Skip to content
Know.itKnow.it
Create an animated lesson
On request

This article is free to read. Creating a lesson uses your daily or stored credits; review the language and settings before starting.

How does phishing work?

TechnologyLesson on requestFree to readयह पेज हिंदी में पढ़ें

Quick answer

Phishing is a cyberattack where criminals send fake messages that look like they come from a trusted organisation. The message pushes you to click a link and enter passwords or payment details on a copycat website. The attacker captures that data and uses it to break into your real accounts.

Phishing works by sending fraudulent messages that impersonate trusted sources, tricking people into revealing passwords, card numbers or clicking malicious links. Attackers then use those credentials to access accounts, steal money or install malware.

Step by step

  1. The attacker chooses a target, such as customers of a specific bank or employees of a company.
  2. They create a fake email, text, or website that closely imitates the real organisation's branding.
  3. The message is sent to many people, often with a story that demands urgent action.
  4. A victim clicks the link and lands on a counterfeit login page controlled by the attacker.
  5. The victim types their username, password, or card details into the fake page.
  6. The attacker records the stolen data and uses it to access the real account or sell it.

Key things to understand

  1. Phishing starts with a message that mimics a bank, employer, or popular service you trust.
  2. The message creates urgency, fear, or curiosity to make you act without checking carefully.
  3. It contains a link to a fake website that looks identical to the real login page.
  4. When you enter your username and password, the site sends them straight to the attacker.
  5. The attacker then logs into your real account, often changing passwords to lock you out.

Labelled diagram

  1. Attacker

    Criminal creates a fake message and a copycat website that looks real.

  2. Fake message

    Email or text is sent to many people, using urgency to prompt a click.

  3. Victim clicks

    The person follows the link, believing it is from a trusted source.

  4. Fake login page

    Victim enters username, password, or card details into the attacker's site.

  5. Data captured

    The attacker records the credentials and uses them to access the real account.

How a phishing attack unfolds

Real-world examples

  • A fake email from 'PayPal' warns that your account is limited and asks you to confirm your password via a link.
  • A text message pretending to be from a delivery company says a parcel is waiting and requests a small redelivery fee.
  • An email that looks like it comes from your company's IT department asks you to reset your password on a fake portal.
  • A social media message from a 'friend' says they are stranded and need you to log into a game site to help them.

Common mistake

✗ Myth: Phishing emails are always full of obvious spelling mistakes and come from strange addresses.

✓ Fact: Many phishing messages are carefully written and use genuine-looking logos and email addresses that differ from the real one by only a character or two. Always verify the sender through a separate, trusted channel.

People also ask

What is the difference between phishing and spam?
Spam is unsolicited bulk email, often advertising products, and may be annoying but not always dangerous. Phishing is a specific type of spam designed to steal personal information or install malware by impersonating a trusted entity. All phishing is spam, but not all spam is phishing.
Can phishing happen on social media?
Yes. Attackers create fake profiles or send messages that look like they come from friends or brands. They may ask you to click a link to view a video, claim a prize, or log in to a site. Social media phishing often spreads through direct messages and fake login pages.
What should i do if i think i've been phished?
Immediately change the password for the affected account and any other account that uses the same password. Enable two-factor authentication. Contact your bank if financial details were shared. Report the phishing message to the real organisation and to your email provider.
What happens if I click a phishing link but don't enter any information?
Clicking alone can still be harmful. The fake page may download malware to your device, or simply confirm that your email address is active, leading to more targeted attacks. Always close the page and run a security scan if you are unsure.
How can I tell if an email is a phishing attempt?
Check the sender's full email address, not just the display name. Hover over links to see the real web address. Look for urgent language, spelling errors, and requests for personal information. Legitimate companies rarely ask for passwords by email.
What is spear phishing?
Spear phishing is a targeted attack aimed at a specific person or small group. The attacker researches the victim using social media and company websites to craft a highly convincing message. It is harder to spot because it often references real projects, colleagues, or personal details.
Does two-factor authentication stop phishing?
Two-factor authentication (2FA) makes phishing harder but does not stop it completely. Attackers can use fake login pages that capture both your password and the one-time code in real time. However, 2FA still blocks many automated attacks and is strongly recommended.

Part of the guide: How the Internet Works →