What Is Phishing? How to Spot and Stop It (2026)

You get a text: "Your parcel is held - confirm your details here." Or an email that looks exactly like your bank, warning your account will be locked. That's phishing - and it's the most common way ordinary people get their accounts and money stolen in 2026. It doesn't break encryption or guess passwords; it tricks you into handing them over. This guide explains what phishing is, the types to recognise, how to spot it, and the defences that actually work.

Phishing is the best-known branch of social engineering.

Phishing isn't the only silent threat - a keylogger records what you type.

What phishing is

Phishing is a social-engineering attack: a scammer impersonates someone you trust to trick you into revealing credentials or data, or installing malware. It usually arrives as a message that manufactures urgency ("act now or lose access") and pushes you toward a fake login page or a reply with personal details.

The attack targets human judgement, not technology. That's why it works against even strong passwords - you're persuaded to type them into the attacker's page yourself.

The main types

• Email phishing - the classic mass campaign.
• Spear phishing - personalised to a specific target, far more convincing.
• Whaling - aimed at executives.
• Smishing - by SMS/text; vishing - by voice call (fake "support" or "bank").
• Clone phishing - copies a real message but swaps in a malicious link.

All share one goal: get you to act before you verify.

How to spot it

• Urgency or threats - "your account will be closed."
• A sender address that's subtly wrong - look closely at the domain.
• Mismatched links - hover to see the real destination; it won't match the claimed site.
• Requests for passwords or codes - legitimate services never ask.
• Generic greetings and unexpected attachments.

On mobile, links are harder to inspect - be extra careful. When unsure, don't click: type the address yourself or use the official app.

A phishing message, dissected

Picture a text: "NETFLIX: Your payment failed. Update your card within 24h or your account will be suspended: netflix-billing-secure.com/verify". Four red flags are stacked in one line:

• Manufactured urgency - "within 24h… suspended" pushes you to act before thinking.
• A look-alike domain - netflix-billing-secure.com is not netflix.com; the real brand is only a prefix. Attackers love subdomains and hyphens (paypal.account-verify.io) because the trusted word still appears.
• An unexpected channel - a real billing issue shows up in the app, not a random SMS link.
• A request to "update" payment via the link - legitimate services tell you to log in normally, never through a texted URL.

Train yourself to read the domain right-to-left: the true site is the part just before the first single slash (here, netflix-billing-secure.com), not whatever brand name appears earlier in the URL.

How to stop it

• Never click links in unexpected messages. Navigate to sites directly.
• Turn on two-factor authentication so a stolen password alone isn't enough - and prefer phishing-resistant factors.
• Use a password manager. It only autofills on the genuine domain; if it refuses to fill, the site is probably fake - a built-in warning. (See why password managers are safe.)
• Verify "urgent" requests through a separate, trusted channel.

What to do if you already clicked

Falling for a phish isn't the end - speed limits the damage. If you entered credentials on a fake page:

1. Change that password immediately, on the real site, and anywhere you reused it. Reuse is what turns one phish into many compromised accounts.
2. Check 2FA on the affected account: confirm no unknown second factor or recovery email was added, and sign out all active sessions.
3. Watch for the follow-up. Attackers often chain a phish with a fake "support" call (vishing) to extract your 2FA code - never read a code aloud to anyone.
4. If it was a work account, tell IT now. Early reporting limits a breach far more than hiding the mistake.
5. If you entered card details, contact your bank to freeze or reissue the card and watch statements.

The faster you rotate the password and revoke sessions, the smaller the window an attacker has - see what to do if an account is hacked for the full checklist.

Why passkeys and managers are phishing-resistant

Both bind to the real domain. A password manager autofills only on the exact legitimate site, so a look-alike page gets nothing. Passkeys and hardware keys (FIDO2/WebAuthn) go further: the login is cryptographically tied to the real site's origin, so even if you land on a fake page, it won't authenticate. That origin-binding is the real defence - see our best authenticator app guide, and if you think you've already been caught, what to do if an account is hacked.

The bottom line

Phishing tricks you into giving up credentials through fake messages and login pages - it beats strong passwords because it targets you, not your encryption. Spot it by its urgency, wrong sender and mismatched links; stop it by never clicking unexpected links, enabling phishing-resistant 2FA, and letting a password manager refuse to autofill on fakes. The habit of verifying before you act is the whole defence.

Editorial guide based on documented phishing techniques (email/spear/smishing/vishing) and standard defences (2FA, passkeys, password-manager domain-binding). Commercial links carry the rel="sponsored nofollow" attribute; an affiliate commission may apply at no extra cost to you.