How does a phishing email work? An attacker sends a message that appears to come from a reputable source, creates urgency, and steers you to click, open or reply. Checking the real link and sender before acting breaks the chain.
This guide follows the attack from the attacker’s side, then turns each stage into a check you can make. For the wider picture, see how to protect yourself from hackers.
The attack from the attacker’s side
Microsoft describes phishing as an online scam where criminals trick people into giving away sensitive information. Check Point explains the mechanism: phishing messages manipulate a user into actions such as installing a malicious file, and the manipulation relies on social engineering, which uses psychology to influence the target. The email is only the delivery vehicle. The real target is a quick decision by a person.
Research and targeting
Preparation comes first. A phisher may use public resources, especially social networks, to collect background information about the people they want to reach, according to Check Point. Details on public profiles are raw material for a convincing message, so it is worth reviewing what yours reveal.
Dressing the message as a trusted source
Zscaler notes that phishing attacks begin with an email, phone call, SMS message or social media post that appears to come from a reputable source. In email, the sender line is easy to fake. Check Point points out that the sender field in an email is just data and is under the control of the sender. The name and address you see are a costume, not proof of identity.
Applying pressure
Next the attacker adds a deadline or a threat. Zscaler says phishers carefully create a sense of urgency that fools the victim into lowering their guard. Check Point adds that phishers hope you will read the email in a hurry and skip scrutiny. The pressure is part of the design, so a pause is the cheapest defence available.
The hook: a link, an attachment or a request
The message ends in an action. A link may lead to a page built to capture a login. Attackers disguise it in several ways. Check Point notes that link shorteners like bit.ly conceal the target destination of a URL, and Microsoft says phishing links sometimes contain misspellings, extra characters or unfamiliar domains. An attachment may carry a malicious file. Or the message may simply ask you to hand over information. Installing a malicious file is one route from phishing to wider malware trouble, and the mechanics of one such attack are covered in How Ransomware Works: Inside Attacks, Payments, and Practical Defenses (2026 Guide) – Cubeguard.
Types of phishing and how they differ
The same trick appears in several channels and at different levels of targeting. The table compares the main types so you can see which habits protect you against each.
| Type | How it works | Planning use |
|---|---|---|
| Phishing (email) | A message from an apparently reputable source tries to prompt a harmful action | Check the link and sender before acting on any unexpected email |
| Spear phishing | Targets specific individuals whose personal details the attacker already knows to some extent | Personal detail is not proof of legitimacy; verify through a separate channel |
| Whaling | Targets senior management and other highly privileged roles | Leaders and finance or admin staff need the strictest verification habits |
| Smishing | Text messages sent to mobile devices try to get victims to give out personal information | Treat unexpected texts like unexpected emails |
| Vishing | The same approach as smishing, carried out over a phone call | Do not give information to a caller who contacted you first |
| Pharming | Attackers hijack the functionality of a Domain Name System (DNS) server to redirect users | Harder to spot by eye, so rely on layered protections as well as vigilance |
| Angler phishing | Fake social media accounts belonging to well-known organisations | Confirm an organisation’s account through its official website |
The descriptions are drawn from Zscaler’s phishing glossary and Check Point’s phishing overview.
Smishing deserves attention because a phone makes quick reactions easy: a short text with a link gets less scrutiny than a full email. A fake bank text is the classic example.
Red flags to check before you act
Most phishing messages give themselves away on at least one of these points. Check them in this order and stop at the first failure.
- An unusual, unexplained request. Zscaler calls an email asking you to do something unusual, especially without explanation, a big red flag.
- A near-match sender address. Microsoft warns that scammers use addresses that look similar to real ones but have small differences. Read the full address, not only the display name.
- A link that leads somewhere else. Hover over links without clicking to see where they really lead. Inconsistent email addresses and web domains are another warning sign.
- An unrequested attachment. Microsoft says legitimate companies rarely send attachments, so an unexpected file deserves suspicion.
- A request for secrets. According to Microsoft, no legitimate company will ask you to provide passwords, credit card numbers or Social Security numbers over email.
- Pressure to hurry. Urgency is a tactic, not evidence of a real emergency.
If something seems off, do not click it. At work, report the email to your IT department, as SOCRadar advises. Contact the organisation through a channel you already trust rather than through the message itself.
What to do after clicking
Clicking is not the end if you act quickly. Microsoft’s guidance is that if you engage with a phishing email, act fast by changing passwords, notifying relevant parties and reporting the email. In practice, work through these steps in order:
- Stop interacting. Do not click further links, open more attachments or reply.
- Change the affected passwords. Start with any account whose login you typed or whose password you reuse elsewhere.
- Notify the right people. At work, tell IT. For a personal account, contact the service or bank the message imitated through its official channel.
- Report the email. Reporting helps providers and IT teams block the same message for others.
- Check that multi-factor authentication is on. SOCRadar says that even if attackers steal credentials through spear phishing, multi-factor authentication can prevent unauthorized access. Two-factor authentication is the common form of this.
Zscaler describes measures such as MFA as creating additional layers of defence between attackers and your internal systems. For a different approach to sign-in, what is a passkey explains how passkeys work and how they compare with passwords.
Frequently asked questions
How is spear phishing different from ordinary phishing?
Mitnick Security describes ordinary phishing as a broad, non-personalised attack and spear phishing as a calculated, target-specific one. Spear phishing generally requires the attacker to research the victim first, and the message is personalised for a specific person or organisation.
Does multi-factor authentication make a click harmless?
No. It can block access even when a password has been stolen, but it works as an extra layer rather than a cure. You should still change affected passwords and report the message.
Can phishing start somewhere other than email?
Yes. Zscaler lists phone calls, text messages and social media posts as starting points, and Check Point describes fake social media accounts of well-known organisations. The same checks apply: question the request, verify the sender independently and avoid acting under pressure.
