Phishing is a form of social engineering: an attacker impersonates a person or organization and uses a request, link, file, or other prompt to steal information or money, gain access, or deliver malware. The ten forms below are useful ways to recognize common tactics, not a definitive or mutually exclusive taxonomy. A single scam may combine several.
What are the most common types of phishing?
Phishing can be grouped by delivery channel, target, or objective. For example, a targeted business email could spoof a vendor, carry a malicious attachment, and ask for a wire transfer. The categories overlap.
As an Amazon Associate I earn from qualifying purchases.
Email phishing
A broad email impersonates a legitimate business and asks you to verify personal details, follow a link, or visit a lookalike website. A familiar logo or polished wording does not prove that a message is genuine. FBI guidance on spoofing and phishing explains common warning signs.
Spearphishing
Spearphishing targets a particular person or organization. The message may use details about the recipient and appear to come from a trusted colleague, supplier, or service. Because it can be personalized, a message that sounds relevant still needs independent verification.
#1 Best Overall
Whaling
Whaling is phishing aimed at a high-profile individual to obtain sensitive, high-value information. It is a targeting subtype rather than a separate delivery channel; an attempt may arrive by email or another means.
Business email compromise
Business email compromise (BEC) uses a message that appears to come from a known source to prompt a payment or sensitive action. Common scenarios include a supposed vendor changing payment details, an executive asking an employee to buy gift cards, or fraudulent real-estate wire instructions. The FBI describes BEC scenarios and response steps in its BEC guidance.
Smishing
Smishing is phishing delivered by SMS or text. A message may urge you to click a link, download something, or reply to begin a conversation. Treat an unexpected text about an account, delivery, or payment as unverified until you check it through a channel you already trust.
Recommended Free Tools
Vishing
Vishing uses phone calls, voice email, or VoIP to pressure someone into revealing information or taking an action. In a 2025 alert, the FBI described targeted campaigns using AI-generated voice messages; that example does not mean every suspicious call is AI-generated. Read the FBI’s 2025 alert.
Pharming
Pharming redirects someone to a fraudulent website through malicious code, rather than relying only on a conventional fake email link. If a page unexpectedly asks for credentials or payment information, do not assume it is safe simply because you reached it through a familiar route.
QR-code phishing
A substituted or malicious QR code can send a phone to a fake website. The FTC has described reports of scammers covering legitimate parking-meter codes with their own codes. Check that a code appears to belong to the intended organization, and inspect the destination before entering information. FTC advice on malicious QR codes.
Sender or domain spoofing
Spoofing alters a sender name, email address, phone number, or website URL so it looks trusted. The FBI notes that even a one-character change can mislead. Compare the full address or domain with a known, legitimate one instead of relying on the display name. The FBI defines spoofing as disguising these details to convince someone they are interacting with a trusted source.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsAttachment or malware-delivery phishing
A message may prompt you to open or download a file that installs malware or enables further compromise. The FBI describes malware being used to access legitimate invoice email threads; the FTC warns that phishing links and attachments can lead to ransomware. Do not open an unexpected file until you have independently confirmed the sender and the reason for it. See the FBI’s BEC guidance and the FTC’s small-business cybersecurity guidance.
How can you tell if an email or text is fake?
Look for signs that the sender or request needs verification, but do not treat any single clue as proof. A real account may send an unexpected notice, while a convincing scam can look polished.
- Check the complete sender address and the spelling of the domain, not just the display name or logo.
- Before following a link, inspect its destination and compare it with the organization’s known website. Do not enter credentials or payment details on a page reached through an unexpected message.
- Be cautious of unexpected files, urgent payment requests, password prompts, and requests for one-time codes.
- Do not use contact details supplied in the suspicious message to verify it. Find the organization’s number independently or use a contact method you already know.
For payment changes, wire instructions, or other sensitive requests, confirm with the person through a separate, known channel. That verification should not depend on replying to the message or calling a number it provides.
What should you do if you clicked a phishing link?
Clicking alone does not establish what happened: the risk depends on what the link opened and whether you entered information, downloaded a file, or approved a request. Stop interacting with the page or message, then respond to the exposure that occurred.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- If you entered a password: From a trusted device, change it on the legitimate service and on any other account where you reused it. Use the service’s account-security options to review active sessions and sign out unfamiliar ones.
- If you shared a one-time code or approved a sign-in: Contact the affected service through its official app or website, secure the account, and review recent activity.
- If you downloaded or opened a file: Do not open it again. Use your organization’s security process if this is a work device; for a personal device, run its trusted security tools and seek help if you see signs of compromise.
- If you sent money or changed payment details: Contact your financial institution immediately and ask it to contact the receiving institution. Report BEC to the FBI’s Internet Crime Complaint Center (IC3).
How do you prevent phishing at home and at work?
Verify before acting
Use an independently obtained number, official app, or known contact to confirm unexpected requests. For a vendor’s changed bank details or a wire transfer, speak with the person through a separate channel before sending money. Do not rely on contact information embedded in the message being checked.
Protect accounts with MFA
Multi-factor authentication (MFA) adds a verification step beyond a password, but methods differ in strength and are not supported by every service. CISA recommends that businesses aim for phishing-resistant MFA; enable the strongest supported method available for your account. A hardware security key is one possible MFA option, not a universal fit: check that the account supports its authentication standard and connector, and understand the account’s recovery method before choosing one. FBI guidance says to set up two-factor or multi-factor authentication where available and never disable it. Never share a one-time code with someone who contacts you.
See CISA’s MFA guidance and the FTC’s advice on protecting personal information.
Make reporting easy for employees
Organizations should give staff a clear way to report suspicious messages and make sure someone reviews reports. Training should emphasize independent verification of payment requests and sensitive actions, rather than asking employees to judge authenticity from appearance alone.
Free tools Windows power users keep installed
One-click scans. No signup required.
Authenticate your business email domain
SPF, DKIM, and DMARC are email-authentication tools that can make it harder for scammers to spoof a company’s email. The FTC recommends these protections for businesses. Before setting records, ask a knowledgeable email provider or administrator to review the configuration; incorrect settings can affect legitimate mail. Decide how to handle messages that fail checks—such as flagging, quarantining, or rejecting them—and who will monitor reports. The FTC small-business cybersecurity guidance also covers staff training and payment verification.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
