How to Recognize and Avoid Phishing Attacks

Phishing is the single most common cyber attack method. In 2025, the FBI's Internet Crime Complaint Center received over 300,000 phishing complaints, with losses exceeding $12 billion. Behind every phishing attack is a simple premise: trick you into giving up something valuable.

The good news? Phishing attacks follow predictable patterns. Once you know what to look for, most are easy to spot. This guide will train your eyes to catch them.

What Is Phishing?

Phishing is a form of social engineering where attackers impersonate legitimate organizations — banks, tech companies, government agencies, or even your colleagues — to trick you into revealing sensitive information or performing actions that compromise your security.

The name comes from "fishing" — attackers cast a wide net and see who bites. Modern phishing has evolved far beyond the obvious "Nigerian prince" emails of the past. Today's phishing attacks are sophisticated, targeted, and often nearly indistinguishable from legitimate communications.

Types of Phishing Attacks

Red Flags: How to Spot a Phishing Attempt

1. Urgency and Fear Tactics

Phishing emails almost always create a sense of urgency:

• "Your account will be suspended in 24 hours!"
• "Unauthorized login detected — verify immediately!"
• "Final notice: your payment has failed"

Why it works: Urgency bypasses your critical thinking. Attackers want you to act fast before you stop to think.

2. Generic or Mismatched Greetings

Legitimate organizations usually address you by name. Phishing emails often use:

• "Dear Customer"
• "Dear Account Holder"
• Your email address instead of your name

3. Suspicious Sender Addresses

Always check the actual email address, not just the display name:

4. Mismatched or Suspicious Links

Before clicking any link, hover over it to see the actual URL. Look for:

• Misspelled domains: amaz0n.com instead of amazon.com
• Extra subdomains: paypal.secure-login.fake-site.com (the real domain is fake-site.com)
• URL shorteners: bit.ly/xxx — you can't see where it leads
• HTTP instead of HTTPS on login pages

5. Spelling and Grammar Errors

While some phishing emails are well-written, many contain obvious errors:

• Awkward phrasing or unnatural language
• Spelling mistakes in the body text
• Inconsistent formatting or branding

6. Unexpected Attachments

Never open attachments from unexpected emails, even if they appear to come from someone you know. Common malicious attachment types:

• .exe, .scr, .bat — executable files
• .zip, .rar — archives that may contain malware
• .docm, .xlsm — Office files with macros
• .pdf — can contain malicious links or scripts

7. Requests for Sensitive Information

Legitimate organizations never ask for:

• Passwords via email
• Social Security numbers
• Credit card details via email or text
• Bank account information

Anatomy of a Phishing Email

Let's break down a common phishing email:

Red flags in this example:

1. Generic greeting ("Dear Customer")
2. Fake sender domain (not netflix.com)
3. Urgency ("24 hours")
4. Link goes to a completely different domain
5. Asks for billing information via email link

How to Protect Yourself from Phishing

Immediate Actions

1. Pause before clicking — If an email creates urgency, that's a red flag. Take a breath.
2. Verify the sender — Check the actual email address, not just the display name.
3. Hover over links — See where they actually go before clicking.
4. Navigate directly — Instead of clicking a link, go to the website directly by typing the URL.
5. Contact the organization — If unsure, call or message the company through their official channels.

Long-Term Protection

• Enable 2FA — Even if your password is stolen, 2FA can block the attacker
• Use a password manager — It won't auto-fill on fake sites, alerting you to phishing
• Install email filtering — Services like Gmail's spam filters catch most phishing
• Keep software updated — Browsers and email clients have built-in phishing protection
• Educate yourself regularly — Phishing tactics evolve; stay informed

What to Do If You Fell for a Phishing Attack

If you've already clicked a phishing link or entered information, act immediately:

1. Change your passwords — Start with the compromised account, then any account using the same password
2. Enable 2FA — If it wasn't already enabled
3. Run a full antivirus scan — If you downloaded anything or clicked a suspicious link
4. Monitor your accounts — Watch for unauthorized transactions or activity
5. Report the phishing — Forward the email to phishing@us-cert.gov (US) or your country's equivalent
6. Place a fraud alert — Contact credit bureaus if financial information was exposed
7. Report to the impersonated company — Most companies have a dedicated phishing reporting channel

Frequently Asked Questions

Conclusion

Phishing attacks are everywhere, but they're predictable. By learning to recognize the red flags — urgency, suspicious senders, mismatched links, and requests for sensitive information — you can protect yourself from the vast majority of phishing attempts.

The single most effective habit: pause before you click. That moment of hesitation is often enough to spot a phishing attempt and protect yourself.