How Phishing Scam Works

You've probably heard the word "phishing" thrown around. Maybe someone told you to "watch out for phishing emails" without actually explaining what that means. Let's fix that. Understanding how these scams work is the best way to not fall for them.

## What this guide covers

- What phishing actually is (in plain language) - The different forms it takes - Why it works so well — even on smart people - How to spot it and what to do when you see it

---

## So What Is Phishing?

Phishing is when someone pretends to be a person or company you trust in order to trick you into giving up information — like your password, credit card number, or personal details.

That's it. That's the whole concept.

The name comes from "fishing" — they throw out bait and wait for someone to bite. The "ph" spelling is just hacker tradition from the 1970s. Not important, but now you know.

---

## What Does Phishing Look Like?

Phishing isn't just one thing. It shows up in different forms, and scammers keep getting more creative.

### Email phishing (the classic)

You get an email that looks like it's from your bank, a delivery service, a streaming platform, or even your boss. It usually tells you something urgent — your account has been compromised, your payment failed, your package couldn't be delivered.

There's always a link. The link takes you to a fake website that looks almost identical to the real thing. You enter your login details, and now the scammer has them.

### SMS phishing (smishing)

Same concept, but through text messages. "Your package is being held — click here to reschedule delivery." Or "Unusual activity on your account — verify your identity." Short, urgent, and designed to make you tap before you think.

### Voice phishing (vishing)

A phone call from someone pretending to be your bank, a government agency, or tech support. They might already know some of your details (from a previous data breach) to sound legitimate. They'll ask you to "confirm" the rest.

### Social media and messaging phishing

A message from a friend's account (which has been hacked) saying "Is this you in this video?" with a link. Or a DM from what looks like a brand offering you a deal. It exploits trust — you're more likely to click something from a friend than a stranger.

### Spear phishing

This is targeted phishing. Instead of blasting millions of people with the same generic email, the scammer researches you specifically. They might reference your job, your company, your recent activity. It's rarer, but much harder to spot because it feels personal.

---

## Why Does It Work?

Phishing doesn't work because people are stupid. It works because it's designed to exploit how human brains operate.

### Urgency shuts down critical thinking

"Your account will be locked in 24 hours." When you feel time pressure, you act first and think later. Scammers know this.

### Authority makes us compliant

An email from "your bank" or "the tax office" carries weight. We're wired to respond to authority figures and institutions, especially when they say something is wrong.

### Fear is a powerful motivator

"Someone accessed your account from a new device." That spike of fear is exactly what the scammer wants. It pushes you toward the "solution" they've conveniently provided — the phishing link.

### Familiarity breeds trust

When an email looks exactly like every other email you've received from that company — same logo, same layout, same tone — why would you question it?

### Volume plays the odds

Most phishing is a numbers game. Send a million emails, and even if only 0.1% of people click, that's 1,000 victims.

---

## How to Spot Phishing

You don't need to be a tech expert. Most phishing has telltale signs once you know what to look for.

**Check the sender's actual email address.** It might say "PayPal" but the email address is something like support@paypa1-security.net. Hover over or tap the sender name to see the real address.

**Look at the URL before you click.** Hover over the link (without clicking) and look at where it actually goes. Does it match the real website? Watch for subtle misspellings, extra words, or unusual domains.

**Be suspicious of urgency.** Legitimate companies rarely threaten you with account closure via email or give you a countdown. If something feels designed to rush you, slow down.

**Watch for generic greetings.** "Dear Customer" or "Dear User" instead of your name can be a red flag, though smarter phishing will use your real name.

**Look for odd language.** Awkward phrasing, unusual formatting, or a tone that doesn't quite match how that company normally writes. This is getting harder to spot as scammers use AI to write better messages, but it's still worth noticing.

**Ask yourself: did I expect this?** If you get an email about a package you didn't order, a payment you didn't make, or a problem you didn't know about — treat it with suspicion.

---

## What to Do When You Spot Phishing

**Don't click anything.** Don't open attachments. Don't reply.

**Report it.** Most email apps let you report phishing directly. This helps protect other people.

**Go to the source directly.** If the email claims to be from your bank, open your banking app or type the website address yourself. Don't use the link in the message.

**Delete it.** Once reported, get rid of it.

**If you already clicked or entered information,** don't panic — head to our guide: *You Clicked a Suspicious Link — Now What?*

---

## The Bottom Line

Phishing is social engineering. It doesn't hack your computer — it hacks your attention, your trust, and your emotions. The best defence isn't expensive software. It's the habit of pausing for two seconds before you click.

> **Been caught by a phishing scam?** You're in good company. Visit our [Stories page] to read how others dealt with it — and know you're not alone.

---

*This guide is part of the StillOnline.org explainer series. Written in plain language for real people who want to understand what's actually going on.*