Glossary
Phishing
Phishing is a message that pretends to be from someone you trust — a bank, a delivery company, a colleague, a streaming service — in order to get you to click a link, open an attachment, or hand over a password or money.
What it means
Phishing is a message that pretends to be from someone you trust — a bank, a delivery company, a colleague, a streaming service — in order to get you to click a link, open an attachment, or hand over a password or money. It works by borrowing trust: the message looks like something you already expect, arrives at a plausible moment, and asks for something small. The attacker does not need to break a security system if you open the door yourself.
How it works
Phishing arrives by email, text message, phone call, and fake websites, and the techniques have a vocabulary of their own: spear phishing targets one person with details gathered about them; smishing is phishing by text message; vishing is phishing by voice call; quishing hides the malicious link in a QR code. The common structure is constant — an attractive or alarming premise, a reason to act quickly, and a link or request that leads somewhere the sender controls. Modern phishing is often written cleanly, sometimes with the help of AI, so bad grammar is no longer a reliable warning sign. What still gives it away is the mismatch: a sender address that is almost but not quite right, a link that leads somewhere unexpected, or urgency designed to stop you thinking.
Example
Imagine a fictional user, Lena, who receives an email that looks exactly like her bank's: a warning about unusual activity, a request to verify now, and a link to log in. The bank's real domain is northbank.com; the email comes from northbank-alerts.com. The link leads to a login page that looks identical to the bank's. Lena does not click. Instead she opens her bank's own app, where there is no alert at all. The email was phishing; the app was the truth. That single habit — checking through a channel you control — defeats most phishing.
Common misunderstandings
Two old pieces of advice no longer work. The first is to look for bad spelling: AI-written phishing is grammatically clean. The second is to trust the padlock icon: HTTPS only means the connection is encrypted, not that the site is honest — a phishing site can have a valid padlock. The reliable checks are the sender's full address, the link's real destination, and whether the message pressures you to act before thinking.
Related terms
Learn more
- Phishing awareness
- How to spot a phishing email
- What to do if you clicked a phishing link
- Cybersecurity Awareness Path
- Back to the full glossary
Last checked: 14 November 2026.
Frequently asked questions
Can I trust a message just because it looks professional?
No. AI-written phishing looks polished, uses correct logos and proper grammar, and copies real message formats. Appearance is no longer a reliable signal — check the sender address, the link destination and whether the message pressures you to act.
What should I do with a phishing email?
Do not click anything in it. Report it through your email provider's report function, and if it pretends to be from a company you use, forward it to that company's official phishing reporting address. Then delete it.
I already clicked a phishing link. What now?
Stay calm and do not enter anything. Close the page, and if you downloaded a file, do not open it. If you entered a password, change it and any account that reused it, and turn on two-factor authentication. Our triage tool walks through the steps for your situation.