Phishing is responsible for over 90% of data breaches. Modern phishing emails are sophisticated, personalized, and nearly indistinguishable from legitimate messages. Here's how to recognize them — and the one habit that stops almost all of them.
Phishing is the practice of impersonating a trusted entity — your bank, your employer, Amazon, the IRS — to trick you into revealing credentials, clicking a malicious link, or transferring money. It's the most common attack vector in cybersecurity: the Verizon Data Breach Investigations Report consistently finds that over 90% of data breaches involve phishing as an initial access method. Despite decades of awareness campaigns, phishing remains devastatingly effective because it exploits human psychology rather than technical vulnerabilities.
Classic phishing red flags (that sophisticated attacks no longer show): poor spelling and grammar (modern phishing emails are often grammatically perfect); generic greetings like 'Dear Customer' (spear phishing uses your real name); obvious fake domains like 'paypa1.com' (attackers now use convincing lookalikes like 'paypal-security.com' or register legitimate-looking domains); and requests for your password (modern attacks steal session cookies instead, bypassing password entry entirely).
Spear phishing is targeted phishing using personal information. An attacker who knows your name, employer, manager's name, and a recent project you worked on can craft an email that appears to come from your manager asking you to urgently review a document. This information is often available from LinkedIn, company websites, and data broker profiles. Business Email Compromise (BEC) — a form of spear phishing targeting financial transactions — cost US businesses over $2.9 billion in 2023, according to the FBI's Internet Crime Report.
Adversary-in-the-Middle (AiTM) phishing is the most sophisticated modern variant. Instead of a fake login page that just harvests your credentials, AiTM attacks proxy the real site in real time. You enter your credentials and 2FA code on what appears to be the real site — because it is relaying your inputs to the real site and showing you the real responses. The attacker captures your session cookie, which lets them access your account without needing your password or 2FA code again. This attack bypasses all forms of 2FA except hardware security keys.
How to recognize phishing in practice: check the sender's actual email address (not just the display name — 'Amazon Support' can have any email address behind it); hover over links before clicking to see the actual URL; be suspicious of any message creating urgency ('Your account will be suspended in 24 hours'); verify unexpected requests through a separate channel (call your bank directly using the number on your card, not the number in the email); and be especially cautious with attachments — even PDFs and Word documents can contain malicious macros.
The one habit that stops most phishing: never click links in emails to log into accounts. Instead, type the URL directly into your browser or use a bookmark you created yourself. If you receive an email claiming your bank account needs attention, open a new browser tab and navigate to your bank's website directly. This single habit eliminates the risk from the vast majority of phishing attacks, because the attack depends on you clicking their link to their fake site. Hardware security keys provide the strongest technical protection — they verify the site's domain cryptographically and refuse to authenticate on fake sites.
Safety 1st Editorial Team
This article is credited to Safety 1st Editorial Team. Safety 1st Consumer Protection has republished this content with attribution.