What Is Phishing? How to Spot and Stop Phishing Attacks

Phishing is a social engineering attack that tricks someone into revealing credentials, clicking a malicious link, or transferring money, usually by impersonating a trusted person or organization. If you have relied on spotting bad grammar or an odd tone as your main defense, that warning sign has quietly stopped working, and this guide explains what actually replaces it.

What Is Phishing?

Phishing is a type of social engineering attack that impersonates a trusted individual, brand or organization to trick someone into revealing sensitive information, clicking a malicious link, or taking a financially damaging action. Unlike attacks that exploit a technical vulnerability, phishing exploits trust, urgency and routine human behavior directly.

The term now covers a genuinely broad family of related techniques, delivered by email, text, phone call, QR code or messaging app, all sharing the same underlying goal of impersonation and deception rather than technical compromise.

The Main Types of Phishing

Different phishing techniques target different channels and different levels of specificity, and recognizing which one you are dealing with shapes how you defend against it.

1. Spear Phishing

Spear phishing targets a specific individual or organization using personalized details, a name, job title, recent project, gathered beforehand to make the attempt considerably more convincing than a generic, mass-sent email.

2. Whaling

Whaling specifically targets senior executives or high-value individuals within an organization, since compromising or impersonating someone with genuine authority to approve payments or access sensitive systems yields a far greater payoff than targeting a junior employee.

3. Smishing

Smishing delivers phishing attempts via SMS text message, often impersonating a delivery service, bank, or government agency, exploiting the shorter, more casual format of text messages where people apply less scrutiny than they might to email.

4. Vishing

Vishing conducts phishing over voice calls, sometimes using AI-generated voice cloning to impersonate a specific, familiar person convincingly, pressuring a target into immediate action before they have time to verify the request independently.

5. Quishing

Quishing embeds a malicious link inside a QR code rather than a clickable text link, exploiting the fact that most security awareness training still focuses on suspicious links and attachments, while a QR code’s actual destination remains invisible until scanned.

6. Clone Phishing

Clone phishing duplicates a legitimate email a target has previously received, replacing the original attachment or link with a malicious version, relying on the recipient’s familiarity with the original message to lower their guard.

Why You Can No Longer Rely on Bad Grammar to Spot It

For years, the standard advice for spotting phishing centered on obvious tells: awkward phrasing, spelling mistakes, generic greetings. That advice is genuinely outdated now, and continuing to rely on it leaves people looking for a signal that has largely disappeared.

AI tools can now generate flawless, contextually accurate impersonations of executive communication, matching an organization’s actual tone, structure and internal terminology with real precision. The FBI’s own 2025 Internet Crime Report included a dedicated section on AI for the first time in its 25-year history, specifically noting that AI is removing one of the last constraints on business email compromise: execution quality. Attackers can now tailor tone and intent to match internal communication patterns, eliminating exactly the inconsistencies that historically made phishing detectable through grammar and phrasing alone.

This genuinely changes what a warning sign should be. Rather than scanning for spelling errors, the more reliable signals now are contextual: an unexpected request for urgency or secrecy, a request to bypass a normal approval process, a change to payment details communicated only through a single channel with no verification step, or a request that arrives outside normal business hours or through an unusual channel for that specific relationship. A perfectly written email requesting an unusual wire transfer change should raise exactly the same suspicion a poorly written one once did, since the writing quality itself no longer tells you anything reliable about legitimacy.

MFA Fatigue Attacks: The Technique That Doesn’t Need Your Password at All

MFA fatigue attacks exploit multi-factor authentication itself rather than trying to steal a password directly. An attacker who already has valid stolen credentials repeatedly triggers login attempts, sending a flood of MFA approval requests to the victim’s phone, hoping the target eventually approves one out of frustration, confusion, or simply to make the notifications stop.

This technique specifically targets the human tendency to treat a repeated, annoying prompt as a technical glitch rather than an active attack in progress. Defending against it requires configuring MFA systems to reject rapid repeated requests, using number-matching approval instead of a simple approve or deny tap, and training employees that a sudden flood of authentication requests they did not initiate is itself the warning sign, not something to dismiss or approve just to stop the interruption.

The Blind Spot: Why Phishing Sent by Text or Messaging App Often Goes Unnoticed

Most organizational phishing defense concentrates almost entirely on email, spam filters, link scanning, employee training focused on inbox behavior. This leaves a genuine, growing blind spot around phishing delivered through text messages and third-party messaging apps, channels that typically sit entirely outside corporate security tooling.

An employee’s personal phone receiving a smishing text impersonating a delivery company, or a vishing call impersonating IT support, happens completely outside any monitoring your organization has in place for email. Because these channels feel personal and informal, people often apply less scrutiny to them than they would to a work email, even though the underlying deception technique is identical. Closing this gap requires extending awareness training explicitly to cover text and voice channels, not just email, and establishing a clear, simple process for employees to report suspicious contact regardless of which channel it arrived through.

The Real Numbers: FBI Losses, UK Breach Data, and Why the UK Percentages Don’t All Agree

The FBI’s Internet Crime Complaint Center 2025 Annual Report, released in April 2026, recorded 191,561 phishing and spoofing complaints, making phishing the most reported cybercrime category in the US for the third consecutive year. What stands out is not the complaint count, which held roughly flat compared to 2024, but the financial damage: reported phishing losses jumped from $70 million to $215.8 million year over year, meaning each individual attack is now causing dramatically more damage even though the number of attacks barely changed. Business email compromise, a close relative of phishing, generated $3.046 billion in losses from just 24,768 complaints, an average of roughly $123,000 per incident.

Here is a genuinely useful clarification most coverage skips. You will likely encounter several different UK phishing percentages that seem to contradict each other, and they are all correct, just measuring different things. The DSIT Cyber Security Breaches Survey 2025/2026 found 43% of UK businesses reported experiencing any cyber security breach or attack in the past year. Separately, it found that 85% of businesses that experienced any breach specifically experienced phishing, a figure describing only the subset of businesses that had a breach at all, not all UK businesses. A third figure, around 38%, describes the share of all UK businesses, breached or not, that specifically identified phishing. These numbers are not inconsistent. They simply use different denominators, all businesses surveyed, only breached businesses, or businesses reporting phishing specifically, and citing one without the others creates exactly the confusion many readers encounter when cross-referencing sources.

The practical takeaway holds regardless of which specific percentage you cite: phishing remains, by a wide margin, the most common way both US and UK organizations get breached, and the financial damage per successful attack is climbing even where raw attack volume is not.

Why Board-Level Engagement Matters More Than Another Training Module

Employee training matters, but a training program without genuine board-level engagement behind it tends to stay underfunded and under-prioritized relative to the actual risk phishing represents. Boards increasingly treat cyber security as a governance issue rather than a purely technical one, and phishing’s dominant role in breach statistics makes it a genuinely obvious topic for board-level attention specifically, not just an IT department concern.

A board that understands phishing drives the majority of successful breaches, and that BEC alone accounts for billions in annual losses, is considerably more likely to fund proper detection tooling, adequate training frequency, and a genuine incident response process than a board hearing about phishing only as a line item in a broader security budget request. Framing phishing risk in board-relevant terms, financial exposure, regulatory consequence, reputational damage, secures resources a training module alone rarely unlocks on its own.

Monthly vs Annual Training: Does It Make a Measurable Difference?

Training Cadence	Typical 12-Month Click Rate Outcome	Reporting Behavior
Annual only	Learning decays within 3 to 6 months	Low, inconsistent reporting
Quarterly	Some retention, longer gaps between reinforcement	Moderate
Monthly	Roughly 75% reduction in click rate	Significantly higher, more consistent

Yes, genuinely and measurably. Research cited in the SANS 2025 Security Awareness Report found that organizations running monthly phishing simulation programs saw roughly a 75% reduction in click rates over a year, moving from an average untrained baseline of around one in three employees clicking a simulated phishing attempt down to roughly one in twenty. Annual “check the box” training, by contrast, lets learning decay significantly within three to six months, since a single training session’s effect fades well before the next one arrives.

Verizon’s 2025 Data Breach Investigations Report adds a genuinely useful, complementary data point: employees trained within the previous 30 days were four times more likely to report a phishing attempt than those without recent training. This connects the frequency argument directly to reporting behavior, not just click rates, and reporting matters enormously, since an employee who reports a suspicious email quickly gives a security team the chance to block a wider campaign before it reaches others. An annual training cadence simply cannot sustain that recency effect, meaning most of the year passes with a workforce further and further from their last meaningful reinforcement. The evidence here is consistent enough across multiple independent sources that “train once a year” should be treated as a genuinely inadequate baseline, not a defensible minimum.

How Do You Spot and Stop a Phishing Attempt?

Check for contextual red flags rather than writing quality: unexpected urgency, a request to bypass normal approval steps, or a change to payment or account details communicated through only one channel. Verify unusual requests through a separate, known communication channel, calling a known phone number rather than replying to the message itself, before taking any action involving money, credentials or sensitive data.

Treat a sudden flood of MFA approval requests you did not initiate as an active attack, not a technical glitch, and never approve one out of frustration. Extend awareness beyond email specifically to text messages, voice calls and QR codes, since attackers increasingly target exactly the channels your existing training and tooling overlook. Run phishing simulations monthly rather than annually, given how much the data above shows frequency genuinely changes outcomes, and make reporting suspicious contact simple enough that employees actually do it. Cyber Security Solutions Ltd builds exactly this kind of frequency-driven, multi-channel awareness program, rather than a once-a-year compliance exercise that looks complete on paper but leaves the actual risk largely unaddressed.

Conclusion

Phishing has not gotten simpler to defend against, it has gotten harder, precisely because the old warning signs no longer reliably apply. Start by shifting your own team’s attention from writing quality to contextual red flags, and move training frequency from annual to monthly if you genuinely want the click-rate improvement the data supports. To build a phishing defense program grounded in current data rather than outdated assumptions, visit cybersecuritysolutionsltd.com for expert support from Cyber Security Solutions Ltd.