What phishing is
Phishing is the practice of sending messages that pretend to come from a trustworthy source, such as a bank, a delivery company, an employer or a friend, in order to get you to reveal information, click something or send money. The word is a play on fishing: the sender casts out bait and waits to see who bites. Messages may arrive by email, text, phone call, social media or messaging apps.
The goal is usually one of a few things: capture a password or verification code, get you to install something harmful, or persuade you to make a payment. Notably, it targets the person rather than the technology. That is why even well-protected systems are affected.
Why it works
If phishing were obviously fake, it would not be a problem. It works because it leans on ordinary features of how people think.
Urgency. Messages say an account will be closed, a payment failed, or a package is held. Time pressure encourages quick action and discourages checking. Calm reflection is exactly what the sender does not want.
Authority. A message that appears to come from a boss, a government body or a bank gets compliance more readily, because people are used to following such instructions.
Fear and reward. Threats of loss and promises of a prize both trigger emotional responses that can override careful judgment.
Familiarity and context. Messages that mention something you were really expecting, such as a delivery or a bill, feel natural. Most people receive many routine notifications and act on them without much thought.
Volume and odds. A sender does not need to fool everyone. If a very large number of messages are sent, a small fraction of recipients being busy, tired or distracted at the right moment can be enough. That is why anyone can be caught on some day.
Targeted versions
Some messages are written for a specific person or organization, using details found publicly, such as a job title or a colleague’s name. These are often called spear phishing. They can be much more convincing than mass mailings. A related pattern is the request that appears to come from an executive or a relative asking for urgent money or gift cards. The common thread is a plausible story and a request to act outside normal procedures.
Advances in AI mean messages can now be well written and tailored with little effort, so poor spelling is no longer a reliable sign. Synthetic voices and video, which are explained in the discussion of deepfake technology, add another way to impersonate people. This is part of the broader landscape of advanced cyber threats, but the defenses below remain largely the same.
General warning signs
None of these proves a message is fake, and a genuine message can have some of them. Together they are reasons to slow down.
- It creates pressure to act immediately or threatens consequences.
- It asks for passwords, verification codes, or payment details. Legitimate organizations generally do not ask for a password by message.
- The sender address or link looks slightly off, for example a misspelled name or an unfamiliar domain. On a phone, pressing and holding a link can reveal where it goes before you open it.
- It is unexpected, or it comes from someone you know but with an odd tone or an unusual request.
- It asks for payment in unusual forms, such as gift cards or transfers that are hard to reverse.
- It contains an attachment you were not expecting.
Habits that help
The most reliable defense is to verify through a separate route. Rather than clicking a link or calling a number in the message, open the official app or type the address yourself, or call a number you already trust. If a colleague or family member asks for money or secrets, confirm by calling them directly.
Other helpful measures:
- Use two-factor authentication, so a stolen password alone is not enough. Note that criminals sometimes ask for the code itself, so never share it with anyone who contacts you.
- Use a password manager, which typically fills in credentials only on the correct site and can act as a mild alarm.
- Keep devices and browsers updated, as described in the article on software updates.
- Agree on a family or team routine for confirming unusual payment requests.
If you clicked or replied
Mistakes are common and do not mean you are careless. If you entered a password, change it right away on the real site, and on any other account where you used it. If you shared a verification code or financial details, contact the service or bank promptly. If you installed something, disconnect from the network and seek help from someone qualified or the device maker’s support. Reporting the message to the impersonated organization or your email provider helps others too.
The point of understanding the psychology is not to make you permanently suspicious. It is to notice the moment when a message is trying to rush you, and to treat that moment as the signal to pause.