What phishing is trying to achieve
Phishing is the practice of sending messages that pretend to come from a trusted sender in order to get you to reveal information, click a harmful link, open a file or send money. Email is the classic channel, though the same structure appears in texts and social media messages.
A phishing email usually has one job: move you from reading to acting. The action might be signing in on a fake page, opening an attachment or replying with details. Everything in the message is arranged for that purpose.
The parts of a phishing email
The sender
The display name is what you usually see first, and it is easy to set to anything, such as a bank’s name or a colleague’s name. The actual sending address can be checked by looking at the full address behind the name. Common tricks are an address from a free webmail service pretending to be an organisation, or a lookalike domain, as covered under lookalike domains.
Even a perfect-looking address is not proof. Email was designed without strong identity checks, and although systems for authenticating senders exist, they are not applied uniformly. Understanding how email delivery works explains why the “from” line can sometimes be forged. Spam filters catch much of this, but not all of it.
The subject line
Subjects tend to promise urgency or relevance: “Action required”, “Your account will be suspended”, “Invoice attached”, “Unusual sign-in”. They borrow ordinary business language so that they blend in.
The greeting and tone
Older advice pointed to generic greetings like “Dear customer”. They remain a clue, but personalised openings are now easy to add, particularly when attackers have names from data breaches. Generative AI also makes it simple to write fluent, error-free text, so spelling mistakes are a weaker signal than they once were. What remains consistent is the tone: urgency, threat or reward.
The story
The body gives a reason to act. Typical themes include:
- A security alert or locked account.
- A failed payment or an overdue bill.
- A parcel or delivery problem.
- A document to review or sign.
- A refund, prize or tax rebate.
- A message from a boss asking for a quick favour.
The details may be vague, since the sender often does not know which services you use. A message about “your account” without naming it can suggest a mass mailing.
The link
Most phishing emails contain a button or link. The visible text can say one thing while the real destination is another. On a computer, hovering over a link usually shows the true address; on a phone, pressing and holding it often does. The destination may be a fake login page that copies a real service, or a page that tries to download something.
The attachment
Attachments might be invoices, voicemails, shipping documents or “secure messages”. Harmful files may be disguised, so it is worth checking file extensions, though even common formats such as PDF files can carry links or content designed to trick you. Be particularly careful with unexpected files that ask you to enable macros or editing. More on handling these safely is covered under email attachments.
The ask
Finally, the request: sign in, confirm details, pay, open the file, reply or call a number. A request for a password, a one-time code or an unusual payment is a strong warning.
Variations worth knowing
- Spear phishing targets a specific person or organisation using details gathered about them, so it may look much more convincing than a mass mailing.
- Business email compromise pretends to be a supplier or executive and asks for a change of bank details or an urgent transfer.
- Reply-chain hijacking uses a genuine but compromised account to send a message inside an existing conversation. The sender really is someone you know, but the account has been taken over.
- Callback phishing includes no link at all, only a phone number to ring, which sends the victim to a scammer posing as support.
- QR code phishing places a code in the email that sends you to a fake site, which can bypass some link scanning.
Clues to look for
No single clue is decisive, but several together are persuasive:
- Unexpected message from a company you do not deal with, or about something you did not do.
- Sender address that does not match the organisation.
- Link destination that differs from the displayed text.
- Urgency, threats or secrecy.
- Request for credentials, codes or payment details.
- Unusual payment methods.
- Attachment you were not expecting.
What to do instead of clicking
- Leave the message alone and go directly to the organisation’s website or app by typing the address or using a saved bookmark.
- If the message claims to be from someone you know, contact them using another route.
- Use the report-phishing option in your email service if it has one, then delete the message.
- Keep your accounts protected with a password manager and two-factor authentication, or a passkey sign-in where offered; these do not stop a click, but they reduce the value of a stolen password. Software updates also close holes that malicious pages try to use.
If you clicked
Clicking a link alone is often not harmful, but entering details or opening a file may be. Change the password for the affected account (and anywhere it was reused), run a security scan, and tell your bank if payment details were involved. The general advice in scam recovery steps applies. Workplaces usually have a person to tell, and speed helps.