How to Avoid Phishing Attacks: A Complete Guide

Phishing is the most successful cyberattack in history — not because it uses sophisticated code, but because it targets the most vulnerable part of any security system: human judgment. In 2024, phishing was responsible for 36% of all data breaches. This guide explains exactly how it works and what you can do to stop it.

What is phishing?

Phishing is a social engineering attack where an attacker impersonates a trusted entity — your bank, employer, Apple, Google, PayPal — to trick you into handing over credentials, clicking a malicious link, or installing malware.

The word is a deliberate misspelling of "fishing." The attacker baits a hook, casts it at millions of people, and waits to see who bites.

The main types of phishing

Email phishing

The most common form. You receive an email that looks like it's from a legitimate company asking you to "verify your account," "update your billing information," or "confirm a suspicious login." The link in the email leads to a fake site that harvests your credentials.

Spear phishing

Targeted attacks on specific individuals. The attacker researches the victim's employer, colleagues, and recent activity (often from LinkedIn or social media) to craft a convincing personalized message. "Hi [Name], Sarah from HR asked me to send you this year-end W-2 document." This is how most corporate breaches begin.

Smishing (SMS phishing)

Phishing via text message. Common examples: "Your package has a delivery problem — click here," or "Your bank account has been locked. Tap to verify." SMS links are especially dangerous because phones display less context than a browser.

Vishing (voice phishing)

Phone calls from fake bank fraud departments, IRS agents, or tech support. They create urgency — "Your account will be closed in 30 minutes" — and ask for passwords, account numbers, or one-time codes.

Clone phishing

The attacker intercepts a legitimate email you previously received (a receipt, shipping notification, or meeting invite), makes a near-identical copy with a malicious attachment or link, and resends it — sometimes from a spoofed version of the original sender's address.

How to spot a phishing attempt

How to check a link before clicking

On desktop, hover over any link without clicking. Your browser will show the real destination in the bottom-left corner. On mobile, press and hold the link to reveal the full URL. Ask yourself:

• Is the domain correct — not a slight misspelling?
• Does the URL start with https://?
• Is there an unusual subdomain — like amazon.support-center.ru?
• Is it a URL shortener hiding the real destination?

Your strongest defense: two-factor authentication

Even if a phishing attack successfully steals your password, two-factor authentication (2FA) stops the attacker from using it. With 2FA enabled, they also need your second factor — your authenticator app code or hardware key — which they cannot obtain from a phishing page alone.

This is why enabling 2FA on your most important accounts (email, banking, work accounts) is the single highest-impact security action you can take. See our complete 2FA guide to get started.

What to do if you clicked a phishing link

1. Don't panic — don't enter any information. If you clicked but didn't enter a password, your risk is lower. Close the tab immediately.
2. Change your password immediately on any account you may have compromised — and on any account that uses the same password.
3. Enable 2FA on the affected account right now, if it isn't already on.
4. Check for unauthorized activity — review recent logins, transactions, and sent emails.
5. Run a malware scan if you downloaded anything or clicked a link that seemed to install something.
6. Notify the real company — forward the phishing email to phishing@[company].com or report it to the FTC at ReportFraud.ftc.gov.
7. Alert your organization if you used a work account — IT needs to know immediately to contain any damage.

The password angle: why strong, unique passwords limit the damage

If a phishing attack steals your password to one site, the damage is contained — as long as you don't reuse that password. If you use the same password across 10 accounts, one successful phishing attack becomes 10 compromised accounts.

Use a unique, strong password for every account. A password generator makes this effortless, and a password manager stores them all so you never need to remember them.

Technical defenses (for organizations)

• •
  Email authentication (SPF, DKIM, DMARC) — prevents attackers from sending emails that appear to come from your domain.
• •
  DNS filtering — blocks access to known phishing domains before users can reach them.
• •
  Hardware security keys (FIDO2/WebAuthn) — the only 2FA method that is completely phishing-proof. Even if you enter your credentials on a fake site, the key will not respond to a domain it wasn't registered with.
• •
  Security awareness training — simulated phishing campaigns with immediate feedback are proven to reduce click rates significantly.

Frequently asked questions