: if a message asks for credentials, money, or sensitive data, verify it through a second channel you already trust — not by replying to the message.

How organizations prevent phishing {#prevention}

No single control stops phishing, because the attack succeeds when a person acts. Effective programs combine layers so that one failure does not become an incident:

• Security awareness training with realistic simulation — so employees recognize current attack styles and know exactly what to do with a suspicious message.
• Multi-factor authentication, ideally phishing-resistant — so a stolen password alone does not give access. See Email Account Security Beyond Passwords.
• Email authentication (SPF, DKIM, DMARC) — to make it harder for attackers to spoof your own domain against your customers and staff. See DMARC, SPF & DKIM Explained.
• Email and web filtering — to block known-bad messages, attachments, and destinations before a person sees them.
• A simple reporting path — one click or one address to report a suspicious message, with fast feedback so people keep using it.
• Patching and endpoint protection — to limit the damage if a malicious attachment or link is opened.
• Monitoring for lookalike domains — attackers often register domains that resemble a real brand to host phishing pages. See What Is Domain Security?.

Why simulation matters {#simulation}

Reading about phishing and recognizing it under pressure are different skills. Phishing simulation sends employees safe, realistic test messages and measures who reports, who clicks, and who enters data, so training can focus on the people and the attack styles where risk is highest. Simulation across more than one channel — email, SMS, and voice — reflects how attackers actually operate, since smishing and vishing bypass email filters entirely.

How Threat ResQ's TRISA and TRAP fit {#trisa-trap}

TRISA is Threat ResQ's AI security awareness and human risk intelligence platform. Its AI mentor assesses each employee's Cyber Knowledge Quotient (CKQ) and adapts the training path to that person's gaps, with continuous readiness scoring and department-level and board-level reporting.

TRAP is the phishing simulation capability within TRISA. It combines interactive training with continuous phishing, smishing, and vishing simulation, and its simulation results feed TRISA's readiness scoring. TRAP's published capabilities include 1,000+ phishing templates across 130+ languages and SIEM integration, with cloud or on-premises deployment.

For organizations that want a facilitated, human-led session alongside the platform, Threat ResQ's Security Awareness Services provide that layer.

FAQ {#faq}

What is the difference between phishing and spear phishing? Phishing is usually a broad message sent to many recipients that impersonates a well-known brand or service. Spear phishing is targeted: the message uses details about the specific recipient — their role, colleagues, or projects — to appear credible.

What are smishing and vishing? Smishing is phishing delivered by text message or messaging app. Vishing is phishing delivered by phone call, where the caller impersonates a bank, help desk, vendor, or colleague. Both bypass email filters, which is why training and simulation should cover more than email.

How can I tell if an email is a phishing attempt? Look for unexpected urgency, a sender address that does not match the display name, links whose real destination differs from the visible text, and requests for credentials, codes, or payment changes. When in doubt, verify through a separate channel you already trust rather than replying.

Does multi-factor authentication stop phishing? It reduces the damage of a stolen password, but not all MFA is equally resistant. Phishing-resistant methods such as FIDO/WebAuthn are stronger than SMS codes, which attackers can sometimes intercept or trick users into sharing.

How often should employees be trained on phishing? Phishing tactics change continuously, so awareness works best as an ongoing program with regular simulation rather than a single annual session.