What Is Phishing: Common Tactics, Real Examples, and How to Prevent Phishing Attacks and Stay Safe From Online Scams

Phishing is the most frequently reported cybercrime in the United States, and the messages carrying it now arrive by text, voice call, QR code, and video meeting as often as by email. Generative AI has stripped out the misspellings and clumsy phrasing that once exposed a fraudulent request. What remains is a credible message, a plausible deadline, and one employee deciding whether to comply.

That decision point sits beyond the reach of most technical controls. According to Verizon's 2026 Data Breach Investigations Report, the human element was present in 62% of breaches, a share that has climbed for two consecutive editions. Filters, browser warnings, and identity controls narrow exposure, yet none of them can judge whether an urgent payment request from a familiar name is genuine.

This guide covers:

• How phishing attacks progress from target research to account takeover, payment fraud, or ransomware access;
• The full range of phishing types across email, mobile, voice, social media, QR codes, and video;
• How AI deepfake phishing dismantles the warning signs employees were once taught to trust;
• The phishing red flags, quick checks, and safe inspection habits that expose a fraudulent request;
• Incident response steps after a click, a credential entry, or an approved authentication prompt;
• Reporting routes for phishing email, text, voice scams, and business fraud;
• Prevention controls and cybersecurity awareness training programs that measurably reduce phishing risk.

Every hour a fraudulent request sits unreported gives cyberattackers room to expand access across connected accounts and payment systems. Adaptive Security turns employee reporting into containment within minutes.

Take a self-guided tour

What Is Phishing and What Does It Mean in Cybersecurity?

Phishing is a social engineering cyberattack that deceives a person into revealing information, transferring money, installing malware, or taking another unsafe action. Cyberattackers use email, websites, phone calls, text messages, or video to impersonate a trusted person or organization, then create enough urgency or confidence for the target to comply. Unlike a technical exploit, phishing manipulates human judgment first, although the resulting action can expose credentials, compromise an account, or deliver malicious software.

The volume behind that definition is substantial. According to the APWG Phishing Activity Trends Report, 1st Quarter 2026, the group recorded 971,181 phishing attacks in the first quarter of 2026, a rise of 13.8% over the previous quarter.

Where the Word Phishing Came From

The word phishing combines "fishing" with the altered spelling associated with early hacker culture. The metaphor is precise, because a cyberattacker casts a lure, waits for a response, and attempts to hook a target into surrendering something valuable. Early campaigns focused on online service accounts and payment details, but the technique now spans email, messaging apps, social platforms, phone calls, QR codes, and video meetings.

The terminology changed as the cyberattack changed. Early phishing often relied on bulk emails, obvious fake login pages, and poorly written requests. Modern campaigns use spoofing, compromised legitimate accounts, lookalike domains, stolen branding, and information gathered from public sources.

The objective has stayed constant: make an unsafe action appear ordinary before the target has time to verify it. Phishing is defined neither by the delivery channel nor by the quality of the grammar. A polished email sent to one finance employee qualifies, while a poorly written message can be harmless spam; the defining feature is deception intended to produce a security-impacting action.

Phishing as Social Engineering

Phishing belongs to the broader category of social engineering, which uses psychological manipulation to influence a person's decision. Instead of exploiting a software vulnerability, the cyberattacker persuades someone to open a file, approve a payment, disclose a password, bypass a procedure, or trust a false identity. A 2024 systematic review of organization-focused phishing research describes the technique as a multi-phase cyberattack involving target research, deceptive interaction, exploitation of obtained information, and efforts to conceal the activity.

The distinction between phishing and a technical exploit matters because technical controls cannot address every stage. Secure email configuration, malware scanning, browser warnings, and identity controls block many malicious artifacts. None of them reliably determine whether an employee should trust an urgent request that appears to come from a manager, supplier, customer, or government agency.

Phishing typically combines several forms of deception:

• Credential harvesting collects usernames, passwords, authentication codes, or session tokens through fake login pages, forms, messages, or calls;
• Spoofing falsifies an email address, phone number, website, sender name, or other identity signal so a message is disguised as one from a trusted source;
• Business email compromise (BEC) is a fraud scheme in which a cyberattacker impersonates or compromises a business account to induce payments, change banking details, disclose sensitive information, or perform another unauthorized business action;
• Open-source intelligence (OSINT) is information collected from publicly available sources, such as company websites, professional profiles, social media posts, conference videos, press releases, and public records.

OSINT gives spear phishing its precision. A cyberattacker can identify who approves invoices, which vendors a company uses, when an executive is traveling, or how a department formats payment requests. The resulting message does not need to look credible to everyone, only to one intended recipient.

Phishing also overlaps with impersonation, pretexting, and malware delivery, though those terms describe different parts of the cyberattack. Impersonation establishes a false identity, pretexting creates a fabricated situation that makes a request seem legitimate, and malware is harmful software that can be delivered after a target clicks, downloads, or enables content. Phishing is the deceptive method that connects these elements and turns trust into access.

The cyberattack can succeed without malware. A fake invoice request can cause a wire transfer even when no device is infected, and a counterfeit Microsoft 365 login page can capture credentials without exploiting the browser. A phone call can persuade an employee to disclose a one-time code, so treating phishing only as a malicious-file problem leaves these human-led paths exposed.

Spam, Phishing, and Malware Compared

Spam, phishing, and malware are related without being interchangeable. Spam is unwanted or unsolicited communication, usually sent in bulk for advertising, promotion, scams, or other purposes. Spam is inconvenient and sometimes dangerous, yet it does not always attempt to steal information or induce an unsafe action.

Phishing is deceptive communication built to manipulate a target into an action that benefits the cyberattacker. A phishing email might request a password, direct the recipient to a fake payment portal, request a wire transfer, or pressure the recipient to open an attachment. Mass campaigns work at scale, while targeted messages tend to convert more often because the content matches the recipient's role and circumstances.

Malware is software built to disrupt operations, damage systems, spy on users, steal data, or provide unauthorized access. Ransomware, spyware, remote-access tools, and credential-stealing software all qualify. Phishing can deliver malware, although malware also arrives through compromised websites, vulnerable software, malicious advertisements, removable media, or unauthorized downloads.

A short comparison clarifies the relationship:

• Spam is primarily about unwanted volume,
• Phishing is about deception and an unsafe decision,
• Malware is about harmful software and its technical impact.

One message can fit all three categories. A cyberattacker might send millions of unsolicited emails, impersonate a payroll provider, and attach malware disguised as a tax document. That message is spam because it is sent in bulk, phishing because it manipulates recipients, and malware delivery because the attachment installs harmful code.

The response should match the category. Filtering and unsubscribe controls handle ordinary spam, independent verification handles a suspected phishing request, and isolation or immediate reporting handles suspected malware. For organizations, phishing simulations and cybersecurity awareness training give employees practice across email, voice, SMS, and other channels before a genuine request reaches a decision point.

Phishing is a cyberattack on trust, context, and timing. The cyberattacker's technology creates the disguise, while the target's decision determines whether the campaign becomes credential theft, financial fraud, malware infection, or a wider breach.

Definitions alone leave employees unprepared when a convincing request lands during a busy Friday afternoon. Adaptive Security converts that understanding into rehearsed decisions through realistic, role-specific phishing simulations.

Explore the platform

How Does a Phishing Attack Work?

A phishing attack selects a valuable target, builds a believable pretext, delivers a deceptive message, and persuades the recipient to reveal information, transfer money, or run malicious code. Cyberattackers combine psychological pressure with lookalike domains, fake login pages, compromised accounts, and legitimate cloud services. The sequence is worth understanding in order, because each stage offers defenders a different interruption point, and the safest checkpoint remains a pause, an independent verification, and a report of anything suspicious.

1. What Are the Typical Steps of a Phishing Attack?

Target selection starts the cyberattack. Criminals choose people who can approve payments, access customer data, reset credentials, or influence others. Finance employees, executive assistants, administrators, and privileged IT users carry more value than random recipients because public information reveals reporting lines, suppliers, travel schedules, and active projects.

Reconnaissance follows. Cyberattackers assemble a convincing story from the OSINT sources described earlier, adding public filings and breached credentials to the mix. A compromised account makes this stage easier because the intruder can read genuine conversations, copy a familiar writing style, inspect shared files, and identify active projects without creating a suspicious identity.

The lure centers on a specific outcome, asking the recipient to review a document, confirm a payroll change, approve an overdue invoice, or join an urgent video meeting. Phishing-as-a-service operators package these campaigns for other criminals with templates, hosting, credential collection, and dashboards, which turns a fake login page into a repeatable business process rather than a one-off cyberattack.

Delivery can occur through email, text message, voice call, social media, collaboration software, or a shared document. Cyberattackers favor legitimate services such as cloud storage, file-sharing platforms, and online forms because those domains are familiar and often permitted by corporate systems. Familiar infrastructure does not make an unfamiliar request safe.

The interaction pushes the recipient to act by clicking a link, opening an attachment, scanning a QR code, answering a call, approving an MFA prompt, or entering information into a form. The page may imitate a Microsoft 365, Google, banking, payroll, shipping, or benefits portal. A pop-up may claim that the session expired, or a counterfeit browser error may instruct the user to follow a recovery step.

Data capture or malware execution follows. A fake website can collect a username, password, MFA code, security answer, or payment-card number, while a malicious attachment can install malware or prompt the user to enable macros. An adversary-in-the-middle (AiTM) page can relay a login session, letting the intruder capture an authenticated session in place of a password alone.

Follow-on abuse turns the interaction into an access event. Stolen credentials open email, cloud applications, payment systems, customer databases, or internal collaboration spaces. From there, criminals send more credible phishing messages, create forwarding rules, steal documents, change supplier payment details, or launch ransomware.

The scale of that pipeline is visible in national reporting data. According to the FBI Internet Crime Complaint Center's 2025 Internet Crime Report, IC3 received 1,008,597 complaints during 2025 and recorded $20.877 billion in reported losses, a 26% increase over the prior year. Organizations should train employees to interrupt the sequence before the click, the reply, or the approval.

2. Which Psychological Triggers Make Phishing Effective?

Psychological triggers make phishing effective because cyberattackers shape decisions under pressure rather than present a technical puzzle. Pretexting supplies the fictional situation, while emotion supplies the momentum. Employees should treat emotional pressure as a signal to slow down and verify.

Urgency is the most familiar trigger. A message says an account will close within the hour, a payment must clear before a deadline, or a document requires immediate approval. The compressed time frame discourages independent verification, so an urgent request should activate normal controls instead of bypassing them.

Fear creates a different form of pressure. A fraudulent account alert, disciplinary notice, legal demand, or security warning suggests that inaction will cause personal or organizational harm. The cyberattacker then presents a malicious link or phone number as the only way to prevent that harm.

Authority exploits respect for a manager, executive, bank, government agency, supplier, or technical support team. A BEC attempt can impersonate a chief financial officer and request a wire transfer, while a stolen account makes the same request look like it came from a genuine colleague, removing many obvious warning signs. Voice-led pretexting has become common enough that Verizon's 2026 Data Breach Investigations Report records it as an initial access vector in 6% of all breaches.

Curiosity drives document lures, confidential announcements, and messages about layoffs, acquisitions, or investigations. Financial pressure appears in fake refunds, overdue bills, tax notices, payroll changes, and delivery fees, while greed and opportunity promise a reward, exclusive access, or an unexpected payment.

Cyberattackers frequently combine triggers. A fraudulent executive message can create authority, add financial pressure, impose a deadline, and request secrecy all at once. Employees should not be blamed for encountering persuasive social engineering, and they should rehearse a clear response: stop, inspect the request, verify the person and destination independently, then report the message.

3. Which Technical Methods Help Phishing Evade Detection?

Technical evasion begins with identity imitation. A lookalike domain replaces a trusted address with a visually similar one, while typosquatting registers a domain based on a common typing error. Homograph cyberattacks use characters from different alphabets that resemble ordinary letters, and sender display names can show a manager's name while the underlying address belongs to an unrelated domain.

Fake websites and data-entry forms complete the impersonation. A cloned sign-in page copies logos, colors, page structure, and familiar authentication prompts, and some forms redirect the recipient to the genuine service after collection to reduce suspicion. Employees should open sensitive services by typing the known address directly instead of following an unsolicited link.

Attachments create another path, because a document can contain malicious code, exploit software, or instructions that persuade the recipient to enable a blocked feature. Cyberattackers also use password-protected archives, invoice formats, and cloud-hosted documents to make the payload appear routine.

Compromised accounts and legitimate services weaken simple filtering. Messages sent from a genuine colleague, shared through an approved cloud platform, or posted in a familiar collaboration channel inherit trust from the account or service. Unusual payment changes, credential resets, sensitive downloads, and requests for secrecy all warrant confirmation through a route the sender did not supply.

Phishing infrastructure also changes rapidly. Fast fluxing rotates domains or IP addresses so defenders have less time to block a campaign, while pop-ups, counterfeit CAPTCHA checks, and fake browser error pages persuade users to paste commands, download software, or complete a security step that benefits the criminal. Content injection can place malicious instructions inside a legitimate webpage, document, advertisement, or compromised account.

Speed compounds every one of these techniques. According to the CrowdStrike 2026 Global Threat Report, average adversary breakout time, the window between initial access and lateral movement, has fallen to 29 minutes, with the fastest intrusion measured at 27 seconds.

These methods work together in practice. A message can arrive from a compromised account, use a lookalike login page hosted on a legitimate service, and capture credentials before redirecting to the genuine site, yet a trained recipient who stops and confirms the request breaks the chain before the lure becomes an account takeover.

Cyberattackers rehearse their pretexts, while most employees meet one for the first time under deadline pressure. Adaptive Security reverses that imbalance with repeated practice across every channel.

Take a self-guided tour

What Are the Different Types of Phishing Attacks?

Types of phishing attacks differ by the channel they use, the people they target, and the outcome they seek. Bulk email casts a wide net, while spear phishing, whaling, and business email compromise concentrate on specific people, roles, or transactions. The practical test stays consistent across all of them: identify where the message arrives, what action it requests, and whether that action could cause credential theft, payment fraud, malware delivery, or session theft.

Email and Targeted Identity Deception

Email phishing remains the broadest category because one message reaches thousands of inboxes at low cost. Cyberattackers impersonate a bank, cloud provider, delivery company, or employer, then pressure recipients to click a link, open an attachment, confirm account details, or make a payment. Common warning signs include unusual urgency, a mismatched sender domain, an unexpected attachment, or a login page reached through an email link.

• Bulk email phishing: An untargeted campaign sends similar messages to a large audience, typically seeking credentials, malware delivery, or small payments. Generic greetings, claims that an account faces imminent closure, and links that do not match the stated organization are the usual tells;
• Spear phishing: A targeted message uses personal or workplace details gathered through OSINT to appear relevant to one employee or team. The objective is often credential harvesting, malware delivery, or access to an internal system. An unusually specific request is a reason to verify through a known contact route rather than proof of legitimacy;
• Whaling: This is spear phishing aimed at senior executives, finance leaders, or other high-value decision-makers. The criminal seeks authority, sensitive information, or a large transfer. Requests involving confidential deals, payroll, legal documents, or an urgent wire require independent confirmation;
• Business email compromise (BEC): BEC uses a compromised or impersonated business account to manipulate invoices, payroll, vendor payments, or sensitive data, and it often avoids malware entirely in favor of a believable conversation. According to the FBI's 2025 Internet Crime Report, BEC generated $3.046 billion in reported losses across 24,768 incidents, averaging roughly $123,000 per case, which makes call-back verification and dual approval essential for payment-change requests;
• CEO fraud: CEO fraud is a form of BEC that impersonates a chief executive or another authority figure, usually combining urgency with confidentiality. Typical requests involve buying gift cards, transferring funds, or bypassing normal approval. An executive request that discourages consultation with colleagues requires verification;
• Clone phishing: The criminal copies a legitimate message, attachment, or conversation and replaces its link, file, or payment details. Because the format resembles a message the recipient has already seen, the replacement escapes casual inspection. Comparing the new sender address, destination domain, and attachment context with the original conversation exposes the swap;
• Barrel phishing: Barrel phishing uses two linked messages, the first establishing familiarity or delivering a harmless attachment and the second presenting the malicious request. A seemingly benign first email does not validate a later link, file, or login prompt;
• Trap phishing: Trap phishing places a lure where a target expects useful information, such as a shared document, support ticket, job application, or customer inquiry. The criminal waits for the recipient to engage before requesting credentials or installing malware. Verifying the source and destination before opening files from an unfamiliar workflow closes that gap.

These email types vary in precision, though the defensive response stays consistent. A familiar logo, an existing email thread, and a known display name are presentation, never authentication. Employees should confirm the request using a phone number or directory entry located independently, then report suspicious messages before deleting them so the security team can investigate related attempts.

Mobile, Voice, Social, QR, and Wi-Fi Phishing

Phishing is no longer confined to the inbox. Mobile and voice channels exploit speed, personal attention, and the assumption that a phone call or text carries more authenticity than an email. A structured phishing simulations program should rehearse these channels so employees practice verification before an unfamiliar request arrives.

• Smishing: Smishing is phishing delivered by SMS or another messaging service, with common lures covering package delivery fees, unpaid tolls, account alerts, and multifactor authentication (MFA) notices. Warning signs include a shortened link, an unfamiliar number, or a demand to act immediately from a personal device;
• Vishing: Vishing is voice phishing delivered through a phone call, voicemail, or voice message to obtain credentials, payment, or sensitive information. The caller may impersonate a bank employee, help desk analyst, police officer, or colleague. A confident tone is never grounds for disclosing a one-time code or approving a login;
• Callback or hybrid vishing: Callback phishing begins with an email or document telling the recipient to phone a number about a suspicious charge, subscription, or invoice. The call supplies social pressure and may direct the target to install remote-access software or reveal account details. A phone number supplied in an unsolicited message stays untrusted even when the message impersonates a genuine company;
• Quishing: Quishing, or QR code phishing, hides a malicious URL inside a QR code. The code can appear on a parking meter, invoice, poster, package notice, or printed letter and send a phone to a counterfeit login page. Previewing the destination before opening it, and declining to enter credentials after scanning a code from an unfamiliar source, prevents most of these cases;
• Angler phishing: Angler phishing uses social media, online reviews, or public support threads to impersonate a brand representative. After a user complains or asks for help, the criminal sends a direct message requesting account details or directing the user to a fake support page. Contacting the organization through its verified website settles the question quickly;
• Pharming: Pharming redirects a user from a legitimate address to a fraudulent site through poisoned DNS settings, a compromised router, or malicious software. Unlike ordinary phishing, the victim can type the correct address and still reach the wrong destination. Secure DNS, endpoint protections, and certificate checks limit the exposure;
• Evil twin Wi-Fi attacks: An evil twin is a rogue wireless network that imitates a hotel, airport, office, or coffee shop connection, allowing the operator to intercept traffic, present a fake sign-in page, or capture credentials. Confirming the network name with staff, avoiding sensitive logins on open Wi-Fi, and preferring a trusted cellular connection reduce the risk;
• MFA fatigue or prompt bombing: The criminal repeatedly sends MFA prompts until the target approves one to stop the disruption. The cue is a sudden series of login requests, often followed by a caller claiming to be IT. Every unrequested prompt should be denied and reported rather than accepted for convenience.

Changing channels does not change the underlying manipulation. The cyberattacker still builds a believable identity, introduces pressure, and asks an employee to perform an irreversible action. Employees who pause, verify, and report provide an active control across every channel, including the authenticated workflows that criminals increasingly target.

Advanced Phishing Methods and Account Takeover

The most damaging phishing methods bypass simple link inspection by targeting authenticated sessions, trusted websites, or high-value workflows. These cyberattacks call for controls that protect both the credential and the session established after login. Credential abuse still accounts for 13% of all breaches in Verizon's 2026 Data Breach Investigations Report, even as exploitation of software vulnerabilities rose to 31% and became the leading initial access route for the first time.

• Search engine phishing or SEO poisoning: Cyberattackers manipulate search results or advertisements so a fake support, banking, or software-download page appears for a trusted query, usually leading to credential theft or malware delivery. Reaching sensitive services through a bookmarked, verified link avoids the first result entirely;
• Watering-hole attacks: A compromised website frequented by a particular industry or community serves malicious code or a counterfeit login page, targeting a group instead of messaging each member. Patched browsers and devices help, and an unexpected login prompt on a familiar site deserves suspicion;
• Adversary-in-the-middle (AiTM) phishing: AiTM phishing places an intruder between the victim and the genuine sign-in service. The victim enters valid credentials into a convincing proxy, allowing the criminal to capture the session cookie after authentication. This produces session theft, granting access even when the password and a conventional MFA code were correct;
• Credential theft: The criminal wants usernames, passwords, recovery codes, or one-time tokens, with account takeover, data access, or a foothold for further social engineering as the payoff. A password manager, unique passwords, and phishing-resistant MFA reduce the exposure, and active sessions should be revoked whenever credentials were entered;
• Payment fraud: The criminal changes bank details, redirects payroll, or persuades an employee to authorize a transfer. Financial loss is often immediate because the transaction completes before the organization recognizes the deception. Out-of-band confirmation and separation between payment preparation and approval interrupt it;
• Malware delivery: The lure carries a malicious attachment, script, macro, or download that installs ransomware, an information stealer, or remote-access software. Content and software from an unsolicited message should never be enabled or installed, and the message belongs in a report so security teams can contain related files;
• Session theft: The criminal captures an authenticated browser session in place of a password alone, which is dangerous precisely because the victim may complete MFA and see no failed-login alert. Signing out of unfamiliar sessions, adopting phishing-resistant MFA, and investigating unrecognized device activity are the corrective steps.

Defenses against these methods must measure more than whether someone clicked an email. Security teams should test email, SMS, voice, QR, and login workflows, then provide short, role-specific coaching after each failure.

Email-only testing leaves voice, SMS, and QR channels completely unrehearsed for the employees cyberattackers target most. Adaptive Security runs realistic phishing simulations across every one of those channels.

Explore the platform

How Does AI Deepfake Phishing Change Phishing Attacks?

An AI deepfake phishing cyberattack uses generative AI to imitate a trusted person's words, voice, image, or video, then pressures a target into sharing information, approving a payment, or bypassing a security process. The result is faster, more personal, and much harder to dismiss using old signals such as spelling mistakes, awkward phrasing, or unfamiliar sender addresses. The FBI's 2025 advisory on AI-enabled impersonation describes how criminals combine AI-generated text, voice messages, and fabricated profiles to impersonate trusted officials and manipulate targets.

Synthetic identity fraud has grown alongside that capability. According to Sumsub's Identity Fraud Report 2025-2026, sophisticated fraud involving deepfakes, synthetic identities, and telemetry tampering surged 180% year over year.

How AI-Generated Phishing Emails Personalize Spear Phishing

AI-generated phishing emails turn ordinary campaigns into high-volume, targeted spear phishing. Criminals feed an employee's job title, recent promotion, public conference appearance, social media activity, or company announcement into a generative model, which produces a message matched to that person's responsibilities and current context.

The result is more than better grammar. Generative AI produces several versions of the same lure for finance, human resources, legal, procurement, and executive teams. A finance employee might receive a vendor-payment request that references a genuine supplier, a human resources employee might receive a benefits document carrying a credential-harvesting link, and an executive assistant might receive a message impersonating a leader traveling between meetings.

Personalization raises the chance that the recipient treats the request as routine. The message does not need to persuade everyone, only the one person with access to a mailbox, payment workflow, payroll system, customer record, or internal document.

Perfect grammar has stopped functioning as a phishing signal. AI removes misspellings, translates messages into natural local language, reproduces a leader's preferred tone, and adjusts the message after a target replies. Security teams should prioritize request verification over proofreading, because a polished message asking for secrecy, urgency, a password, a verification code, or a change to payment instructions still requires independent confirmation.

That confirmation must travel through a route the criminal did not supply. Replying to the email, calling the number inside it, or joining a meeting link included in the request all keep the conversation inside the cyberattacker's control. Opening the company directory, calling a known number, starting a new chat with the employee, or confirming through an established finance workflow moves it outside.

Payment changes should require a second approver and a documented callback to a known contact. These controls protect employees by giving them a safe process to follow when a request appears authentic.

AI also changes the defender's side of the exchange. A classifier can review reported messages, compare sender and domain signals, inspect links and attachments, and group similar reports so analysts see a campaign rather than hundreds of isolated alerts. Adaptive Security's Phish Triage workflow applies AI classification to reported email and connects detection with remediation, letting employees report suspicious messages without requiring them to make the final technical judgment.

How Deepfake Video Enables Executive Impersonation

Deepfake video phishing uses synthetic or manipulated video to make a criminal appear to be an executive, colleague, customer, regulator, or family member. The video supplies apparent proof, because people naturally treat a familiar face, voice, and meeting context as confirmation that a request is genuine.

The most dangerous version combines several channels. A criminal sends an email from a counterfeit chief financial officer requesting a confidential transfer, the target receives a calendar invitation or video-call link, and a deepfake executive repeats the request while additional synthetic participants appear to confirm the transaction. The cyberattack manufactures apparent consensus to suppress doubt.

A documented 2024 incident demonstrated the consequence. According to CNN's 2024 report on the Hong Kong police briefing, a finance worker at engineering firm Arup transferred about $25.6 million after joining a video conference in which the apparent chief financial officer and other participants were deepfake recreations. The employee initially suspected a phishing email, yet the video call made the request appear legitimate, and the fraud surfaced only after a check with the company's head office.

Executive impersonation does not require a perfect replica to succeed, because a believable authority figure, a plausible business reason, and a short deadline are often enough. Criminals also impersonate an executive's assistant, board member, attorney, or major customer, since the objective is to exploit one employee's role instead of fooling every observer.

Verification protocols must therefore override visual confidence. No video call should authorize a high-value payment, a new bank account, a credential reset, or the release of sensitive data by itself. Requirements should include a second channel, a known callback number, written approval in the normal system, and separation between the person requesting a payment and the person approving it.

For especially sensitive requests, a verification question that cannot be answered from public information adds another layer. Employees should watch for inconsistencies without treating them as definitive proof. Synthetic video can show unnatural blinking, facial edges that shimmer, lighting that does not match the room, lip movements that lag behind speech, frozen expressions, or subtle distortion when the person turns; high-quality deepfakes hide these clues, which makes visual inspection a secondary signal instead of a verification method.

How AI Voice Scams Target Verification Codes

AI voice cloning makes vishing more persuasive because criminals can imitate a person after collecting short audio samples from public interviews, conference recordings, social media posts, or voicemail greetings. The cloned voice asks for a password reset, requests a wire transfer, claims that a relative is in trouble, or pressures a family member to share a verification code.

Family-targeted AI voice scams exploit emotional urgency over corporate authority. A caller may sound like a child, spouse, parent, or grandchild and claim to have lost a phone, been arrested, or suffered an accident, often paired with a demand for money and an instruction to tell nobody else. Ending the call and reaching the person through a known number or a prearranged family phrase resolves it, because a caller's voice is never proof of identity.

Chained voice impersonation creates a serious enterprise cyber threat. A criminal can begin with a fabricated employee, use that conversation to obtain an internal name or process detail, then call another employee while impersonating the first person. Lateral movement of this kind builds credibility one conversation at a time, turning a fictitious vendor into a fictitious accounts payable employee and then into a fictitious executive.

Verification codes deserve special protection because they can complete an account takeover even when a password stays secret. No legitimate support representative, executive, bank employee, or family member needs a one-time code sent to someone else's device. Employees should refuse to read codes aloud, reject unrequested authentication prompts, and report repeated requests as a possible compromise.

Fraud complaints involving these tools have become a measurable category of their own. According to the FBI Internet Crime Complaint Center's 2025 Internet Crime Report, IC3 logged more than 22,000 complaints involving AI-related technology during 2025, with roughly $893 million in associated losses.

Organizations should rehearse these scenarios rather than rely on annual warnings. A practical cybersecurity awareness training program combines AI-generated phishing emails, vishing, smishing, and deepfake video exercises with clear payment-verification rules, plus feedback that treats reporting as protective behavior when a scenario is convincing or a decision is made under pressure.

AI cannot replace human judgment in a payment or identity decision. The strongest model combines machine speed with employee skepticism and a process that makes safe verification faster than unsafe compliance.

A convincing face and a familiar voice now cost cyberattackers almost nothing to fabricate on demand. Adaptive Security trains employees against deepfake video and cloned-voice scenarios directly.

Book a demo

What Do Real Phishing Examples Look Like?

Real phishing examples rarely look exotic. A convincing message usually resembles a routine request from a bank, colleague, delivery service, cloud platform, or social media support team, and it works because the surrounding context feels ordinary.

Each lure creates pressure, requests access or money, and contains at least one mismatch that a deliberate pause can expose. The examples below group the most common patterns by the outcome the criminal is chasing.

Credential and Account-Alert Phishing Examples

A fake account suspension email warns that an account will close today unless the recipient confirms their identity. Fear of losing access supplies the lure, and the message pushes the recipient to click a sign-in button and enter a password or multifactor authentication code. A sudden deadline, an unfamiliar sender address, or a login page reached through the message itself signals danger, and opening the service through a bookmarked link settles the question in seconds.

A fraudulent security alert claims someone signed in from a new location and asks the recipient to review activity. Credentials, payment details, or an approval notification are the payoff, and pressure to call an unfamiliar number, approve an unrequested login, or disclose a one-time code exposes the scheme. The provider's official support page is the correct destination, and any password change belongs in the verified account portal.

A fake shared-document email impersonates a colleague and asks the recipient to review an attached salary plan before a meeting. Only opening the document or signing in to view it completes the cyberattack, and an unsolicited file, a vague note from someone who normally supplies context, or a lookalike cloud domain gives it away. Confirming through a separate chat or phone call, then asking the sender to reshare through the organization's normal workspace, closes that path.

Payment, Invoice, and Delivery Phishing Scams

An overdue invoice email claims a supplier payment is late and includes new bank details. A believable business obligation supplies the lure, and the scheme depends on a wire transfer or a change to vendor banking records. A different account number, unusual urgency, altered invoice formatting, or a request to bypass approval should stop the transaction, since BEC succeeds when normal payment routines give way to rushed exceptions.

A fraudulent payment request impersonates an executive asking an employee to buy gift cards or transfer funds immediately, using authority and confidentiality to block verification. A demand to keep the request private, use personal payment methods, or send codes by reply reveals the cyberattack. Contacting the executive through a known number, outside the email thread, and reporting the message to the finance team is the correct sequence.

A delivery-fee text message says a package cannot be delivered until the recipient pays a small redelivery charge. A pending parcel supplies the lure, and the payoff arrives when the recipient taps a shortened link and enters card information. An unsolicited text, vague delivery details, or a payment page that does not match the courier's official domain signals fraud.

These smaller campaigns add up. According to the FBI's 2025 Internet Crime Report, reported phishing and spoofing losses climbed to $215.8 million in 2025, up from roughly $70 million the previous year, even as complaint volume stayed nearly flat.

Social, Cloud, QR, and Attachment Phishing Examples

A QR-code parking scam, also called quishing, places a replacement sticker over a legitimate parking meter code. A normal payment task supplies the lure, and the scheme only pays off if the driver scans the code and enters card or vehicle details on a counterfeit page. A sticker covering the original code, a strange domain, or a request for more information than parking requires all signal fraud, so the meter's printed payment instructions or the city's official application remain the safer route.

An advance-fee scam promises a grant, inheritance, job, or investment return after the recipient pays a processing fee. Money or identity documents must change hands first, and guaranteed returns, secrecy, and repeated fees expose the pattern. Paying to receive money is never a legitimate requirement.

A fraudulent data-entry form offers remote work or a survey payment while asking for tax, banking, or identity information. Compensation that requires sensitive data before a legitimate hiring process begins signals fraud, so applications belong on a verified employer site.

A malicious HTML attachment may arrive as an invoice, receipt, or voicemail notification, and opening the file launches a browser page imitating a login screen. The file extension and a request to enable content or sign in to view an attachment are the warning signs. Unfamiliar HTML files should go to the security team through the organization's reporting process instead of being opened.

An angler phishing message arrives through social media after someone posts a complaint. The counterfeit support account offers a refund or troubleshooting help while asking for a password, verification code, or payment details. A newly created account, an unsolicited direct message, or a request to move the conversation to another channel reveals the lure, and the platform's verified help center is the only reliable destination.

These examples follow one shared pattern. The message pushes the recipient to act before checking, while a small mismatch provides an opportunity to stop. Pausing, verifying independently, and reporting the attempt prevents the lure from becoming a stolen credential, a diverted payment, or a data loss.

Reading about a convincing lure builds recognition; meeting one under deadline pressure builds behavior. Adaptive Security closes that gap with phishing simulation scenarios drawn from live cyberattack patterns.

Take a self-guided tour

What Are the Phishing Red Flags and Warning Signs?

Phishing red flags appear when a message creates pressure, requests sensitive information, or asks someone to bypass a familiar process. The Cybersecurity and Infrastructure Security Agency (CISA) advises treating suspicious links, unexpected requests, and urgent messages as reasons to stop and verify. Polished wording establishes nothing, because AI-generated messages sound professional while the sender, destination, and request remain unverified.

The signals below separate presentation from evidence, starting with the seven that recur most often across email, text, and voice.

The Seven Red Flags of Phishing

1. 1Unexpected urgency: The message demands immediate action, threatens account closure, or says a payment must be completed before a deadline. Pressure is engineered to prevent careful verification;
2. 2Requests for secrets or payment: Unsolicited requests for passwords, multifactor authentication codes, tax records, gift cards, cryptocurrency, wire transfers, or bank details all carry high risk;
3. 3Sender-domain mismatch: The display name may show a bank brand or an executive's name while the actual address uses an unrelated domain, extra characters, or a lookalike spelling. The complete address matters more than the visible name;
4. 4Suspicious links or QR codes: A link can lead to a counterfeit login page, and a QR code can redirect a phone to a malicious site, so unfamiliar destinations need independent verification;
5. 5Unusual tone or context: A familiar contact may suddenly adopt an unfamiliar style, open with a generic greeting, demand secrecy, or make a request unrelated to their normal responsibilities. Context matters more than grammar;
6. 6Unsolicited attachments: An unrequested invoice, document, shared-file notice, compressed archive, or HTML attachment can deliver malware or route someone to a credential-harvesting page. Confirmation through a separate channel should precede opening it;

1. 1Pressure to bypass normal process: Requests to skip approval, avoid a ticket, use a personal account, keep a transaction confidential, or ignore a callback procedure signal an attempt to defeat safeguards. Normal controls protect both employees and the organization.

These signals often appear together, though one is enough to justify a pause. Employees should report the message through the organization's approved channel instead of testing the link or replying to the sender.

Five Quick Signs in Email or Text

A five-sign checklist works before any interaction with an unfamiliar message: urgent demand, request for credentials or money, unfamiliar sender address, unverified link or QR code, and out-of-pattern file or request. One sign calls for independent verification. Two or more calls for a report without opening the message content.

AI-generated phishing increases the value of this checklist, because verification signals stay harder to fake than fluent prose. They depend on a known phone number, an established workflow, or direct confirmation with the person who supposedly sent the request.

That gap is widening in a specific direction. According to the National Cybersecurity Alliance's Oh Behave! The Annual Cybersecurity Attitudes and Behaviors Report 2025-2026, 58% of employed participants had received no training on the security or privacy risks of AI tools, despite 65% now using AI and 43% admitting they had shared sensitive work information with those tools.

How to Inspect a Suspicious Phishing Message Safely

Safe inspection means examining surrounding signals without opening the attachment, clicking the link, scanning the QR code, or calling a number supplied in the message. The sender's full address should be checked through the mail client's details view and compared against the organization's known domain, because a familiar display name establishes no identity at all.

A destination can be previewed without a visit. On a computer, hovering over a link without clicking reveals the actual URL for comparison with the visible text. Misspelled domains, unfamiliar subdomains, shortened URLs, and login requests from sites reached outside a saved bookmark all warrant a stop, and QR codes should go through a scanner that displays the destination first.

Attachments stay untrusted until the sender confirms them through a separate, known channel, and the phone number, reply address, and meeting link supplied by a suspicious message are all part of that message. CISA recommends avoiding message links and contact details when authenticity is uncertain, so the company directory, a bookmarked website, or a previously trusted number should carry the verification. Request context deserves the same scrutiny, because the timing, amount, recipient, and approval path either match normal practice or they do not.

Recognizing which actions actually create risk matters just as much. Employees have likely been phished if they clicked a link, entered credentials, or approved an unrequested MFA prompt. The same applies if they opened a suspicious attachment, called a scammer, or replied with sensitive information; the effect of merely opening a message is covered separately below.

CISA's 2025 business guidance identifies fake links, harmful attachments, and requests for personal information as core phishing mechanisms. Any suspicious interaction deserves treatment as an incident requiring prompt investigation.

Signs of Compromised Accounts

A compromised account usually reveals itself through changes nobody authorized. The account connected to the phishing message is the starting point, followed by identity, email, browser, and financial records before anyone concludes the issue is harmless.

• Unexpected login activity: Login history deserves review for unfamiliar locations, devices, browsers, IP addresses, or access times. A successful login from a country where no employee works is a strong warning, and unfamiliar cloud-provider locations also require investigation;
• Password or MFA changes: Password-reset notices, new recovery addresses, newly enrolled authenticators, altered security questions, and unrequested MFA prompts all qualify. Repeated prompts can indicate MFA fatigue, while one approved prompt can hand over access;
• Unauthorized email activity: Sent messages, deleted items, draft folders, and mailbox-forwarding rules should all be checked. Criminals often send follow-up phishing messages, delete evidence, or silently forward invoices, password resets, and confidential discussions;
• Unrecognized account changes: New inbox rules, OAuth app permissions, administrator roles, payment details, shipping addresses, and connected devices reveal quiet persistence. Access can be preserved for weeks without any data being stolen immediately;
• Financial or identity warning signs: Unfamiliar transfers, card charges, changed payroll instructions, new loans, credit inquiries, and password-reset emails from uncontacted services all warrant attention. Financial activity should be reported through the institution's verified phone number;
• Device warning signs: Sudden pop-ups, disabled security tools, new browser extensions, unexplained applications, slow performance, or unfamiliar file extensions can indicate malware after someone opened an attachment or a counterfeit update.

If any sign appears, the affected account should be pulled out of sensitive work, its password changed from a known-clean device, its active sessions revoked, and the organization's IT or security team notified. Preserving the message, headers, screenshots, and timestamps before deleting anything gives analysts what they need to trace access and contain related messages.

Can Opening an Email Alone Cause Harm?

Opening an email alone is usually exposure rather than proof of compromise. Viewing a message does not normally hand over a password or authorize an account takeover, though the risk rises when the message exploits an unpatched mail client, loads malicious content, or persuades the reader into a second action. CISA's 2025 cybersecurity essentials guidance warns that phishing is built to make people click fake links, download harmful attachments, or share personal information.

Clicking a link can lead to credential harvesting even when no file downloads. Entering a password hands over a reusable secret, and approving an MFA prompt validates a fraudulent login. Downloading or opening an attachment can execute malware, and calling a number in the message connects the recipient to a scammer who continues the cyberattack by voice.

Replying confirms that the address is monitored and invites a more personalized follow-up. Recording what happened, including the message, link, attachment name, and actions taken, gives responders a starting point. The organization's Phish Triage process or reporting channel should carry the message onward, because forwarding it to colleagues spreads the cyber threat.

Indicators of Stolen Sessions or Malware

Stolen sessions and malware bypass the moment when a password was entered. A browser session cookie lets an intruder act as an authenticated user, and malware captures keystrokes, browser data, or files long after the original phishing message is gone. Active browser sessions and connected devices deserve a check in every affected service, followed by a global sign-out, removal of unknown extensions, and revocation of unfamiliar third-party app access.

Security teams should compare identity-provider logs with endpoint alerts, mailbox rules, cloud-storage downloads, and unusual data transfers. Individuals should disconnect a suspicious personal device without wiping it, then contact the organization's security team. If the incident involves payment instructions, the transaction should be frozen or recalled immediately.

A phishing incident is not defined only by visible damage. Unrecognized authentication activity, altered settings, and suspicious device behavior are all signals to contain access before investigating the full scope, because the earliest evidence often determines how far an intruder can go.

Suspicious messages sitting in inboxes while employees debate whether to report them give cyberattackers a free head start. Adaptive Security makes reporting a single, obvious action on desktop and mobile.

Explore the platform

What Should an Employee Do After Clicking a Phishing Link?

After clicking a phishing link, an employee should stop interacting with the page, report the incident, and contain any account or device exposure immediately. Compromised credentials need changing from a trusted device, active sessions need revoking, MFA may need resetting, the bank needs notice if financial information was shared, and evidence needs preserving. Fast reporting gives IT, the bank, or an identity provider time to block follow-on activity before the phishing attack becomes an account takeover.

1. The First Hour After Clicking a Phishing Link

This incident-response checklist limits how far an intruder can travel:

1. 1Stop interacting: Close the phishing page, enter no further information, and neither reply to the sender nor call a number in the message. No additional MFA prompt should be approved and nothing else downloaded;
2. 2Report the event immediately: The organization's phishing-reporting process and a direct notification to IT or security come first, ideally with the original message attached. A phishing triage and response platform helps analysts determine whether other employees received the same lure;
3. 3Record what happened: The time, device, browser, URL, sender address, information entered, files downloaded, MFA prompts approved, and accounts involved all belong in the record, with screenshots taken without reopening the page;
4. 4Disconnect a potentially infected device: A downloaded file, an opened attachment, installed software, or unusual behavior all justify disconnecting the device from Wi-Fi and wired networks. Erasing it, rebooting repeatedly, or running cleanup tools before IT or a qualified technician reviews it destroys evidence;
5. 5Use a trusted device for account recovery: A separate, updated phone or computer behaving normally is safer than the device used to click the link, because password changes made on a monitored device can be captured;
6. 6Contain exposed accounts: Every account where credentials were entered needs a new password, along with any other account that reused it. Signing out of all sessions and revoking unfamiliar applications, browser sessions, recovery methods, and active tokens completes the containment;
7. 7Escalate based on the information exposed: Financial details go to the bank or card issuer, identity documents go to the identity provider, and work credentials or company data go to the employer.

Employees should report the incident even when the consequences stay unclear, because quick reports give defenders time to remove malicious messages, reset access, and protect colleagues from the same campaign. CISA's 2024 Cybersecurity Incident and Vulnerability Response Playbooks recommend changing credentials and revoking access whenever compromise is suspected.

2. Password, MFA, Bank, and Identity Recovery

Password exposure requires more than changing one password. From a trusted device, the affected password should be reset with a unique passphrase, the account's recovery email and phone number reviewed, unknown forwarding rules removed, and active sessions revoked. Where the account supports it, app passwords, personal access tokens, connected applications, and remembered browsers should all be invalidated, and recent sign-ins checked for unfamiliar locations, devices, or times.

MFA exposure calls for equally direct action. An approved but unrequested MFA prompt means the password should change immediately, all sessions should be revoked, unfamiliar authenticator devices should be removed, backup codes regenerated, and MFA enrolled again through the legitimate account settings page. Repeated prompts usually indicate that an intruder already holds a password and is applying pressure until someone approves access.

Financial exposure requires a separate response. The bank or card issuer should be called using the number on the official website, card, or statement, never the number in the phishing message. The institution can freeze or replace affected cards, review pending transactions, add fraud monitoring, and investigate unauthorized transfers.

Exposed identity data escalates further. A Social Security number, passport detail, tax record, or similar identifier means contacting the relevant government agency or credit bureaus and following their identity-theft process. Evidence should survive the whole recovery, including the original message, full headers, screenshots, transaction records, file names, and exact timestamps.

Forwarding a malicious message broadly, deleting evidence, negotiating with the criminal, or attempting retaliation all make the situation worse, because those actions spread the lure, destroy forensic clues, or expose more information.

3. What to Do on a Work Device

A work device creates a possible organizational incident, so IT or security deserve notice even when nothing unusual appears. The report should include the device name, operating system, account used, link, downloaded files, credentials entered, MFA approvals, and whether confidential data was visible or uploaded. Continuing to work normally, connecting removable media, copying files to a personal account, or factory-resetting the device all interfere with the investigation unless security directs otherwise.

IT should determine whether to isolate the endpoint, inspect browser downloads and extensions, and review authentication logs. The team should also reset tokens, search mailboxes for the same phishing campaign, and check for malware or persistence. Work credentials entered on a personal device belong in the same report.

A phishing attack can continue through stolen sessions after a password change, so security teams must verify revocation across email, cloud applications, VPN access, and administrative systems. The stakes behind that verification keep rising. According to the FBI Internet Crime Complaint Center's 2025 Internet Crime Report, IC3 received 3,611 ransomware reports during 2025, up from 3,156 the previous year.

Fast, transparent reporting gives defenders the signal to contain the event and gives employees a clear record of how the lure bypassed normal judgment. That behavioral insight strengthens the controls and the practice needed to recognize the next cyberattack across email, voice, and text.

Minutes decide whether one clicked link stays contained or becomes an enterprise-wide account takeover. Adaptive Security shortens the distance between an employee report and analyst remediation across every affected inbox.

Take a self-guided tour

How Can Individuals and Organizations Prevent Phishing Attacks?

Preventing phishing attacks starts with one rule: verify unusual requests through a separate trusted channel before clicking, sharing information, or moving money. Individuals should adopt phishing-resistant MFA and cautious browsing habits, while organizations combine email filtering, identity controls, payment procedures, least privilege, reporting workflows, and continuous cybersecurity awareness training across email, voice, SMS, and video. No single control works alone, so organizations should treat every suspicious event as a signal to speed up verification, reporting, and improvement across the whole program.

1. Build Everyday Habits and Use Phishing-Resistant MFA

Everyday verification habits stop phishing before technical controls need to contain it. An unexpected password reset, invoice, wire transfer, vendor change, or confidential-data request should never be approved from the message that delivered it. Opening a new browser window, using a saved bookmark or a manually entered address, and contacting the requester through a phone number or chat channel already known to be genuine keeps the criminal out of the loop.

Urgency is a reason to slow down. Cyberattackers use deadlines, executive authority, account-lockout cyber threats, and emotional pressure to interrupt careful decision-making. A request that changes payment instructions, asks for credentials, or requires secrecy should trigger a second-person review, and high-value actions should require two authorized people to confirm independently.

A password manager with unique passwords for every important account removes the reuse problem, and it makes lookalike domains easier to spot because it will not autofill credentials on an unfamiliar website. Browsers, operating systems, mobile devices, and applications should stay updated, and extensions from unsolicited links should never be installed.

MFA reduces the damage from stolen passwords, though not every method provides the same protection. SMS codes and authenticator-app one-time passwords can be intercepted or entered into a counterfeit login page. Approval prompts remain exposed to MFA fatigue, sometimes called prompt bombing, in which repeated requests continue until a user accepts one simply to stop the interruptions.

A legitimate prompt that appears without a login attempt should be denied and reported immediately. Passkeys or security keys based on FIDO2 and WebAuthn are the stronger choice wherever the service supports them, because these methods bind authentication to the legitimate website, so a counterfeit domain cannot collect a reusable code or relay the same approval.

NIST's 2025 digital identity guidance requires phishing-resistant authentication to be available at Authenticator Assurance Level 2 (AAL2), the tier used for most workforce logins, and identifies WebAuthn as an example of verifier name binding. SMS and app-based codes remain useful as transitional controls, though they should not be the preferred protection for administrators, finance staff, executives, or access to sensitive systems.

An employee's decision to pause and verify still determines whether a well-crafted lure succeeds. Employees should know that denying an unrequested prompt, reporting a suspicious message, or asking for a second confirmation is correct behavior even when the request appears to come from a senior leader. That response protects the organization without assigning blame when a well-built phishing message looks convincing.

2. Layer Organizational Controls and Payment Verification

Organizational phishing defense begins with layered controls that reduce how often malicious content reaches employees and limit the damage when a message gets through. Email authentication belongs at the base of that stack, configured with SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting and Conformance), including an enforcement policy for domains that send on the organization's behalf. Reputation, impersonation, malware, and domain-age signals should filter inbound mail while a clear process handles false positives.

Browser and DNS protections should block known malicious domains, newly registered lookalike domains, credential-harvesting pages, and command-and-control destinations. Link rewriting and time-of-click analysis add protection when a safe-looking URL turns malicious after delivery. Risky file types should be disabled or sandboxed, compressed attachments scanned, and internet-sourced macros blocked.

These controls narrow exposure without identifying every compromised legitimate account or targeted spear phishing message. Identity and access controls limit the consequences of a stolen credential, so least privilege gives employees only the access their role requires and sensitive actions require step-up authentication. Dormant accounts, external forwarding rules, OAuth grants, mailbox delegation, and new MFA registrations all deserve periodic review.

Payment verification needs its own policy, because a valid mailbox proves nothing about a financial request. Out-of-band confirmation should be mandatory for new bank details, urgent transfers, vendor payment changes, gift-card purchases, and requests to bypass normal procurement. Confirmation belongs with a known contact at the vendor in preference to the person who sent the email, supported by transaction thresholds, approval separation, callback procedures, and a documented exception path for genuine emergencies.

A reporting workflow turns an uncertain employee observation into an actionable security signal. Users need one obvious way to report a message from desktop and mobile devices, the original message and headers must survive the process, and reports must route to the people who can investigate them. Security teams should classify the report, search for related messages, remove malicious copies from other inboxes, reset exposed credentials, revoke suspicious sessions, and notify affected users.

A Phish Triage workflow combines automated classification with analyst review so high-confidence cyber threats receive rapid containment while ambiguous cases stay visible for human judgment. AI-assisted detection fits into this process by correlating sender behavior, language, URLs, attachments, authentication results, identity context, and user reports. It should prioritize and explain signals in preference to silently replacing incident judgment.

Human risk signals, such as repeated unsafe clicks, ignored prompts, or risky data-sharing behavior, should guide additional coaching and access review. A risk score earns its place when it leads to a specific action rather than becoming a label attached to an employee.

Controls also need testing. Tabletop scenarios should cover a compromised executive mailbox, fraudulent payment instructions, stolen credentials, and a malicious attachment that bypasses filtering. Measurement should capture time to report, time to contain, and whether finance, IT, legal, and leadership understand their responsibilities, because an exercise that exposes confusion before an incident produces a practical remediation plan.

3. Use Continuous Cybersecurity Awareness Training and Multi-Channel Testing

Cybersecurity awareness training works when it rehearses the decisions employees must make under pressure. Annual content alone cannot prepare teams for AI-generated phishing emails, vishing, smishing, callback phishing, or deepfake video requests. Training should stay brief, role-based, accessible at the point of risk, and reinforced through realistic practice.

Email phishing simulations should reflect the messages employees actually receive, including vendor impersonation, account alerts, shared-document lures, QR codes, and BEC. Finance teams should practice invoice and payment fraud, IT teams should rehearse counterfeit help-desk calls and password-reset requests, and executives and their assistants should practice authority-based impersonation and confidential-information requests.

Vishing and smishing simulations extend the same verification rule beyond the inbox. A voice call can sound familiar, and a text can impersonate a known delivery service or executive. Deepfake awareness training should demonstrate that a convincing face or voice proves nothing about identity, and high-risk requests deserve confirmation through an independently sourced channel even when the caller or video participant appears authentic.

The channel gap is measurable. According to Verizon's 2026 Data Breach Investigations Report, median click rates in mobile-centric phishing simulations, covering voice and text messaging, run 40% higher than equivalent email exercises.

Role-based microlearning should follow observed behavior. Someone who clicks a simulated credential lure needs a short lesson on URL verification, and someone who fails a vishing simulation needs a callback and escalation exercise. Targeted instruction delivered after a specific behavior makes the next decision clearer without shaming the person who missed the signal.

Measurement should cover reporting rates, time to report, repeat failure patterns, phishing simulation performance by channel, cybersecurity awareness training completion, and changes in human risk over time. A failed phishing simulation is evidence that the scenario revealed a skill gap, an unclear policy, or a control needing reinforcement, in preference to proof that an employee is careless. Employees become a stronger defensive layer when the organization supplies realistic practice, simple reporting routes, and permission to pause suspicious requests, which makes verification, reporting, and escalation the default behavior while technical controls limit impact.

Filters and identity controls cannot judge whether an urgent payment request from a familiar name is genuine. Adaptive Security removes advanced phishing before employees ever face that judgment.

Book a demo

How Should an Employee Report a Phishing Email, Text, or Scam?

Reporting a phishing email starts with the built-in reporting tool in the email or messaging application, followed by notice to the employer, financial institution, mobile carrier, or public authority based on the channel and damage involved. The original message must survive the process, though dangerous links should never be forwarded to coworkers who could click them. When money, credentials, or a business account may be compromised, the report becomes an incident response task rather than a spam complaint.

1. Reporting an Email or Collaboration-Message Phish

In Gmail, opening the message, selecting More, and choosing Report phishing sends the message and attachments to Google for analysis, which is why that route beats forwarding the email to colleagues. In Outlook, selecting the message and choosing Report, then Report phishing, performs the equivalent step. The official Gmail reporting instructions and Microsoft Outlook reporting guidance carry the current menu paths.

For Microsoft Teams, Slack, Google Chat, or another workplace platform, the application's report or abuse function comes first, followed by an alert to the internal security team through its approved channel. Replying, downloading attachments, scanning QR codes, and opening a link to see where it leads all increase exposure. When analysts need the message, the platform's report function, the original file attached to a secure ticket, or message headers and a screenshot submitted through the company's incident process all preserve it safely.

This decision tree matches the channel to the right route:

• Email or collaboration message: Report it in the application, notify internal security, and preserve the sender address, subject, timestamp, headers, attachment name, and message ID;
• SMS: Leave the link untapped and send no reply, forward the text to 7726, which spells SPAM, report it in the messaging application, and notify the carrier;
• Voice call: End the call, block the number, and contact the supposed bank, employer, or agency through a verified number;
• Social media message: Report the account and message to the platform, change credentials if any interaction occurred, and warn the impersonated person or organization through a separate channel;
• Workplace incident: Contact the security team immediately after any click, credential entry, MFA approval, attachment opening, or data transfer.

2. Reporting a Phishing Text or Voice Scam

For suspicious texts in the United States, forwarding the message to 7726 and submitting a complaint through the Federal Trade Commission's consumer guidance starts the process. Financial scams, identity theft, and impersonation belong at ReportFraud.ftc.gov. Reports to the messaging application and mobile carrier support sender blocking without replacing notice to a bank or employer after any interaction.

The Anti-Phishing Working Group accepts suspicious email and website reports through reportphishing@apwg.org. The FBI's Internet Crime Complaint Center accepts reports involving online fraud, financial loss, or compromised business systems through IC3.gov. Outside the United States, the relevant national body applies, such as the United Kingdom's NCSC scam reporting service, Australia's ReportCyber portal, or Canada's Canadian Anti-Fraud Centre.

Impersonation of public bodies has grown quickly enough to justify separate attention. According to the FBI's 2025 Internet Crime Report, government impersonation complaints nearly doubled to 32,424 during 2025, carrying $797.9 million in reported losses.

3. Reporting Business Fraud and Preserving Evidence

When a phishing incident involves a payment request, changed bank details, payroll data, credentials, customer information, or suspected account takeover, the bank's fraud department deserves an immediate call on a trusted number. That call should cover a payment recall or hold, followed by contact with affected vendors, credential resets from a clean device, revocation of active sessions and tokens, and involvement of legal, privacy, insurance, and law enforcement teams according to the incident plan.

Evidence should include the original message, full headers, URLs recorded without being opened, phone numbers, usernames, screenshots, payment instructions, transaction records, and a timeline of every action taken. The record should also capture who received the message and whether anyone clicked, entered data, approved an MFA prompt, or transferred funds.

Evidence belongs in the incident system with restricted access, after which phishing response and triage workflows classify reports and remove related messages without spreading the lure. A fast, structured report gives investigators usable signals and helps employees recognize the pattern when another attempt arrives.

Reports scattered across inboxes, tickets, and hallway conversations rarely reach an analyst in time to matter. Adaptive Security consolidates them into one measurable pipeline with clear escalation paths.

Take a self-guided tour

Why Are Phishing Attacks a Major Cyber Threat, and Which Organizations Face the Most Risk?

Phishing attacks remain dangerous because they target trusted human decisions. They also scale cheaply across email, SMS, voice, and collaboration tools, and they exploit the gaps between security controls. A successful lure can lead to account takeover, BEC, ransomware, data theft, or lateral movement through legitimate credentials, which is why the exposure looks different in every sector while the entry point stays the same.

Personal, Financial, and Identity Consequences of Phishing

Phishing creates a personal decision point. A target might enter a password into a counterfeit login page, approve an unrequested MFA prompt, download an attachment, or send sensitive information to an impersonator. That single action can expose email, banking, health, payroll, or social media accounts, giving criminals immediate access and material for more convincing follow-up scams.

The consequences extend beyond stolen credentials. Personal information supports identity theft, redirected payments, fraudulent account openings, and impersonation of the victim to target colleagues and family members. A compromised mailbox also exposes past conversations, invoices, travel plans, and contact lists, letting criminals select later targets with greater precision.

The scale of that exposure is national. According to the Cyber Security Breaches Survey 2025/2026 published by the UK Department for Science, Innovation and Technology, phishing was the most prevalent breach type by a wide margin, experienced by 38% of businesses and rated the most disruptive incident by 69% of affected businesses.

Response speed determines the outcome. Employees should report the message, replace the exposed password from a trusted device, revoke active sessions, and contact the relevant bank or service provider. Employees are not passive targets in this process, because they are often the first people able to interrupt it by pausing an urgent request, verifying the sender independently, and reporting a suspicious message before anyone else interacts with it.

From Phishing to Ransomware and Lateral Movement

Phishing becomes an enterprise cyber threat when a cyberattacker converts one person's access into a path through the organization. A stolen cloud password exposes shared files, internal messages, and connected applications. Criminals then search for administrator accounts, financial workflows, customer data, and backup systems, moving laterally with valid credentials in place of software exploits.

A cyberattacker does not always escalate access right away; a compromised mailbox can sit dormant for weeks while forwarding rules accumulate, an executive is studied, or payment instructions are altered. In a ransomware campaign, the initial lure can deliver malware, harvest credentials, or open access to a remote service that the intruder exploits much later.

Smaller organizations absorb most of that outcome. According to Verizon's 2026 Data Breach Investigations Report, 96% of ransomware victims were small and medium-sized businesses, which typically present unpatched devices, compromised credentials, and limited recovery capability.

A reported near miss remains valuable evidence even when no account was compromised. Security teams should investigate the message, check related accounts, identify who received or interacted with it, and deliver targeted follow-up. Rapid reporting gives defenders more time to contain access before criminals expand their reach.

Sector-Specific Phishing Exposure and Business Impact

No sector faces a single universal phishing pattern. Criminals select campaigns according to the assets, workflows, and trust relationships available. Financial services attract credential theft, payment diversion, and BEC because accounts and transaction authority carry direct monetary value, while health care organizations face campaigns targeting patient data, clinical access, and urgent operational disruption.

Government organizations face impersonation and account theft tied to public services, sensitive records, and political pressure. Technology and telecommunications providers concentrate intellectual property, privileged access, and highly connected infrastructure, which makes lateral movement especially consequential. Retail campaigns exploit payment operations, loyalty accounts, suppliers, and delivery workflows.

Education organizations combine large user populations, open collaboration environments, and valuable research records, while professional services firms hold client data and trusted relationships that turn one compromised account into a route between companies. Supplier exposure now carries measurable weight, and Verizon's 2026 Data Breach Investigations Report records third-party involvement in 48% of breaches, a 60% year-over-year increase.

The practical response is sector-specific rehearsal in preference to a generic annual module. Finance teams should practice invoice and payment verification, health care teams should rehearse account recovery and patient-data handling, and government and education teams should test scenarios involving shared services and public-facing accounts.

Technology, telecommunications, retail, and professional services teams should test vendor impersonation, privileged access, and multi-channel follow-up. Measuring these behaviors by role, department, and channel reveals where phishing risk is shifting and which access paths require closer scrutiny.

Risk concentrates in specific roles and departments long before it appears in an incident report. Adaptive Security surfaces that concentration through continuous human risk monitoring and phishing simulation scoring.

Explore the platform

How Do Modern Cybersecurity Awareness Training Programs Reduce Phishing Risk?

Modern cybersecurity awareness training programs reduce phishing risk by rehearsing the decisions employees must make when a convincing message demands action. Annual end user modules measure completion, while continuous programs measure whether people recognize, report, and resist phishing over time. Generic content gives everyone the same lesson, whereas role-based programs give finance teams invoice fraud scenarios and executives impersonation exercises.

Annual training satisfies a compliance record, though only continuous, measured practice shows whether phishing risk is actually falling.

From Compliance Completion to Behavioral Change

Modern programs treat completion as the starting line. An employee who watches a 20-minute module and passes a quiz has demonstrated knowledge without demonstrating reliable behavior under pressure. Continuous programs test that behavior with realistic phishing simulations, short remediation modules, and follow-up exercises tied to the original mistake.

Human risk varies by role, seniority, and the type of request an employee is likely to receive. A new hire, an accounts payable specialist, and a senior executive encounter different lures, authority signals, and financial consequences. Cybersecurity awareness training should adjust to each person's role, prior behavior, and cyberattack channel, and a missed test should trigger coaching on the overlooked signal in preference to public criticism or a punitive leaderboard.

A 2025 Springer study on security awareness training and human risk management drew on interviews with 20 CISOs, training professionals, and cybersecurity practitioners. Participants consistently separated compliance metrics from broader behavioral and risk data. The practical lesson is direct: protect employees' confidence while using their results to improve the next intervention.

Success should be defined as safer decisions in preference to perfect phishing simulation scores. Employees need a clear reporting route, rapid feedback, and permission to pause an unusual request.

How Should Phishing Simulations Cover Email, Voice, SMS, and Deepfake Cyber Threats?

Email remains essential, though an email-only program leaves gaps. Modern phishing simulation tests should rotate across the channels criminals use to establish trust:

• Email: Test credential harvesting, vendor impersonation, QR code phishing, and BEC using realistic sender names, familiar workflows, and lookalike domains without collecting genuine credentials;
• Voice: Give finance and executive-assistant teams vishing scenarios involving urgent payment approvals, password resets, or requests to bypass authorization;
• SMS: Test smishing with delivery notices, multifactor authentication alerts, and payroll messages, teaching employees to open the company application directly in preference to following an unsolicited link;
• Deepfake video: Rehearse executive impersonation through a short video-call scenario, requiring second-channel confirmation for high-value transfers even when the face and voice appear authentic.

Executive and finance teams need distinct scenarios because their access, authority, and exposure differ. Executives should practice resisting urgent requests that appear to come from the board, legal counsel, or a government agency, while finance employees rehearse invoice changes, wire transfers, and callback requests. The objective is making verification automatic before a cyberattacker creates pressure.

Which Phishing Metrics Should Security Leaders and Boards Track?

Board reporting should replace completion percentages with a compact view of exposure and improvement. A useful dashboard shows susceptibility by department and role, reporting speed from receipt to alert, repeat behavior after remediation, and improvement against a defined baseline.

Negative and positive signals belong together. A click rate identifies where a lure succeeded, while a report rate shows whether employees are becoming active defenders. Time to report indicates how quickly the security team receives a usable signal, and repeat-failure rates identify where cybersecurity awareness training, workflow design, or approval controls require adjustment.

Board attention is now a governance question as much as a security one. According to the World Economic Forum's Global Cybersecurity Outlook 2026, 52% of organizations report that board members receive regular cybersecurity updates, with 30% of board members in high-resilience organizations holding personal liability for breaches compared with 9% in low-resilience organizations.

Risk scores should combine behavioral signals with role sensitivity and exposure, then show whether targeted interventions reduce risk over time. That view gives the board a business measure of human risk instead of a completion percentage detached from exposure.

Compliance cybersecurity awareness training supplies documented evidence when content and records map to SOC 2, HIPAA, GDPR, PCI DSS 4.0, ISO 27001:2022, NIST CSF 2.0, and CMMC 2.0. Evidence should include assigned modules, completion records, phishing simulation results, remediation activity, and management review. It supports compliance without confusing an audit trail with proof that phishing risk has disappeared.

Completion percentages describe attendance, while cyberattackers measure actual behavior under real pressure. Adaptive Security reports the behavioral evidence boards increasingly expect from a cybersecurity awareness training platform.

Take a self-guided tour

Build Faster Phishing Detection Across Every Channel With Adaptive Security

Phishing now reaches employees through email, text, voice, QR codes, and collaboration tools, and every added channel widens the window for a costly mistake. Adaptive Security addresses that spread as one problem instead of several disconnected ones, combining cybersecurity awareness training, multi-channel phishing simulations, and AI-driven detection inside a single cybersecurity awareness training platform.

Cloud Email Security applies dual machine learning and large language model detection to inbound mail through an API connection, so advanced phishing and BEC attempts are quarantined across every affected inbox without MX record changes or mail-flow disruption. Phish Triage classifies what employees report, groups related messages into a single campaign view, and removes copies before anyone else engages. Every detected cyberattack then feeds the risk profile of the employee it targeted.

That feedback loop is what turns detection into measurable improvement. Training assignments follow the cyber threats an individual actually receives, phishing simulations rehearse the channels their role exposes them to, and compliance records map cleanly to the frameworks auditors ask about. Security leaders get behavioral evidence, and employees get practice instead of blame.

Fragmented tools produce fragmented visibility precisely where cyberattackers concentrate their effort against employees and their inboxes. Adaptive Security unifies email detection, multi-channel phishing simulations, and reporting in one platform.

Book a demo

Frequently Asked Questions About Phishing

How Much Does a Phishing Attack Cost a Business?

Costs range from a few thousand dollars to many millions, depending on the access, data, and payment authority a phishing attack compromises. No single average exists, because losses combine fraudulent transfers, downtime, investigation, legal response, recovery, and reputational damage. Most incidents sit at the lower end: the Cyber Security Breaches Survey 2025/2026 puts the average cost of the single most disruptive breach at roughly £1,600, or about 2,100 US dollars, for UK businesses of any size, while a smaller number of cases run into eight figures. Verifying payment and account-change requests through an independently sourced channel, enforcing phishing-resistant MFA, and giving employees a fast reporting route reduces exposure at both ends of that range.

What Is Phishing-Resistant MFA, and Can Passkeys Stop Phishing Attacks?

Phishing-resistant MFA uses cryptographic authentication that binds the login to the legitimate website, which prevents a counterfeit site from collecting a reusable code or credential. Passkeys built on FIDO2 or WebAuthn provide that protection because the private key stays on the user's device and authentication is tied to the approved domain. CISA guidance identifies FIDO and WebAuthn as the only widely available phishing-resistant authentication methods. Passkeys do not stop every scam, malware infection, or social engineering attempt, so they belong alongside payment verification, secure recovery processes, and trained employees who report suspicious requests.

Can a Person Get Phished Just by Opening an Email?

Opening a message rarely compromises an account by itself, largely because modern mail clients block remote content, disable active scripting, and render attachments in sandboxed previews by default. Those protections apply only to the display layer, so an unpatched client or a disabled security setting narrows the margin considerably. Risk arrives with the next action, whether that is clicking a link, entering credentials, downloading an attachment, replying with information, or approving an MFA request. FTC phishing guidance recommends stopping interaction and reporting the message, and employees protect the organization most effectively when reporting is quick, blameless, and treated as a security control.

Where Should a Business Report a Phishing Attack Involving Financial Loss?

A business facing financial loss should contact its bank or payment provider immediately, report the incident to internal security or IT, and file a complaint with the FBI's Internet Crime Complaint Center. The bank can advise whether a transfer recall or payment freeze remains possible, which is why speed matters more than completeness in the first hour. Emails, headers, invoices, phone numbers, wallet addresses, and transaction records should all be preserved, and law enforcement notified through IC3's official reporting channel. The FBI also directs businesses affected by BEC to contact their financial institution and file with IC3, per its BEC guidance.

What Is the Most Common Type of Phishing Attack Today?

Phishing and spoofing delivered through digital messages remain the most commonly reported category, and email continues to serve as the dominant business channel. According to the FBI Internet Crime Complaint Center's 2025 Internet Crime Report, phishing and spoofing generated 191,561 complaints, more than double the next-largest category. That figure reflects complaint volume in preference to total cyberattack volume, since most attempts are never reported, and Verizon's 2026 Data Breach Investigations Report separately places phishing as the initial action in 16% of breaches. Criminals also use smishing, vishing, QR codes, collaboration platforms, and compromised accounts, so email-only rehearsal leaves a measurable gap.

Cyberattackers rotate channels faster than most annual programs can update a single module. Adaptive Security keeps rehearsal, detection, and reporting aligned with the routes actually in use.

Explore the platform