Phishing Explained: How the Internet's #1 Attack Works, and How to Stop It

Of every kind of online crime reported to the FBI last year, one was reported more than any other, by a wide margin: phishing. It is the oldest trick on the internet and still the most effective, the single most common way a data breach begins. And it has quietly evolved. The clumsy "Dear customer" email full of typos has given way to flawless AI-written messages, fake login pages that defeat two-factor authentication, malicious QR codes, and video calls where the boss asking you to wire money is a deepfake. This is how phishing actually works in 2026, every form it now takes, and the defenses that genuinely stop it.

What phishing actually is

Phishing is social engineering by impersonation. An attacker pretends to be someone you trust, a bank, an employer, a delivery company, a colleague, to trick you into handing over something valuable: a password, a one-time code, a payment, or simply a click that installs malware. The United States cyber agency, CISA, defines it as using email or malicious websites to solicit personal information by posing as a trustworthy organisation.

What makes phishing so durable is that it targets people, not machines. You can patch a server, but you cannot patch the human instinct to obey an urgent message from the boss. That is why, even with modern defenses, the human element is involved in roughly 60 percent of all breaches, according to Verizon's 2025 Data Breach Investigations Report.

The anatomy of a phishing attack

However sophisticated, almost every phishing attack runs the same four-beat play. Spotting any one stage is a chance to stop it.

1. The lure. A message designed to provoke action: a security alert, a failed payment, an unpaid toll, a shared document. It impersonates a brand or person you trust and manufactures urgency so you act before you think.
2. The hook. A link to a spoofed login page that looks pixel-perfect, or a malicious attachment or QR code. The fake page exists for one reason: to capture what you type.
3. The capture. You enter your username, password, and often your one-time code, and the attacker harvests them in real time, or the attachment quietly installs malware.
4. The exploitation. With your credentials or access, the attacker drains an account, wires money, steals data, or uses your inbox to phish the next victim. Speed is everything: stolen access is often used within minutes.

The many faces of phishing

"Phishing" is an umbrella. The lure is the same; the channel and the targeting change. These are the forms you will actually meet.

Phishing by the numbers

The data tells a consistent story: phishing is both the most common attack and a rising one, even as defenses improve.

One older but striking finding from Verizon's 2024 research still frames the danger: the median time for a person to click a phishing link was about 21 seconds, and under a minute to then hand over their data. Phishing wins on speed and habit, not on technical genius.

How modern phishing beats two-factor login

For years the advice was simple: turn on two-factor authentication and a stolen password is useless. Attackers adapted. The technique now is called adversary-in-the-middle, and it is why not all multi-factor authentication is equal.

The fake login page is no longer just a look-alike. It is a live relay sitting between you and the real website. When you type your password and then approve the genuine two-factor prompt, the relay passes it all to the real site and quietly steals the resulting session cookie, the token that proves you are logged in. Replaying that cookie logs the attacker in as you, no code required. Crucially, this is not a flaw in two-factor itself; the token is stolen after you authenticate.

This capability is now rented as a service. Kits such as Tycoon 2FA, EvilProxy, Mamba 2FA and Sneaky 2FA let low-skill criminals run these attacks at scale, with Tycoon 2FA alone dominating in early 2025 before a March 2026 takedown. The defense is the same token theft cannot beat: phishing-resistant MFA such as passkeys and security keys, which are cryptographically bound to the real website and simply will not work on a fake one.

The AI upgrade

Generative AI removed phishing's biggest tell. The broken English and clumsy formatting that once gave scams away are gone; AI now writes flawless, personalised lures in any language in minutes. IBM found generative AI cut the time to craft a convincing phishing email from about 16 hours to roughly 5 minutes, and that one in six breaches now involve attackers using AI, most often for phishing.

It goes beyond text. Attackers clone a voice from a few seconds of audio to power AI voice-cloning scams, and stitch together video deepfakes for high-value fraud. The landmark case remains the engineering firm Arup, where in 2024 a finance worker paid out about 25.6 million US dollars after a video call in which the chief financial officer and colleagues were all AI-generated fakes. For the wider picture, see the deepfake fraud economy.

Phishing in the wild

These verified cases show how phishing drives real-world losses, from rented attack kits to voice-phished corporations.

How to spot a phish

The lures share a handful of tells. Learn these and you will catch the overwhelming majority.

1. Manufactured urgency or fear. "Your account will be suspended," "payment failed," "act now." Panic is the whole point.
2. A sender address that does not match. The display name says your bank; the actual email domain does not. On a phone, tap the sender to reveal the real address.
3. Generic greetings. "Dear customer" instead of your name often means a mass send.
4. Links that do not go where they claim. Hover on a computer, or long-press on a phone, to preview the real destination before tapping.
5. Any request for a password, one-time code or payment. Legitimate organisations never ask for your OTP. Ever.
6. Unexpected attachments or QR codes. Especially invoices, "voicemails," or a code you did not ask for.

Defenses that actually work

No single product stops phishing. A few layers, together, make you a hard target.

1. Use phishing-resistant MFA. Passkeys and security keys (the FIDO2 standard) are bound to the real website and cannot be relayed by a fake one. CISA calls them the only widely available phishing-resistant option.
2. Treat SMS codes as the weak option. One-time codes by text can be intercepted or relayed. Prefer an authenticator app, and a passkey wherever you can.
3. Let a password manager guard you. It only fills your login on the genuine domain, so a look-alike site gets nothing, and that silence is itself a warning.
4. Lock down your email domain. SPF, DKIM and DMARC are DNS settings that stop criminals spoofing your organisation to others.
5. Train people and make reporting one click. A report-phishing button beats a memo; trained staff catch and report far more.
6. Keep devices and browsers updated. Many lures rely on an unpatched flaw to land their payload.

How to report phishing

Reporting is fast, free, and genuinely helps shut attacks down.

If you have already clicked

Do not panic, but move quickly and in order.

1. Change the password now, from a different, clean device, on that account and anywhere you reused it.
2. Turn on MFA, ideally a passkey, on the affected accounts.
3. Call your bank if you entered card or account details, and ask them to watch or freeze the account.
4. Report it using the channels above. In the US you can also file at reportfraud.ftc.gov.
5. Watch for the second wave. Victims are frequently targeted again by fake "recovery" services promising to get the money back for a fee.

Watch: how phishing works

A two-minute primer on the mechanics, from IBM.

Frequently asked questions

What is the difference between phishing and spear phishing? Ordinary phishing is a mass, untargeted net. Spear phishing is aimed at one specific person using real details about them, which makes it far more convincing and dangerous.

Can phishing get past two-factor authentication? Yes. Adversary-in-the-middle attacks relay your login in real time and steal the session token after you approve the prompt. Phishing-resistant methods like passkeys and security keys defeat this; SMS codes do not.

What is quishing? Phishing that uses a QR code. The malicious link is hidden inside the image, which helps it slip past filters and pushes you onto your phone, where warning signs are harder to see.

Is AI making phishing worse? Yes. It removes the bad grammar that used to give scams away, writes personalised lures in seconds, and powers voice and video deepfakes. The defenses, however, are unchanged: verify independently, and use phishing-resistant MFA.

I clicked a link but did not enter anything. Am I safe? Usually, if you entered no credentials and no download ran. To be safe, close the page, do not enter anything, run a security scan, and change the password for the impersonated account from a clean device.

Sources

• FBI IC3 2025 Internet Crime Report (phishing #1 complaint type)
• Verizon 2025 Data Breach Investigations Report
• IBM Cost of a Data Breach Report 2025
• APWG Phishing Activity Trends Report, Q2 2025 (PDF)
• Microsoft Security, inside the Tycoon 2FA AiTM phishing kit
• SecurityWeek, Tycoon 2FA takedown and the surge in AiTM kits
• CISA, Implementing Phishing-Resistant MFA (PDF)
• CISA, Recognize and Report Phishing
• CNN, Arup confirmed as victim of the 25 million dollar deepfake scam
• KnowBe4 2025, training cuts phishing click rates by 86%
• NCSC UK, report a scam email