Email phishing is a social-engineering attack delivered through email: a scammer pretends to be a person, company, or service the recipient trusts to prompt a click, password entry, payment, disclosure, or software download. The main types differ by target and goal, while links, attachments, QR codes, and authorization screens are delivery routes that can overlap.
Which email phishing attacks are most common?
There is no reliable universal ranking of every phishing email. Microsoft Threat Intelligence reported detecting approximately 7.6 billion email-based phishing threats in Q2 2026. In that vendor’s observed payload-based attacks, credential phishing accounted for 94–96% in each month of the quarter. Those figures describe Microsoft’s observations and denominator, not the share of all phishing emails worldwide. Microsoft’s Q2 2026 email threat analysis also found HTML and PDF attachments were common malicious payload types.
As an Amazon Associate I earn from qualifying purchases.
Credential theft is a frequent objective, but it is only one way email phishing works. Some scams seek money through business payment processes; others target a particular person, try to obtain access to email or files, or deliver malware. CISA, NSA, the FBI, and MS-ISAC state that malicious actors primarily use phishing to obtain login credentials for initial network access. Their 2025 guidance focuses on how organizations can interrupt that attack cycle.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Types of email phishing by target and goal
These labels are not mutually exclusive. For example, a targeted message to an executive could be whaling, use a stolen business mailbox, and carry a malicious link at the same time.
Broad impersonation and credential phishing
A message impersonates a familiar company, bank, utility, or online service and urges the recipient to fix an overdue payment, verify an account, or resolve a problem. The link may lead to a lookalike sign-in page, or the message may show a spoofed sign-in screen that captures credentials. A logo or familiar sender display name does not authenticate the request. Use the organization’s site or contact details you already trust rather than the message’s link or phone number. The FBI’s spoofing and phishing advice and the FTC’s consumer guidance describe these kinds of lures.
Spearphishing
Spearphishing targets a particular person or group and uses relevant details to make a request seem plausible. Those details can come from the recipient’s role, relationships, or ongoing work. The goal might be credentials, malware execution, or information that supports a later fraud. CISA defines spearphishing as phishing aimed at an individual using key information about them. CISA’s phishing postcard explains the distinction.
Whaling
Whaling is spearphishing aimed at a high-profile person, such as an executive, to obtain sensitive or high-value information. The term describes who is targeted, not a distinct delivery method: a whaling message may look like an ordinary business request.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallBusiness email compromise and account compromise
Business email compromise (BEC) exploits trust in business communications to trigger a fraudulent payment or disclosure. Examples include an invoice with changed bank details, an executive asking an assistant to buy gift cards, or altered wire instructions in a home purchase. A criminal may spoof an address, use targeted phishing to learn about a business process, or take over a real mailbox and insert a fraudulent request into an existing invoice thread. In the last case, the sender address can be genuine while the request is not.
Verify payment-detail changes and unusual financial requests using a known phone number and your organization’s established approval process—not contact information supplied in the email. The FBI’s BEC guidance describes common scenarios; the FTC’s small-business cybersecurity advice covers protective policies.
Delivery methods that can carry a phishing lure
Malicious links and attachments
A link may lead to a counterfeit site that steals credentials, while an attachment may contain or lead to a malicious payload. In Microsoft Threat Intelligence’s Q2 2026 observations, HTML attachments accounted for 35–41% and PDFs for 24–31% of payload-based attacks across the quarter; together, the two formats represented roughly 60–70% monthly. These are shares of Microsoft’s observed payload-based attacks, not all email or all attachments. A file format by itself does not prove a message is malicious. Consider whether the sender and file are expected, and report suspicious messages using your provider’s or workplace’s process. Microsoft’s report gives the measurement context.
QR-code phishing
A QR code in an email or attachment can move the recipient to a web page on a phone, including a credential-harvesting page. Microsoft tracked QR-code phishing in Q2 2026 and reported PDF attachments as its dominant delivery vehicle, although their share weakened during the quarter. That does not make every QR code or PDF dangerous. Treat an unexpected code that leads to a login or payment request as a reason to verify the request independently.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →OAuth consent phishing
An email may direct someone to approve a malicious application on a legitimate provider’s authorization screen. If the user grants the requested permissions, the app may access account data such as email without the attacker learning the password. Changing the password alone may not end that access. The FBI’s September 1, 2026 alert explains this consent-phishing method and advises victims to revoke the application’s access in account security settings and contact the appropriate security team: FBI IC3’s consent-phishing alert.
How to assess a suspicious email
Warning signs can help, but none is conclusive by itself. Polished writing does not establish that a message is genuine, and spelling mistakes alone do not prove fraud.
- A sender address that is unfamiliar or subtly altered, even if the display name looks familiar.
- A generic greeting or an unexpected request that does not fit the sender or context.
- A link whose destination does not match the organization or request it claims to represent.
- An unexpected attachment, QR code, or request to approve an application.
- Pressure to act urgently, enter credentials, pay an invoice, change bank details, or share sensitive information.
Do not use a link or phone number in the suspicious message to check whether it is real. Navigate to the organization’s website independently, use a number already known to be legitimate, or contact a colleague through a separate, established channel. See the FBI’s advice on spoofing and phishing and Microsoft’s steps for protecting yourself from phishing.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do if you receive or act on a phishing email
If you only received it
- Do not click links, scan codes, open unexpected files, reply, or use contact information in the message.
- Report it through your email provider or workplace security team, then delete it.
- If the message claims to come from a company or colleague, verify the request through a separate trusted channel.
If you entered a password or approved an app
- If you entered credentials, change the password promptly through the legitimate site and follow your organization’s incident procedures.
- If you approved an OAuth application, revoke its access in account security settings and alert the relevant security team. A password change alone may leave the app’s access active.
If you may have sent money
Contact your financial institution immediately and ask it to contact the receiving institution. The FTC also advises reporting phishing messages and taking action if personal or financial information was shared. FTC phishing advice.
How organizations can reduce email phishing risk
Organizations can use controls that make common attack paths harder, while recognizing that no single measure guarantees every phishing attempt will be blocked or noticed.
- Authenticate mail from your domain. The FTC recommends SPF, DKIM, and DMARC so receiving systems can check whether mail claiming to come from a business domain is authorized. These controls address domain impersonation; they do not stop every fraudulent message or compromised account.
- Make financial verification routine. Require independent confirmation of wire requests and payment-detail changes using established contact information and approval procedures.
- Enable phishing-resistant MFA. CISA recommends phishing-resistant multifactor authentication and security reporting processes. MFA is a protective control, not a reason to trust an unexpected email.
- Train employees to report suspicious messages. Make reporting easy and ensure staff know how to verify requests outside the email thread.
For organizational controls, consult the FTC’s small-business cybersecurity guidance and CISA’s phishing-prevention actions.
Related phishing channels that are not email types
Smishing uses text messages, while vishing uses voice calls. They are phishing variants, but not email attack categories; criminals may use them as follow-up contact or alongside an email lure. The FBI’s phishing guidance distinguishes these channels.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
