Phishing is what type of attack? It is a social engineering attack. That is the short answer, and it matters, because phishing does not primarily break technology. It persuades a person to hand over a password, click a malicious link, open a dangerous attachment or transfer money, usually by pretending to be someone trustworthy.
Phishing sits inside the wider family of social engineering attacks, which manipulate human psychology rather than exploiting software flaws. Understanding that classification explains both why phishing is so common and why technical defences alone never fully stop it.
The Direct Answer, and Why the Classification Matters
Security teams classify attacks by how they work. Malware attacks infect devices with malicious code. Network attacks exploit protocols and open ports. Phishing attacks exploit people. The attacker’s main tool is deception: a convincing email, message or website that creates urgency, authority or curiosity.
That is why phishing can succeed even in well-defended organisations. A firewall cannot tell that an email from “IT support” asking an employee to “verify” their account is fake, and antivirus cannot block a user from willingly typing their password into a lookalike login page. Defences therefore have to combine technology with training and process.
How a Typical Phishing Attack Works
- The lure. The victim receives an email, text or message that appears to come from a bank, a cloud provider, a delivery company or a colleague. It warns of a locked account, an unpaid invoice or a missed delivery.
- The hook. The message creates pressure: act now, or lose access, miss a payment or face a penalty. A link or attachment is offered as the “solution”.
- The capture. The link leads to a fake login page that harvests credentials, or the attachment installs malware. Sometimes the goal is simpler: a reply containing sensitive information, or a bank transfer to the attacker.
- The exploitation. Stolen credentials are used to log in as the victim, read email, reset other passwords or launch further attacks from a trusted account.
Modern campaigns are often automated and personalised. Attackers scrape job titles, suppliers and recent projects from public sources, so a message can reference a real invoice number or a real manager’s name.
Types of Phishing
| Type | Channel | Typical target |
|---|---|---|
| Bulk email phishing | Anyone; sent in large volumes | |
| Spear phishing | A specific person, highly personalised | |
| Whaling | Senior executives and finance staff | |
| Smishing | SMS text message | Mobile users, parcel and bank scams |
| Vishing | Voice call | Anyone, often impersonating banks or IT |
| Business email compromise | Finance teams, via fake supplier or boss requests |
Whaling attacks deserve special attention: because they target senior staff with access to payments and sensitive strategy, a single success can be far more costly than hundreds of bulk phishing emails.
Why Phishing Works: The Psychology
Phishing leans on predictable human responses. Authority makes a message from “the CEO” or “Microsoft support” feel legitimate. Urgency short-circuits careful checking. Curiosity pulls people towards unexpected invoices, photos or delivery notices. Familiarity does the rest: a copied logo, a plausible sender name and a familiar layout lower suspicion.
Attackers also exploit busy moments. Messages sent at month-end, during holidays or in the middle of a system migration are more likely to be actioned without a second thought. That is why phishing peaks around tax deadlines, Black Friday and major outages.
Real-World Examples
A finance officer receives an email that appears to come from the managing director, asking for an urgent supplier payment while the director is travelling. The bank details belong to the attacker. A warehouse worker gets a text about a failed delivery with a tracking link; the link installs malware that steals saved passwords. An office employee clicks a “password expiry” email and signs in to a perfect replica of the company login page, handing over credentials that are used within minutes.
In each case the technology worked as designed. The failure was human judgement under pressure, which is exactly what social engineering targets.
How to Spot Phishing
- Check the sender address carefully, not just the display name. Look for misspellings and odd domains.
- Hover over links before clicking and compare the real destination with the claimed one.
- Be suspicious of unexpected urgency, threats or requests for credentials and payments.
- Watch for generic greetings, poor grammar and mismatched branding, though AI-generated messages are making these clues less reliable.
- Never trust a login page reached from an email link. Go to the service directly instead.
What to Do If You Clicked or Replied
Act fast. Change the affected password immediately, from a known-good device, and change it anywhere else you reused it. Turn on multi-factor authentication. Tell your IT or security team so they can check for mailbox rules, forwarded mail or further logins. If money was sent, contact the bank at once. Reporting the message also helps providers block the same campaign for others.
Defending an Organisation Against Phishing
Technical controls reduce the volume that reaches inboxes: email authentication (SPF, DKIM and DMARC), spam and malware filtering, and link and attachment scanning. Multi-factor authentication limits the damage when credentials are stolen. But training is equally important. Short, regular phishing simulations, covered in many penetration testing programmes as social engineering tests, teach staff to recognise and report suspicious messages without shame.
Process controls matter too. A rule that payment changes always require a second, out-of-band confirmation defeats most business email compromise attempts, because the attacker cannot fake a phone call to a known number as easily as an email.
Phishing and Cloud Accounts
Cloud accounts are a favourite phishing target, because one stolen login can open email, files, chat and admin consoles at once. Attackers favour fake “password expired” or “new sign-in” pages that mimic Google, Microsoft 365 or other cloud providers, and they increasingly use adversary-in-the-middle pages that relay real multi-factor prompts to the victim. The defence is to use phishing-resistant authentication where possible, such as hardware security keys, and to review account sessions and app permissions regularly. If a cloud account is compromised, revoke its sessions and tokens as well as changing the password, because an attacker with a live session may not need the password at all.
Common Mistakes to Avoid
Common mistakes include assuming only careless people fall for phishing, relying on a spam filter alone, and punishing staff who report clicks instead of rewarding fast reporting. Another mistake is training once a year and expecting it to stick: phishing tactics change constantly, so awareness needs to be ongoing and based on real, current examples.
Frequently Asked Questions
Phishing is what type of attack?
Phishing is a social engineering attack. It uses deception to trick people into revealing credentials, clicking malicious links, opening harmful attachments or sending money.
Is phishing a type of malware attack?
Not exactly. Phishing is the deception that delivers the harm; malware is sometimes the payload. Many phishing attacks steal passwords without any malware at all.
What is the difference between phishing and spear phishing?
Bulk phishing targets many people with generic messages. Spear phishing targets one person or a small group with personalised messages, making it harder to spot and more likely to succeed.
Can antivirus software stop phishing?
Only partly. Antivirus can block malicious attachments and known bad sites, but it cannot stop a user from voluntarily entering a password on a convincing fake login page. Email filtering, multi-factor authentication and training are also needed.
What should I do with a suspected phishing email?
Do not click links or open attachments. Report it using your email provider’s phishing report button or your organisation’s reporting process, then delete it. If you already clicked, change your password and alert IT straight away.
