Phishing Scams: How to Spot and Avoid Them

For an individual, it can mean a complete loss of savings or a stolen identity. For a business, it can mean regulatory fines, long-term reputational damage, and even millions in losses. Phishing isn’t a rare crime. With around 3.8 million phishing attacks recorded in 2025, it remains the most common entry point for cybercriminals worldwide 1 .

The danger is growing in both scale and finesse. AI can now generate grammatically perfect messages; deepfake audio and video may trick people, while fake login pages tend to look identical to real sites. Attackers now have sophisticated and convincing phishing weapons at their disposal, and they can target anyone.

This guide is meant to help you understand what phishing is and how it works. In it, you’ll find real-world cases that show the damage a single click can do, as well as preventive steps that can help you recognize and stop phishing attacks before damage is done.

Phishing is a type of cyberattack where criminals impersonate trusted people or brands (such as a bank, a coworker, or even a family member) to trick you into giving up sensitive information (like passwords, bank details, or company data).

Instead of exploiting software flaws, they use psychological tactics like urgency, fear, reward, or authority to pressure you into clicking a link, downloading an attachment, sending money, or entering credentials.

Phishing messages can reach their targets through emails, messaging apps, phone calls, fake websites, and social media. Attackers usually copy real logos, replicate writing styles, and mimic email addresses to make their messages appear authentic. Sometimes, they even send the messages from real accounts they compromised, which can make distinguishing real from fake particularly difficult.

Neither individuals nor organizations are immune. When targeting individuals, the attacker’s goal is usually account takeover, payment fraud, or identity theft. When it comes to companies, on the other hand, a single compromised user can open the door to data breaches, ransomware attacks, wire fraud, and long-term reputational damage.

Phishing is the most widespread form of cyberattack. According to the FBI, phishing was the most frequently reported cybercrime in 2024, with 193,407 complaints recorded 2 . Extortion ranked a distant second with 86,415 complaints. These figures only represent reported cases; the number of phishing incidents that actually occurred is certainly greater.

The problem is pervasive across the world. According to the Anti-Phishing Working Group, 3.8 million phishing attacks were recorded globally in 2025, up slightly from 3.76 million in 2024 1 .

Whether the target is a global organization or an individual, phishing follows the same pattern: impersonation, urgency, or exploitation of trust at an unguarded moment.

Understanding the channels and types of attacks can make it easier to recognize the red flags before any real damage occurs.

The following section provides a brief overview of phishing channels and their commonly used tactics. For more detailed information and examples, please refer to the appendix at the end of this article.

First deployed in the mid-1990s, an email-based attack happens when bad actors mimic legitimate senders to steal credentials, money, or data. They often use lookalike domains (e.g., substituting “m” for “rn” in the email address), branding, urgent language, and malicious links or attachments to trick recipients.

According to Astra Security, in 2022, 1.2% of emails sent were estimated to have been phishing attempts 3 . Over the years, attackers have honed various tactics, including:

Some phishing tactics focus on replicating legitimate websites to harvest credentials, hijack sessions, or install malware. These attacks are designed to exploit the trust you have in the impersonated brand.

For example, you may land on a fake login page and enter your credentials without a second thought, assuming it’s a normal identity-validation request from that service.

Other common tactics for website-based phishing schemes include URL spoofing (when lookalike domains use small typos to mimic a brand’s legitimate website address) and scareware (pop-up alerts that simulate security warnings and urge you to make purchases or downloads under the guise of protecting your device).

Scams targeting smartphone users have become increasingly common. According to Zimperium’s 2024 Mobile Threat Report, 82% of phishing sites are now specifically optimized for mobile devices 4 . Here are five common tactics phishers use:

Social media-based attacks exploit popular platforms like , Instagram, or through fake profiles, scammy direct messages, or pretend support accounts.

For example, criminals could impersonate someone you know and request urgent financial assistance. They could also data-harvesting quizzes or surveys on , tricking respondents into giving them the answers to common security questions (like their pet’s name or mother’s maiden name).

Successful phishing attacks aren’t petty crimes. They often result in financial losses, emotional distress, data breaches, and long-term reputational damage.

According to IBM’s Cost of a Data Breach Report, phishing accounted for 16% of the 600 breaches studied across the globe in 2025, with the average incident costing $4.44 million 5 . The report found that phishing continued to be the #1 attack vector employed by attackers to gain access to organizations.

Perhaps one of the most infamous examples is the 2023 breach of MGM Resorts International.

How did the attackers manage it? By simply calling the company’s IT helpdesk.

After learning the personal details of a member of staff via , the perpetrators impersonated the employee and convinced the IT team to reset account credentials. This single social engineering tactic triggered a widespread system outage across MGM’s hotels and casinos. It exposed the data of roughly 37 million customers, disrupted operations for days, and cost the company over $100 million 6 .

Phishing and impersonation attacks don’t just steal passwords; they may open the door to entire enterprises and destroy consumer trust along the way. Data leaks can cause long-term reputational damage for the affected companies.

Phishing is also the primary delivery mechanism for ransomware and malware infections.

The 2014 Dyre banking trojan campaign, for example, showed how badly phishing-delivered malware can hit organizations. It infected 133,000 computers worldwide and created 1,100 phishing websites mimicking well-known banks 8 .

The attackers pretended to be tax consultants in phishing emails, convincing employees to download malicious executable files disguised as financial documents.

The phishing element of the campaign was two-pronged. When victims didn’t engage with emails or fake web pages, the attackers called them directly via Skype, impersonating bank employees or even law enforcement agents to pressure victims into giving up their login details.

When phishing leads to large-scale exposure of personal information, regulators can step in.

British Airways, for instance, was fined $26 million by the UK Information Commissioner’s Office following the 2018 data breach 9 . The attack in question resulted in the exposure of the personal data and payment information of more than 400,000 customers. Attackers used compromised credentials to redirect users to a fraudulent payment page where they harvested login and card details.

The penalty was not among the largest ever issued, but the breach illustrates how credential compromise and web-based impersonation tactics can be leveraged to compromise large-scale systems and steal user information.

Business email compromise (BEC) scams have drained billions from organizations worldwide. According to the FBI’s 2024 Internet Crime Report, BEC scams have caused over $50 billion in global losses since 2013 2 .

A notable example is the 2024 deepfake-enabled BEC case. A finance employee at UK engineering firm Arup transferred approximately $25 million after attending a video call with deepfake versions of senior executives 10 .

The consequences of these attacks are not limited to corporate losses; sometimes, on an individual level, the consequences can be just as severe.

According to research by email security company Tessian, 1 in 4 employees who made a security mistake that led to a breach lost their jobs 11 . Moreover, even when they keep their jobs, victims may face penalties at work and suffer from damaged reputation.

Phishing often begins with what looks like a routine workplace request, which is what can make it so tricky to identify.

In 2020, employees at US-based Magellan Health received what appeared to be a legitimate internal email requesting employee W-2 tax forms. The request was fraudulent. As a result, sensitive tax data belonging to roughly 364,000 individuals was exposed 12 .

That information (e.g., Social Security number, income details, address) is often all that an identity thief needs to begin their scam. Victims can spend years dealing with fraudulent tax filings, unauthorized loans, and damaged credit histories.

According to IBM, the cost of the average breach fell by 9% in 2025 compared to the year 5 . This drop doesn’t necessarily indicate fewer breach attempts. Instead, it reflects faster identification and containment, which helped organizations limit the financial repercussions.

However, the operational impact remains severe. The report found that 86% of breached organizations experienced “significant or very significant” business disruption (an 85% year-on-year increase). In other words, even when breaches are contained, they still disrupt operations, systems, and customer service .

After recognizing the importance of phishing prevention, many companies have been investing in awareness training. Research shows that trained employees are 30% less likely to fall for phishing attempts; however, the effectiveness of this training can decline over time, as knowledge retention tends to fade within four months. 13

As a result, organizations are shifting toward multi-layered defense models (which consider people, process, and technology) to minimize the risk and impact of phishing attacks.

The strongest defence is usually a combination of personal caution with technical safeguards. While no one measure provides complete protection, implementing multiple defensive layers can significantly reduce the risk of falling prey to phishing scams.

Unfortunately, even if you follow all these suggestions to the letter, it’s likely some phishing attempts will still slip through your emails and personal messages. So, it’s important that you keep your eyes open.

Phishing attempts don’t always look suspicious. It can be a routine delivery notification, a periodic password reset request, a message from a trusted individual, or an email from “the CEO” of a company you engage with. These attacks tend to work because they seamlessly blend into everyday communication.

Estimates suggest that over 90% of all data breaches are caused by human mistakes 14 . It’s not because people are careless, but because attackers continuously develop new tactics to look urgent, familiar, and legitimate. That’s why awareness is often your best defense.

Over the section, we’ll give you some tips on how to identify phishing attempts. Although it’s no exact science, below you can find 7 warning signs you can watch out for.

Also, watch out for domain misspellings, like @micros0ft.com (zero replacing “o”) or @ paypa1.com (one replacing “l”). They are designed to trick people who only give the sender email a quick glance. If what comes after the “@” symbol doesn’t match the organization’s name exactly , it’s almost certainly a scam.

Please note that not all emails with a generic greeting are scams, but it’s a common phishing signal, especially from services where you’ve already registered.

If you’re skeptical a message, the organization directly through confirmed official channels and verify the information you received.

Exercise caution with URLs, as bad actors can use similar-looking characters to trick you, like an uppercase “i” in place of a lowercase “L” (“I” and “l”). When in doubt, either visit the company’s website manually or use a URL checker to verify if the link is malicious before you open it.

Recognizing a phishing attempt is important, but what you do matters even more. A single click can cause plenty of damage. Taking timely action can protect not just you, but also your colleagues, family, and organization.

Hang up suspicious calls. If someone on the phone claims to be from your bank, a government agency, or tech support and pressures you to personal or financial information, hang up. If you need to the organization, don’t use the callback number provided. Always use the number listed on the official website.

iCloud Mail does not have a dedicated option for reporting phishing, but you can move phishing emails to the Junk folder. This will help Apple improve their spam filtering service. To do this on your iPhone: Swipe left on an email > Tap “More” > Move to Junk.

Even the most cautious person can make a mistake. It just takes one rushed click or one unguarded moment, and you may have unknowingly shared your credentials or other sensitive information. In such instances, the priority shifts from prevention to damage control.

The faster you respond, the more damage you can prevent. Don’t panic, but act quickly.

Why this matters: It can help identify and keep records of the scope of the compromise. This is important in case you decide to report it to the authorities.

Why this matters: It can keep attackers from having long-term access to your accounts and data.

Why this matters: Removing malicious software can protect devices and networks from persistent attacks.

Why this matters: It can help limit potential financial and reputational damage. It can also prevent cyberattackers from further data misuse, like identity theft.

Why this matters: It can prevent criminals from opening new accounts or taking loans in your name.

Why this matters : It can keep cyber attackers from successfully committing phishing attacks in your name. This can help protect others.

Phishing attacks are evolving rapidly as cybercriminals make use of new technologies to devise increasingly sophisticated attacks. The infographic below illustrates this shift: how we went from scams focused on stealing passwords to sophisticated attacks that impersonate trusted authorities, companies, or even loved ones.

Let’s take a closer look at how phishing tactics are evolving and what emerging trends you should watch out for.

Generative AI tools (like OpenAI’s ChatGPT or Anthropic’s Claude) allow attackers to produce polished, convincing content in seconds. While reports state that fully AI-generated phishing still represents a small percentage (0.7%–4.7%) of attacks 16 , these tools boost attackers capabilities by allowing them to:

What once required skill and expertise can now be mass produced with a prompt. So, it’s not just that AI can be misused to improve the effectiveness of a phishing message; with AI tools, the speed and scale at which attackers operate can escalate too.

Research firms like Gartner predict that 17% of total cyberattacks will involve generative AI by 2027 17 , while other experts forecast AI-enhanced phishing will become the dominant social engineering method starting as early as 2026 18 .

Deepfake technology enables criminals to create hyper-realistic audio and video of (generally unconsenting) people.

Voice cloning systems like Microsoft’s VALL-E can now replicate voices from three seconds of audio , down from the 30 minutes required years ago. According to The Battle Against AI-Driven Identity Fraud report, deepfake fraud attempts increased by 2,137% in just 3 years 19 .

As this technology continues to improve, distinguishing real from fake may become more challenging.

Popular cloud computing platforms (like Microsoft OneDrive, Google Drive, or GitHub) can be particularly beneficial to phishers. They provide something difficult to find: automatic legitimacy.

According to Netskope’s Cloud and Threat Report, malicious content distribution via popular cloud apps remains an ongoing risk for organizations. Nearly 90% of the firms studied experience monthly malicious downloads 20 .

The targeting patterns seen in global phishing attacks reinforce this trend. Data from the Anti-Phishing Working Group shows that SaaS and webmail platforms account for more than 20% of phishing attacks 15 , making them one of the most frequently impersonated service categories.

While antiviruses, firewalls, and anti-phishing tools may help, it’s likely technology alone won’t keep all phishing attempts from reaching you. Complementing tech tools with cybersecurity knowledge gives you a better chance to successfully reduce the risks associated with phishing.

Trusted cybersecurity websites, government agencies, and industry organizations provide free, up-to-date threat updates and best practices to keep you ahead of emerging scams. You can see a few reputable examples below.

We included the examples above simply to illustrate a few of the training programs and courses that are offered by reputable organizations. However, many more are available beyond the ones mentioned here. If you’re interested in taking one, we kindly encourage you to research more options and select the one that best aligns with your individual needs and goals.

Phishing attacks aren’t going away; if anything, they’re getting more sophisticated. AI-generated content, deepfake impersonation, and abuse of trusted platforms have made these attacks more convincing, efficient, and difficult to detect.

The good news is that you can avoid the vast majority of phishing attempts you encounter . Email filters, two-factor authentication, and browser safeguards all help, especially when combined with user awareness and clear response action plan.

So, take that extra second to check sender addresses; pause before clicking links or downloading attachments; question any email creating urgency or demanding sensitive information. A small pause can make all the difference.

The table below provides a comprehensive breakdown of various phishing tactics, each with an example to illustrate how these strategies can be applied in real life.