What is phishing?

Phishing is an attack on your attention, not on your computer. Nothing needs to be hacked, no software needs to be vulnerable, and no malware needs to run. Someone sends you a message that looks like it comes from a service you already use, gives you a reason to hurry, and puts a link in front of you. If you act inside that message, the attack has already worked.

That framing matters, because it explains why phishing survives every technical countermeasure thrown at it. Spam filters improve, certificates get cheaper, browsers get warier, and phishing keeps working, because the thing being exploited is the very ordinary human habit of acting on a message that appears to be legitimate.

How phishing actually works

Every phishing attack has three moving parts. Understanding them is more useful than memorising a list of warning signs, because the parts stay the same while the surface details change constantly.

The pretext: a reason to hurry

The message manufactures a small emergency. Your account will be locked. A payment failed. A parcel is waiting on a customs fee. Someone shared a document with you and is waiting for your comment. The specific story is irrelevant. Its only job is to move you from reading to acting without a pause in between, because the pause is where people notice things.

Urgency is the one component attackers cannot drop. A message that says “log in whenever you have a spare moment” gives you time to think, and time to think kills the attack.

The channel: something you already trust

Email is the classic channel, but it is not the only one. The same pretext arrives by SMS, by WhatsApp, in a LinkedIn message, in a calendar invitation, inside a shared document comment, or as a QR code on a parking meter sticker. Attackers follow trust. If a channel feels official to you, it is worth their effort.

The landing point: a page that only needs to look right briefly

The link leads somewhere that resembles the real login page. It does not need to be a perfect replica and it does not need to survive scrutiny. It needs to look convincing for the twenty seconds it takes you to type a password.

Increasingly it is not even a copy. A relay page sits in the middle, showing you the genuine site while capturing everything you type and passing it straight through to the real service.

Why the advice you were given stopped working

Most people were taught to inspect the message. That advice made sense once. It is now close to useless, and worse, it produces confidence exactly when confidence is unwarranted.

“Look for spelling and grammar mistakes.” Broken English used to be a reliable tell. Language models write flawless copy in any language, for free, at scale. The typos are gone. What remains is a filter that catches only the laziest attempts while teaching you that well-written means safe.

“Check for the padlock.” The padlock means the connection is encrypted. It has never meant the site is honest. Certificates are free and automated, so a phishing page has the same padlock your bank has. It always did mean less than people thought, and now it means nothing at all as a trust signal.

“Hover over the link and read it.” Better advice, but weakened from several directions at once. Lookalike domains exploit characters your eye glides over. Attackers route through genuine, reputable redirect and tracking domains, so the visible URL belongs to a real company. And legitimate senders have trained everyone to accept strange URLs, because marketing email routes almost every link through a tracking domain that looks nothing like the brand.

The uncomfortable conclusion is that real messages and fake ones have converged. You cannot inspect your way out of this reliably, which is why the defence has to move somewhere other than your eyes.

The variants worth knowing

Reply-chain hijacking

This is the one that catches careful people, and it is the one worth understanding properly.

An attacker gets access to somebody’s mailbox, often through an earlier, more ordinary phishing success. Rather than sending fresh messages, they go looking through existing conversations, find a real thread that is genuinely ongoing, and reply inside it.

Every trust signal a person normally checks is authentic. The sender address is real, because the mailbox really was compromised. The subject line is a conversation you actually took part in. The quoted history below the reply is your own writing. The tone matches, because the attacker has read the thread. The message arrives when a reply is expected, from someone who has legitimate reason to send you a file or a link.

There is nothing to spot. The thread is real and the person’s account is real. Only the newest message is not. This is why “does it look legitimate” fails as a defence: here, it is legitimate in every way except intent.

Spear phishing

Targeted rather than mass-produced, and built from real details about you: your employer, your role, a project name, a colleague. Individually those details are public, on a company site or a professional profile. Assembled into one message, they produce something that feels like it could only have come from an insider.

Smishing and quishing

The same attack over SMS, or hidden behind a QR code. QR codes are effective for attackers because a code carries no readable URL, so the inspection habit has nothing to work with, and because they get scanned on phones, where the address bar is truncated and people are usually distracted and standing up.

Real-time relay and MFA fatigue

The modern version, and the reason “just turn on 2FA” is no longer a complete answer. The phishing page proxies your session live. You enter your password, it forwards it. The real site asks for your authenticator code, the page asks you for it, you supply it, and it is replayed within seconds. You end up logged in successfully, so nothing feels wrong, while the attacker holds a valid session.

MFA fatigue is the blunter cousin: repeated push notifications at eleven at night until somebody taps approve to make the buzzing stop.

What actually defends you

One habit, and it beats every checklist

Never act from inside the message. Read it, take whatever information it gives you, and then reach the service your own way: a bookmark, the app on your phone, or the address typed by hand. If your account genuinely has a problem, the problem will be waiting for you when you arrive. If nothing is waiting, the message was a lie and you have lost nothing but a few seconds.

This works because it is indifferent to how convincing the message was. It requires no judgement about grammar, sender addresses or URLs, and it holds up perfectly against a hijacked reply chain, where judgement has nothing to work with. The companion piece on why you should never click a link in an email walks through the habit in practice.

Passkeys and hardware keys close the relay hole

A passkey is cryptographically bound to the domain it was created for. Presented with a lookalike, it does not produce a weaker response or prompt you to confirm. It produces nothing at all, because from its perspective the site is simply not the site. The same is true of a hardware security key. This is the one countermeasure that defeats the real-time relay outright, and it is why “phishing-resistant” is a specific technical claim rather than marketing language.

A password manager is a phishing detector

This is its most underrated property. A password manager matches saved credentials against the domain, so on a lookalike page it quietly declines to fill anything in. That silence is a machine performing a comparison your eyes cannot perform reliably. When autofill unexpectedly does not offer anything, treat it as a warning rather than an inconvenience.

Make the recovery path boring

Phishing frequently targets the account that controls the others. Email is usually that account. Give it a passkey or hardware key, check which recovery addresses and phone numbers are attached, and remove anything you do not recognise. Attackers who gain access often add a recovery address or a forwarding rule so they keep access after a password reset, which is why the checklist above includes looking for exactly that.

Who is actually at risk

Everyone, but not identically. For most people the exposure is financial and personal: banking, parcels, tax letters, streaming subscriptions.

For developers there is a second front. The same social engineering arrives as a package that resembles one you rely on, a pull request from an account that resembles a maintainer, or a CI secret request that resembles routine housekeeping. That crossover is why supply chain attacks belong in the same mental category: a phished maintainer account is the beginning of a great many of them.

Increasingly, software gets phished as well as people. An AI agent reading a web page on your behalf can be handed instructions hidden in that page, which is prompt injection and behaves remarkably like phishing aimed at a machine. The pretext is the same. Only the reader has changed.

FAQ

Can I reliably spot a phishing email just by looking at it?

No, and building your defence on that is the mistake. Modern phishing has clean grammar, valid certificates and, in reply-chain attacks, a genuine sender and a real conversation history. Inspection catches the lazy attempts and gives false confidence about the good ones. Change the habit instead of sharpening the eye.

Does two-factor authentication stop phishing?

App codes and SMS codes do not. A real-time relay page collects your password and your six-digit code and replays both to the real site within seconds. Passkeys and hardware security keys do stop it, because the credential is cryptographically bound to the real domain and simply will not respond to a lookalike.

I clicked. What should I do right now?

Change the password for that account from a tab you opened yourself, not from any link. Then sign out all sessions in the account’s security settings, because the attacker may already hold a valid session cookie. Check for new mail forwarding rules or added recovery addresses, which is how access gets kept after a password change. If it was a work account, tell whoever handles security immediately.

Spotted something wrong or missing?

5bats would rather be corrected than confidently wrong. If anything here is inaccurate, out of date, or a threat is missing, reach out over Session or email , corrections and additions are genuinely welcome.

Keep the tools free

This guide and the tools it points to are free and self-funded. If the work is useful, becoming a sponsor keeps it maintained, CVE-scanned and free for everyone. No account, no third-party tracker, just a plain link.