EXECUTIVE SUMMARY

Phishing remains a top online threat in 2026, with attacks evolving to include sophisticated spoofing techniques that make fake messages look incredibly real. Recent reports show over 1.2 billion phishing emails sent daily, leading to billions in losses.

This updated white paper dives deeper into spotting phishing, especially through spoofed emails and messages that try to stop you from verifying them. It includes a glossary of terms, practical prevention steps, real examples, visuals, and graphs. Aimed at non-technical users, this guide empowers you to stay safe without needing expert knowledge.

WHAT IS PHISHING?

Phishing is a type of scam where criminals try to trick people into giving up sensitive information or taking an action that puts the organization at risk. While most people think of phishing as “a fake email,” the truth is that phishing happens across many different communication methods.

The most common type is email phishing, where an attacker sends a message that looks like it came from a trusted source (like Microsoft, a vendor, a coworker, your boss or your bank).

Another common type is spear phishing, which is a more targeted version of phishing. Instead of sending the same email to thousands of people, the attacker customizes the message using personal details—like your name, job title, company name, or even a real project you’re working on—to make it feel legitimate.

Phishing also happens through phone calls and text messages. Vishing (voice phishing) is when scammers call pretending to be IT support, a bank, or a company executive.

Smishing (SMS phishing) is when the scam comes through a text message, often using urgent language like “Your account is locked” or “Package delivery failed.”

One of the fastest-growing trends is spoofing, where scammers fake sender details to make a message look like it came from someone you trust. This could mean a fake email address, a fake display name, or even a message that appears to come from a real person inside your organization. Spoofing is dangerous because it makes phishing harder to recognize at a quick glance.

The reason this matters is simple: phishing is one of the most common starting points for major security incidents, including ransomware, financial fraud, and stolen accounts. Attackers don’t need to break through firewalls if they can convince a person to click the wrong thing. That’s why understanding these phishing methods is so important.