Common Phishing Attacks and How to Recognize Them Before It's Too Late

Common phishing attacks: what they look like before you click

A colleague forwarded me an email last month. Subject line: "Your mailbox is full — action required." The Microsoft 365 logo was there. The footer was there. The sender address read micros0ft-support.com. One character. That was it.

She almost clicked. She told me afterward that what stopped her was the greeting: "Dear Valued Customer." Her actual IT department uses her first name. That detail, not the fake domain, saved her.

That is how most phishing attacks work in practice. Not through technical wizardry. Through a small detail the attacker got wrong — and a recipient who noticed. Understanding common phishing attacks is less about memorizing a list of threats and more about training your eye to catch what feels slightly off.

I have spent years watching these attacks evolve from both sides — as someone who has received them, and as someone who has helped teams build defenses against them. Here is what actually matters.

What makes phishing work in the first place

Phishing does not exploit software vulnerabilities. It exploits urgency, authority, and familiarity — the three levers that make people skip verification.

An attacker who impersonates your bank does not need to know your password. They need you to believe, for about fifteen seconds, that something bad is happening right now and only you can stop it. The "right now" part is the mechanism. Urgency shuts down deliberation.

Why smart, experienced people fall for it

I have seen senior engineers with decades of experience enter credentials into a cloned login page. The reason is not stupidity. It is context collapse.

When you are handling forty emails between meetings, your brain runs on pattern recognition rather than analysis. A message that looks like the other thirty-nine does not get a second look. Attackers know this. They design for the inbox you are actually in, not the one you would have if you had time to think.

The uncomfortable truth: your technical knowledge protects you less than your habits do. Someone who reflexively hovers over links before clicking will outperform someone who knows every phishing technique but clicks fast.

The most common phishing attack types you will actually encounter

Not every attack deserves equal attention. Some are constant background noise. Others are rare but devastating. Here is how I rank them by likelihood of crossing your path.

Email phishing: still the workhorse

Mass email campaigns remain the most frequent attack. The logic is volume. If you send two million messages and even 0.1% of recipients click, that is two thousand compromised accounts from a single send.

What has changed is quality. Early phishing emails had broken grammar and mismatched logos. Modern campaigns use correct branding, proper formatting, and fluent language. The flaws have moved to subtler places: a reply-to address that does not match the sender, a link whose visible text says one domain while the actual destination says another, a tone that is slightly more urgent than the organization would ever use.

One reliable tell I have relied on for years: legitimate organizations rarely ask you to click a link to resolve an account issue. They direct you to log in normally, through your usual route. When a message insists you use the provided link — that is the moment to slow down.

Spear phishing and whaling: when it gets personal

Spear phishing targets a specific person, and the attacker has done homework. They may know your manager's name, a project you are working on, or the software your team uses. That research makes the standard advice — "look for generic greetings" — useless.

Whaling is spear phishing aimed at executives, and it works because senior leaders are often the least protected and the most rushed. I watched a finance director nearly approve a payment request that appeared to come from the CEO. The email referenced a real deal, used the CEO's writing style, and arrived during a week when the CEO was traveling. Three details, all accurate. What broke the spell was a phone call — the director called the CEO directly, on a number she already had.

That is the pattern worth internalizing. Verify through a channel the attacker does not control. Never respond to the message itself asking "is this you?"

Smishing and vishing: the phone becomes the trap

Smishing is phishing via SMS. It exploits a specific weakness: people trust text messages more than email, and they check them faster. A message claiming your package is delayed, or that your bank flagged a transaction, with a short link to "resolve" it.

Vishing is voice phishing. Someone calls claiming to be from your IT department or your bank's fraud team. The script is polished. They may already have partial information about you from a previous breach, which makes the call sound legitimate.

Here is what I tell people about vishing: no legitimate organization will pressure you to act during the call itself. Real fraud departments expect you to hang up and call back on the number printed on your card. When a caller discourages that — when they say "there is no time" or "this line is secure" — you are talking to an attacker.

Quishing and cloned login pages

Quishing is phishing through QR codes. It exploded because phones are harder to inspect than desktops. You cannot hover over a QR code to see where it goes. You scan, you land on a page, and you log in.

Cloned login pages are the destination these attacks lead to. The page looks identical to the real service. You enter your credentials. The attacker captures them in real time and often passes you through to the real site so nothing feels wrong. You only discover the breach later.

Attack type	Channel	Primary target	Typical red flag
Mass email phishing	Email	Anyone	Generic greeting, mismatched link
Spear phishing	Email	Specific individual	Accurate but slightly off personal details
Whaling	Email	Executives, finance	Urgent payment or access request
Smishing	SMS	Mobile users	Shortened link, delivery or bank pretext
Vishing	Phone	Anyone	Pressure to act during the call
Quishing	QR code	Phone scanners	Unexplained QR code in email or print

How to recognize a phishing email before it costs you

Recognition is a skill, not a checklist. But checklists help build the skill. Here are the signals I look for, roughly in the order I check them.

• The sender domain — not the display name. Anyone can set a display name to "PayPal Support." The domain behind it is where the truth lives.
• Where the link actually goes — hover on desktop, long-press on mobile. If the destination does not match the visible text, stop.
• The ask — what does the message want? Credentials, payment, or a click. All three deserve scrutiny.
• The emotional temperature — fear, urgency, or an unusually generous offer. Legitimate organizations rarely lead with panic.
• Odd formatting, mismatched fonts, or an attachment you did not expect

The single most useful habit: treat every unexpected login request as hostile until proven otherwise. Not paranoid — just defaulting to verification rather than trust.

How to identify phishing emails when the usual signs are missing

Modern attacks sometimes pass every visual check. Here is what I look at when nothing obvious is wrong.

First, the timing. Phishing often arrives outside normal business hours, when IT support is unavailable and you are more likely to act alone. Second, the request pattern. If a message asks you to do something you have never been asked to do before — reset a shared credential, approve a payment, confirm a personal detail — that novelty is itself a flag.

Third, and this is the one people overlook: check whether the message could have arrived through a more official channel. An HR policy update would come through your company's internal system, not a personal email. A bank alert would appear in your banking app. When the channel is wrong, the message is wrong.

How to prevent phishing attacks in your organization

Technical controls help. They are also not enough on their own, and pretending otherwise is how organizations get breached.

What actually reduces click rates

I have run simulated phishing campaigns with teams, and the results are consistent. The first simulation usually catches a meaningful share of people — often around a third will click something they should not. That number is not a failure. It is a baseline.

What moves the needle is repetition combined with immediate feedback. Not punishment. Teams that run monthly simulations and debrief each one — showing exactly what the tell was — see click rates fall to low single digits within a few months. The improvement comes from familiarity, not fear.

Layered on top of that, a few technical measures do real work:

1. Multi-factor authentication on every account that supports it — this alone neutralizes most credential theft, because a stolen password without the second factor is useless
2. Email filtering that flags external senders clearly, so an internal-looking message from outside the organization stands out
3. A simple, blame-free reporting button, so people report suspicious messages instead of deleting them and moving on
4. DMARC, SPF, and DKIM configured properly — these prevent attackers from spoofing your own domain

The reporting culture matters more than most people expect. If employees fear looking foolish for reporting a false alarm, they will stay silent when it counts. I have seen teams where the person who reported a suspicious email got public thanks from leadership. That single gesture did more for security awareness than any training module.

How to avoid phishing as an individual

You do not need to be a security professional to protect yourself. You need a few habits that run automatically.

Use a password manager. This is not a small tip — it is the single change that removes the most common payoff of a successful phishing attack. When you do not know your own passwords, you cannot be tricked into typing them into a fake page. The manager only fills credentials on the real domain.

Then, build one rule: never act on a link from a message you did not expect. Close it. Open a new tab. Navigate to the service directly. If the alert was real, it will be waiting for you there. If it was not, you just avoided the attack entirely.

And one more, which sounds trivial but has saved me twice: if a message makes you feel a spike of anxiety or excitement, treat that feeling as a warning rather than a reason to act. Attackers manufacture that spike on purpose. Recognizing it for what it is takes about two seconds — and those two seconds are usually enough.

The part nobody mentions

The phishing landscape in 2026 is not more sophisticated because attackers got smarter. It is more effective because the tools got cheaper and the targeting got easier. What once required a skilled operator now runs as a service, complete with templates and dashboards. The barrier to entry collapsed.

That means the volume will not decrease. Your inbox will keep receiving them. The only variable you control is how quickly you recognize the pattern — and whether you have built habits that hold up when you are tired, rushed, and not paying attention.

Which is, honestly, most of the time.

The question I keep coming back to is not "can I spot a phishing email?" It is "will I still spot one on a Friday afternoon when I am trying to leave?" That is the test that matters. And the only way to pass it is to make verification so automatic that you do it without deciding to.