Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsPhishing is a social-engineering attack in which someone impersonates a trusted person or organization to get you to reveal information, visit a fake site, download malware, or engage with a scammer. The five common forms are general phishing, spearphishing, whaling, vishing, and smishing. They are not mutually exclusive: some labels describe whom an attacker targets, while others describe the channel used.
How the five types differ
Think about phishing along three dimensions: the channel, the target, and the action the attacker wants. A broad email lure and a personalized text can both be phishing, even though they differ in targeting and delivery. CISA’s descriptions distinguish general phishing, spearphishing, whaling, vishing, and smishing, but these are practical labels rather than a complete, exclusive taxonomy.
As an Amazon Associate I earn from qualifying purchases.
| Type | Channel | Targeting | Typical requested action |
|---|---|---|---|
| General email or web phishing | Email or malicious website | Broad | Click a link, download a file, or disclose information |
| Spearphishing | Often email or another message channel | Personalized to an individual | Click, disclose information, or take another requested action |
| Whaling | Often email or another message channel | High-profile person; seeks sensitive, high-value information | Disclose sensitive information or act on a targeted request |
| Vishing | Voice call or other voice communication | May be broad or targeted | Engage in conversation or disclose information |
| Smishing | Text message | May be broad or targeted | Click, download, disclose information, or engage in conversation |
The channel and targeting can overlap. For example, a text written with personal details may be both smishing and a targeted phishing attempt. The category names do not tell you whether a message is safe; judge the request and verify the sender independently. CISA’s phishing guidance defines phishing as social engineering that uses email or malicious websites to solicit personal information or induce malware downloads by posing as a trustworthy entity.
1. General email or web phishing
A scammer sends a message to many people while impersonating a familiar institution or service. It may claim there is a problem with an account, a payment, or a delivery and push the recipient toward a link, attachment, fake login page, or request for personal information. The broad approach does not require the attacker to know much about each recipient.
#1 Best Overall
2. Spearphishing
Spearphishing is aimed at a particular person and tailored with details about them. Personal references can make the message feel credible, but they do not prove it is genuine. Treat an unexpected request for credentials, money, documents, or another sensitive action as unverified until you check it through a trusted channel.
3. Whaling
Whaling is a targeted phishing attempt aimed at a high-profile person, often to obtain sensitive, high-value information. In a small organization, that may mean a leader or another person with access to valuable records or decisions. The defining feature is the intended target, not a special delivery channel.
4. Vishing
Vishing is phishing delivered through voice communication, such as a phone call. The caller may try to keep you in conversation, build trust, and persuade you to disclose information or take an action. A familiar-sounding voice or confident explanation is not independent verification.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
5. Smishing
Smishing is phishing delivered by text message. A text may urge you to click a link, download something, share personal details, or continue a conversation with the sender. The FTC reported that consumers lost $470 million to scams that started with text messages in 2024; this is a figure for reported text-message scam losses, not all smishing or all phishing. The FTC also said fake package-delivery messages were the most commonly reported text scam type. FTC data on 2024 text-message scams.
Rank #3
How to recognize a possible phishing attempt
Pause when an unexpected email, text, call, or social message asks you to click, download, transfer money, log in, or submit sensitive information. Common warning signs include:
- An urgent or threatening demand designed to rush a decision.
- A sender address or contact detail that does not match the organization it claims to represent.
- A link whose actual destination does not fit its visible text or the expected organization.
- An unexpected attachment or download.
- A request for a password, financial information, or other personal details.
These are clues, not a definitive checklist. A convincing message can be well-written and use familiar branding, and a message without obvious errors can still be fraudulent. NIST notes that AI can help create increasingly convincing phishing messages, making it especially important to examine requests for action carefully. NIST’s phishing guidance, updated August 19, 2025, recommends skepticism and verification through contact details you already know are genuine.
What to do when a message seems suspicious
- Stop before interacting. Do not click links or download attachments in an unexpected message. Do not provide passwords, financial information, or personal details in response to an unexpected request.
- Verify through a separate, trusted route. If the message might be legitimate, visit the organization’s website using an address you already know or call a phone number from a trusted record. Do not rely on links, phone numbers, or reply instructions in the suspicious message.
- Report it. The FTC advises reporting phishing emails to the agency and forwarding them to the Anti-Phishing Working Group. Forward suspicious texts to SPAM (7726). See the FTC’s phishing advice for reporting details.
- Respond based on what happened. If you gave away personal or financial information, use IdentityTheft.gov for recovery steps. If you opened an unexpected link, update your security software and scan for malware.
How small organizations can reduce phishing risk
No single control eliminates phishing. NIST recommends combining staff awareness with technical safeguards and account protections:
Recommended Free Tools
- Train employees to recognize suspicious requests and report them promptly.
- Use email filtering and email-authentication technologies that can reject spoofed messages.
- Keep antivirus software maintained.
- Enable multi-factor authentication; where possible, choose phishing-resistant authentication.
These measures work together: training helps people question a request, filtering and authentication can reduce some malicious or spoofed messages, and stronger sign-in protections can limit the damage when credentials are targeted. See NIST’s small-business phishing guidance and the FTC’s cybersecurity guidance for small businesses.
Best Value
What the available figures do—and do not—show
The FTC reported that email was the top method scammers used to contact people in 2024. It separately reported $470 million in consumer losses to scams that started with text messages that year. Those figures describe contact methods and text-message scam losses; they do not establish how common or successful each of the five phishing types is. They should not be used to rank spearphishing, whaling, vishing, smishing, and general phishing against one another.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
