What is phishing? A plain-English guide
What phishing is, the forms it takes, and the habits that stop it, without the jargon.
ยท Phishing
Phishing is a message that pretends to come from someone you trust so that you'll do something you otherwise wouldn't: click a link, open an attachment, sign in on a fake page, or send money.
It works because it targets people rather than systems. A firewall can't tell that "your CEO" is really a stranger with a lookalike domain.
The common forms
- Email phishing: the classic. A message that looks like it's from IT, a supplier, a bank or a delivery company.
- Spear phishing: a targeted email that uses details about you or your role to seem legitimate.
- Business email compromise (BEC): an attacker impersonates (or takes over) a real colleague or supplier's mailbox to redirect payments.
- Smishing and vishing: the same trick by text message or phone call.
- QR-code phishing: a code in an email or poster that leads to a fake sign-in page, often opened on a phone with weaker protection.
Why it keeps working
Phishing doesn't need a technical flaw. It needs one busy person on one bad day. Attackers lean on urgency ("today"), authority ("the CFO asked"), and routine ("your invoice is attached") because those are exactly the moments people act without checking.
What actually helps
- Slow down on anything urgent. Urgency is the attacker's favourite tool.
- Check the sender's real address, not just the display name.
- Hover before you click, and type known addresses yourself instead of following links.
- Verify payment changes by phone using a number you already have.
- Report, don't just delete. One report can protect everyone else who got the same message.
Regular, realistic practice turns these from rules people know into habits they follow. That's what phishing simulations are for: a safe place to make the mistake before it costs anything.