What is phishing and how does it work?

Phishing is a scam designed to make you hand over access or information. The scammer may want a password, card number, wallet recovery phrase, one-time code, or approval for a login that they started.

Most phishing begins with impersonation. A message appears to come from a bank, delivery company, workplace, game, support team, or someone you know. It gives you a reason to act and a link that leads somewhere controlled by the scammer.

A phishing message often invents a problem that feels urgent. Your account may supposedly be locked, a parcel may need a small payment, or somebody may have reported you. Other messages offer something appealing, such as a prize, job, refund, or free subscription.

The story varies, but its purpose is the same: it gets you to act through the message instead of opening the real service yourself. That is why even a well-written message can be dangerous. Spelling mistakes are common in some scams, but they are not a requirement.

The message normally points to a page made to look familiar. It may copy a real logo, sign-in form, support page, or payment screen. Anything entered there goes to the scammer or is used to approve something on the real service.

Not every phishing attempt uses a fake website. Some ask for information directly in a reply. Others use a QR code, phone call, malicious attachment, or request to install software. A scammer may also send a genuine login notification and persuade you to approve it.

A stolen password may be tested immediately. If the same password was used elsewhere, the scammer may try those accounts as well. Access to an email account is particularly useful because email can be used to reset other passwords and hide security messages.

Compromised accounts are often used to contact friends, colleagues, or community members. The next phishing message then arrives from an account people already recognise. In payment and crypto scams, the theft can happen as soon as a transfer or wallet approval is completed.

This is why a phishing incident is not always over when the fake page closes. Recovery means checking the real account, its active sessions, recovery details, connected apps, and any messages sent from it.

Treat an unexpected request as unverified until you check it through another route. Open the official app or type the address you know instead of using the supplied link. Read the website address before entering anything, and do not give passwords or recovery phrases to support staff.

Our guide on how to tell if a website is fake shows what to look for in an address and explains why HTTPS alone is not proof that a page is genuine.

If you find a suspicious site, keep the URL and report it to Phish Takedown. You do not need to open it or test the form.