Subjects and lessons to explore.

Law

Cybersecurity · Foundations

Phishing

9 min read 5 practice questions
7 key termsSourcesReport an error
Want it in plain words first? Jump to Eli explains — the same idea, no jargon.
On this page 9 sections
  1. In 30 seconds
  2. Why this matters
  3. The college version
  4. Eli explains
  5. Worked example
  6. Key takeaway
  7. Quick check
  8. Study tools
  9. Sources & references

In 30 seconds

is a social attack: fraudulent messages that pose as a trusted person or organization to trick you into revealing information or clicking harmful links. It leans on fake urgency, impersonation, and fake login pages. The common forms are email phishing, (text messages), (phone calls), and (targeted at specific people). If a message pressures you to act fast, don't click, don't reply — report it and verify through a channel you know is real.

Why this matters

Phishing matters because it targets the one thing every account has in common: a person who can be rushed or fooled. Practically, recognizing the red flags protects your money, your accounts, and your identity, and it matters at work, where one phished credential can reach far beyond a single inbox. Academically, phishing introduces a theme that runs through all of cybersecurity: security depends on human behavior as much as on technology. And because attackers now use AI to make messages harder to spot by grammar alone, the skill of judging a message by its behavior — not its polish — becomes more valuable, not less.

The college version

What phishing is

Phishing is a form of social engineering — an attack that works on people rather than on software. NIST's glossary defines phishing as a technique for attempting to acquire sensitive data, such as bank account numbers, through a fraudulent solicitation in email or on a website, in which the perpetrator masquerades as a legitimate business or reputable person. CISA's consumer guidance puts it more plainly: phishing occurs when criminals try to get people to open harmful links, emails, or attachments that could request personal information or infect devices, and the messages are designed to look as though they come from a trusted person or organization. The scale is large: the FTC notes that scammers launch thousands of phishing attacks every day, and they are often successful. Phishing is not malware and it is not password guessing; it is deception, and its target is a human decision.

How phishing works: urgency, impersonation, and fake pages

Three elements show up again and again in phishing, and each one is a shortcut around careful thinking. Fake urgency: the message claims dire consequences for not responding immediately — an account will be locked, a payment will fail, a package will be returned — so the recipient acts before checking. Impersonation: the message borrows the look of a trusted sender, using a familiar company name, a logo, or a sender address that imitates the real one with a few characters changed. Fake login pages: a link leads to a website that closely mimics a genuine login screen, and when the victim signs in, the credentials go to the attacker. CISA's public example of 'Omar' describes exactly this pattern: an urgent order-confirmation email, a shortcut link, and a look-alike site that captured his password and card details. Notice that none of this requires technical skill from the victim — it requires a believable story.

The common forms

Phishing arrives through different channels, and each has a name. Email phishing is the most common form: fraudulent email that masquerades as a large account provider or a coworker, typically carrying a link or attachment. Smishing is phishing by SMS — text messages disguised as trustworthy communications, such as a delivery notice that looks like it came from a courier service. Vishing is phishing by voice: callers, sometimes working from fraudulent call centers, try to talk people into revealing sensitive information over the phone. Spear phishing is the targeted version: instead of casting a wide net, the attacker researches a specific person's job or social life and customizes the message to that person, which makes it harder to dismiss. One line worth keeping: phishing is broad and cheap; spear phishing is narrow and prepared.

Reading the red flags

Several signs repeat across government guidance. Unexpected urgency: a message that demands immediate action, often with a threat attached. An unfamiliar sender: an address you do not recognize, or a familiar name spelled slightly wrong. Mismatched links: the displayed text of a link points somewhere else — for example, a link that reads like a bank's address but whose real destination is an unrelated domain. Requests for credentials or payments: legitimate organizations do not email or text asking you to confirm your password or update payment details through a link. Poor grammar and awkward wording: a sign the message was not written by the organization it claims to be. One caveat matters: CISA warns that because AI tools now write clean prose, some phishing messages have perfect grammar and spelling, so grammar alone is no longer a reliable test — the other signs carry more weight.

What to do when a message looks wrong

The guidance from CISA, the FTC, and Microsoft-backed guidance is consistent. Don't click: do not open links or attachments, including 'unsubscribe' links. Don't reply: even a short reply tells the attacker your address is live and invites more attempts. Report it: use the report option in your email or messaging app, and consumer agencies such as the FTC also accept reports of phishing through their public reporting channels. Verify through another channel: if the message claims to be from a company or person you know, contact them using contact information you already have — a website you typed yourself or a phone number from a statement — never the number or link inside the suspicious message. And if a credential was already captured, changing that password and turning on multi-factor authentication limits the damage; NIST's authentication guidance notes that passwords alone are not phishing-resistant and encourages phishing-resistant options where practical.

Why it works, and the role of training

It is tempting to explain phishing away as a problem of ignorance: if people only knew the signs, they would not fall for it. The honest framing is sharper. Phishing exploits trust and emotion — familiarity with a brand, fear of losing money or access, the pressure of a deadline — and attackers deliberately push people to decide before they think. Microsoft's security guidance is direct about this: attackers create a false perception of need and a false sense of trust, and even the most perceptive people can be deceived. That is why the defense is layered rather than a single skill: slow down, check the sender and the link, protect accounts with multi-factor authentication, and report what looks wrong. Formal security-awareness training exists precisely to practice these habits, and it is covered in its own lesson.

Eli, the EliExplains learning guide

Eli explains

The same idea, in plain words

Explain it like I’m 10

Phishing is a trick with a message. Someone sends an email, a text, or a phone call that pretends to be a person or company you trust — your bank, a courier, a friend. The message tries to make you act fast: your account will close, your package will be returned, you owe money now. If you click the link, you land on a page that looks like the real one, and whatever you type there goes to the trickster. The fix is simple and slow: don't click, don't reply, report it, and contact the real company or person using a number or website you already know.

Picture it like this

Imagine a stranger borrowing a delivery uniform and a clipboard, knocking on your door, and saying your package needs a signature — and the pen they offer is a marker that lets them into your house. The uniform does the work, not the skill. A phishing message is that borrowed uniform: it looks official, it creates pressure, and the 'pen' is the link or the login page that hands over access.

Where the picture stops working

The analogy breaks down because in person you can usually see the stranger, and the deception ends at your door. A phishing message is invisible, arrives at scale by the thousands, and can imitate exact logos and layouts, so the fake can look more convincing than a person in a costume. Phishing also targets information and credentials rather than physical entry — though the damage to accounts and money can be just as real.

Worked example

Jordan receives an email that looks like a shipping update from a store they ordered from last week. The subject line says the package could not be delivered and will be returned in 24 hours unless Jordan confirms the address. The sender address is a string of letters at a domain that is not the store's, the greeting is generic, and the button labeled 'Confirm Address' points to an unfamiliar web address. Jordan recognizes the pattern: urgent deadline, unfamiliar sender, mismatched link. Instead of clicking, Jordan reports the message through the mail app's report option, then opens the store's site by typing the address directly and checks the order status there. The order is fine — the message was phishing, and no information was given away.

Key takeaway

Phishing is a con, not a technical failure: it borrows trust and rushes decisions. Slow down, check the sender and the link, never hand over credentials or payments from a message, and report what looks wrong.

Quick check

3 questions here, of 5 in this lesson’s practice set. Answers stay hidden until you check.

Question 1 of 3foundational

What is phishing?

Choose an answer, then check it.
Question 2 of 3intermediate

Ravi gets a text that looks like a delivery notice from a courier he has used, warning that a package will be returned within hours unless he clicks a link to reschedule. The link leads to an unfamiliar site. Which type of phishing is this, and which two tactics does it combine?

Choose an answer, then check it.
Question 3 of 3advanced

A coworker says a suspicious email passed their 'grammar check,' so it must be legitimate. Based on current CISA guidance, why is grammar alone a weak test?

Choose an answer, then check it.
Practice all 5

Keep learning

Ready to build on this? Continue to the next lesson.

Practice this lesson
Study tools & related lessonsYou’ll learn to · Common mistakes · Easily confused · Key vocabulary · Related

You’ll learn to

  • Define phishing and distinguish it from malware and from brute-force password guessing.
  • Explain how phishing works through fake urgency, impersonation of trusted senders, and fake login pages.
  • Distinguish email phishing, smishing, vishing, and spear phishing.
  • Recognize common phishing red flags, including why grammar alone is an unreliable test.
  • Apply the standard response to a suspicious message: don't click, don't reply, report, and verify through another channel.
  • Analyze why phishing succeeds, explaining the role of trust and emotion.

Common mistakes

  • Judging a message only by its grammar.

    CISA warns that AI tools now let some phishing messages arrive with perfect grammar and spelling. Check the sender address, the real destination of links, and the pressure to act instead.

  • Clicking the link 'just to see if it's real'.

    Clicking is what the phisher wants — the link may open a fake login page or harmful content. Inspect the link's destination without opening it, or verify through a channel you know is real.

  • Replying to a suspicious message to ask if it is legitimate.

    A reply confirms your address is active and invites more attempts. Report the message and contact the real organization through contact information you already have.

  • Believing phishing only happens to careless people.

    Phishing exploits trust and emotion, and attackers push for quick decisions; even careful people can be deceived. The defense is the habit of slowing down, not a personal immunity.

  • Using the contact details inside the suspicious message to verify it.

    CISA and the FTC advise contacting the company through a number or website you already know — the phone number in a suspicious message may belong to the attacker.

Easily confused

Phishing vs. malware

Phishing is deception aimed at a person's decision; malware is software that harms a device. A phishing message can be the delivery method for malware, but the two are different kinds of threat — and malware has its own lesson.

Smishing vs. vishing

Both are phishing through a phone, but smishing arrives as a text message and vishing as a voice call; smishing usually asks you to click, vishing usually asks you to talk.

Broad phishing vs. spear phishing

Broad phishing is a mass message that works when enough recipients bite; spear phishing is researched and customized for one specific person or role, which makes it harder to recognize.

Key vocabulary

phishing
A form of social engineering in which fraudulent messages pose as a trusted person or organization to trick recipients into revealing sensitive information or clicking harmful links.
smishing
Phishing delivered by text message: SMS messages disguised as trustworthy communications, such as a delivery notice or bank alert.
vishing
Phishing conducted over voice calls, in which callers impersonate a trusted organization to extract sensitive information.
spear phishing
A targeted phishing attempt that uses research about a specific person or organization to make a customized, believable message.
credential phishing
A phishing attempt aimed at stealing usernames and passwords, usually by sending the victim to a fake login page that mimics a real one.
spoofed link
A link whose visible text or sender appears legitimate but whose real destination is an attacker-controlled site, often a look-alike login page.
multi-factor authentication (MFA)
A login process that requires more than one kind of evidence — such as a password plus a one-time code — so that a phished password alone is not enough to enter an account.

Sources & references

  1. Recognize and Report Phishing — Cybersecurity and Infrastructure Security Agency (CISA)
  2. Avoiding Social Engineering and Phishing Attacks (ST04-014) — CISA (Cybersecurity and Infrastructure Security Agency)
  3. How To Recognize and Avoid Phishing Scams — U.S. Federal Trade Commission (FTC), Consumer Advice
  4. What is phishing? — Microsoft Security
  5. phishing — Glossary | CSRC — National Institute of Standards and Technology (NIST), Computer Security Resource Center
  6. NIST Special Publication 800-63B: Authentication and Authenticator Management — National Institute of Standards and Technology

EliExplains lessons are original prose written from the open, credible references above. See Copyright & Licensing.

Researched 2026-08-21

Educational content only. It is not medical, legal or professional advice. Found an error? Tell us.