What is phishing and how to prevent phishing attacks?

Phishing scams try to trick you into revealing sensitive data or downloading malware, often leading to identity theft, credit card fraud, or other cybercrime. Learn all about phishing and how to prevent it.

With billions of phishing emails sent daily, phishing is one of the main ways online fraudsters attack individuals and organizations.

In 2022, the FBI received over 800,000 complaints of internet crime in the US, resulting in an estimated total loss of $10.3 billion. Of these, over 300,000 were related to phishing(new window).

Successful phishing attacks can have devastating consequences. Scammers could steal your identity(new window), drain your bank account, or hit you with ransomware. If you run a business, that could also mean loss of intellectual property, customer trust, and reputation.

We explain what phishing is, how it works, and how to protect yourself against phishing attacks.

Get Proton Mail button

What is phishing?

Phishing is an online scam in which attackers send you a fake message (usually by email) to trick you into revealing sensitive information (like login or credit card details) or downloading malware(new window) on your device.

The message appears to be from a legitimate source, like a bank, an email provider, or a popular service like Amazon, PayPal, or Facebook. But the aim is to trick you into doing one of the following:

  • Enter your personal details on a website that appears legitimate but in fact steals your data
  • Click on a link to a malicious website or download an infected attachment that installs malware on your computer, tablet, or phone
  • Reply to the message to provide sensitive personal data by email

A form of social engineering(new window), phishing messages often create a sense of urgency or excitement to make you respond without thinking. 

How does phishing work?

Typically, phishing messages contain urgent requests, threats, or prizes asking you to take immediate action. For example, they may claim your Amazon account has been “suspended” and you need to “confirm” your account details to reactivate it. 

In this phishing email, which appears to be from the delivery service UPS, you’re asked to click on a link to pay a “delivery fee” and provide personal details. If you don’t, you won’t get your “package”.

Phishing email example pretending to be from UPS
Phishing email example

But check the email’s From line, and you’ll see it’s not genuine. The display name says UPS but the following email address ( clearly has nothing to do with UPS. In any case, you haven’t ordered any UPS delivery.

Clicking on the link could lead to a fake website where you’re asked to enter your credit card details, home address, or other sensitive data. Or the email could include an unsolicited attachment that automatically installs malware on your device when you download it.

See how to spot a phishing email below for more telltale signs of phishing.

Types of phishing attacks

Scammers can deliver phishing messages via SMS text, social media, or phone calls, but most phishing attacks come by email.

Email phishing

Attackers send bulk emails that appear to come from real organizations to trick you into revealing private information. Typically, scammers aim to steal account login details, banking or credit card details, or personally identifiable information to use for identify theft(new window).

Phishing emails are usually generic and sent in bulk as spam email. The more sent, the greater the chance of “catching” someone.

Spear phishing

Spear phishing emails are usually sent to specific people in an organization, often those with special access rights. The aim is to steal sensitive information like login details or to infect the victim’s device with malware to harvest confidential data.

Messages are often personalized and appear to come from a sender the target trusts, so it’s easy for them to let their guard down. For example, a fraudster impersonating a company accountant may email the accountant’s assistant asking them to make an urgent payment to a fake vendor.

Spear phishing is one of the main methods of business email compromise (BEC)(new window).

Whale phishing (whaling)

Like spear phishing, whaling is a personalized attack, but the target is top management, like a CEO. By targeting C-level management, the fraudsters hope to gain more valuable information or access to financial accounts.

As with spear phishing, targets can easily fall victim because the message may be highly personalized and convincing — apparently from someone they trust.

Vishing and smishing

Vishing is a kind of phishing that uses fraudulent phone calls or voicemails. Scammers pretending to be from a legitimate company call you (either a real person or robocall) and ask for personal information.

For example, they phone from your “broadband provider” and say there’s a problem with your account. They may ask for your name, Social Security number, or credit card information to “resolve the issue”.

Smishing is simply phishing that uses SMS texts instead of emails. Like phishing emails, the text may contain a malicious link to a fake website that’s used to steal your personal data. Or the link could download malware onto your device.

Angler phishing (social media)

Angler phishing is when scammers set up social media accounts pretending to be a company’s customer service agent. By intercepting a customer’s complaint or query on social media, they can ask the victim to provide personal details to “investigate the problem”.

Another method is to create a fake website resembling a social media login page. Fraudsters may also send you phishing emails that appear to come from a social network asking you to “update” or “confirm” your personal details.

How to spot a phishing email

While some phishing emails look like they’re from a legitimate source, many contain clear signs they’re fake.

Look out for the following red flags. Spot any of these in a message, and the chances are it’s a phishing attempt:

Phishing email example pretending to be from PayPal showing phishing red flags
Phishing red flags

1. Unofficial sender’s address: 

The sender in the From field is, but the following email address is actually <>. The unofficial address instead of is a good sign the message is fake.

2. Generic greeting

While legitimate emails usually greet you by name, like “Hi Alice” or “Hello Bob Jones”, fraudsters often start with a general greeting like “Dear Customer” or “Hi” followed by your email address. Or they may use no greeting at all.

3. Urgent requests, threats, or prizes

Phishing emails often pretend your account has been compromised. They ask you to take urgent action to “verify” or “confirm” your personal details, or your account will be suspended or closed. 

Others report a pleasant surprise for you: a “tax refund”, “lottery win”, or “special offer” that’s only available for a limited time. Or a random beautiful man or woman on a fake adult site has picked you for a partner out of the blue. 

4. Grammar or spelling mistakes

Scammers are not always the best writers, so look out for errors. Here it’s a simple capital letter “We” in the middle of a sentence, or it may be a company name misspelled: “Pay-pal” instead of “PayPal”.

5. Links, buttons, or unsolicited attachments

Phishing messages often invite you to click on a button or link to enter personal information or make a payment. If you’re using a computer, hover your mouse over the link (don’t click!), and you’ll see the URL ( is different from the link ( 

Or messages may contain an attachment, like a fake invoice, containing malware that infects your computer when you download it.

Remember that some phishing emails may look completely normal; the only clue would be the suspicious intent.

For example, suppose you were a company accountant and “your boss Sally” (a fraudster) emailed you to make an urgent wire transfer to an unfamiliar bank account. The email looks like it’s from Sally, but would she do that? Is that her writing style? If in doubt, call or text her.

Three steps to check for phishing

All the above are clear indications of phishing, but not all scam emails are so easy to spot. 

That’s why we recommend taking the following steps when you receive any email with a button, link, attachment, or request for personal details, especially if it’s demanding urgent action:

Three steps to check for phishing when you receive a suspicious email
Three steps to check for phishing

Remember that only fraudsters get in touch out of the blue and urge you to take immediate action or else. And legitimate companies won’t ask you for sensitive information by email.

If you’re concerned about an “urgent” message from your bank, for example, log in to your account or contact the bank directly to check. Only don’t use the contact details or login links in the message.

How to prevent phishing attacks

Being vigilant for signs of phishing is just one way to protect yourself against it. Here’s how to minimize the risk of phishing on all your devices:

1. Secure your email

Use a secure email provider with smart spam filtering, like Proton Mail. Proton Mail automatically filters spam into your spam folder and has PhishGuard advanced phishing protection, which flags potential phishing attacks.

Proton Mail red banner warning that this email has been flagged as a phishing attempt
Proton Mail phishing warning

We also make it easy for you to report phishing on the Proton Mail web and mobile apps.

Don’t click on links or download attachments in emails, text messages, or social media from unknown senders.

If you’re using a computer, you can hover your mouse over (don’t click!) a link to check the destination URL. In this fake UPS phishing email, the URL ( clearly has nothing to do with UPS.

Showing how to hover your mouse over a link in an email to check whether the destination URL is genuine
Hover over a link to check it

With Proton Mail, you can use link confirmation to check that email links are genuine, like this one from eBay UK (

Proton Mail's link confirmation feature, which allows you to check links in emails for signs of phishing
Proton Mail link confirmation

3. Don’t respond to spam

Don’t open spam messages or respond to them in any way. By replying to spam emails or SMS (for example, hitting unsubscribe or texting STOP), you’re only letting the spammers know that your email address or phone number is active. Delete them.

Opening emails can also allow email trackers to track you across the web. Get Proton Mail with enhanced tracking protection to block trackers.

Create a free Proton Account button

4. Install antivirus software

Antivirus or internet security software may include spam filters to block potential phishing emails, and many subscriptions cover desktop and mobile devices. Make sure it’s from a reputable brand and updated with the latest virus and malware definitions.

If you do accidentally click on a phishing link and download malware, your security software may detect and disable it.

5. Keep your devices up to date

Keep your computer or phone operating systems, browsers, browser plug-ins, and other apps updated to the latest versions with security patches.

This can protect you against phishing that exploits operating system vulnerabilities.

6. Use strong passwords and 2FA

Make sure you use strong, unique passwords on all your online accounts. We recommend using a good, open-source password manager to help you create and remember strong passwords.

And enable two-factor authentication (2FA) wherever you can. That way, if your usernames or passwords are ever revealed through phishing, scammers won’t be able to access your accounts.

7. Back up your data

Make regular backups of your data, including offline backups. That way, you can always restore your data if your device is infected with ransomware or other malware that results in data loss.

Protect your business from phishing

Businesses in the US lost over $2.7 billion to business email compromise(new window) in 2022. Of the companies in the UK who reported a cyberattack in the same year, 83% said the attack was phishing(new window).

Fall for a phishing attack, and you could suffer a data breach or a ransomware attack. Apart from financial and data loss, that could damage your brand and customer trust.

So if you run a business, taking steps against phishing is vital for your cybersecurity. Here’s how to minimize the risk of phishing to your business:

Enable spam and phishing filters

Make sure you turn on spam and phishing filters in your email and internet security software.

Sign up for Proton for Business, and you’ll get Proton Mail with automatic spam filtering and PhishGuard advanced phishing protection enabled by default. Proton Mail also includes anti-spoofing for custom domains to prevent scammers from using your company domain for spam or phishing attacks.

Train your team

Run regular phishing awareness training with your employees so they know how to spot phishing. If you have the IT resources, you can send them mock phishing emails to give them practical experience. Make it easy for them to report suspected phishing.

Enforce strong passwords and 2FA

Make sure your IT systems enforce strong passwords and 2FA on all your team’s devices. If any of your team’s login details are revealed through phishing, 2FA will give you an extra line of defense.

Get corporate antivirus

If you have more than a couple of people on your team, consider getting enterprise cybersecurity software. Corporate antivirus solutions include real-time threat monitoring that focuses on endpoint security(new window) for whole networks, not just individual devices.

Protect critical data

Encrypt your business’s data to protect yourself. Consider Proton for Business, which secures your email, calendar, and online storage with end-to-end encryption. No one but you and those you authorize can access your data, even if your files are exposed in a data breach.

Back up your data

Make regular backups of your company’s critical information, including offline backups. That way, if a successful phishing attempt leads to data loss, you can always recover your information.

Stay safe against phishing

From bulk spam to targeted whaling, phishing remains one of the main ways scammers commit online fraud, and we’re all targets.

Since phishing relies on human error, vigilance is the best defense. If you receive a message with signs of phishing, don’t open or respond to it. Delete it.

But we’re all human, and even seasoned IT security experts can fall for phishing sometimes. That’s why you need to take steps to reduce the risk.

We’ve designed Proton Mail to give you the best chance against phishing, including:

So beware of suspicious messages, get Proton Mail, and stay secure!

Secure your emails, protect your privacy
Get Proton Mail free

Related articles

People and companies are generally subject to the laws of the country and city where they are located, and those laws can change when they move to a new place. However, the situation becomes more complicated when considering data, which can be subjec
Your online data is no longer just used for ads but also for training AI. Google uses publicly available information to train its AI models, raising concerns over whether AI is even compatible with data protection laws. People are worried companies
iPhone stores passwords in iCloud Keychain, Apple’s built-in password manager. It’s convenient but has some drawbacks. A major issue is that it doesn’t work well with other platforms, making it hard for Apple users to use their passwords and passkeys
There are many reasons you may need to share passwords, bank details, and other highly sensitive information. But we noticed that many people do this via messaging apps or other methods that put your data at risk. In response to the needs of our com
Large language models (LLMs) trained on public datasets can serve a wide range of purposes, from composing blog posts to programming. However, their true potential lies in contextualization, achieved by either fine-tuning the model or enriching its p
is Google Docs secure
Your online data is incredibly valuable, particularly to companies like Google that use it to make money through ads. This, along with Google’s numerous privacy violations, has led many to question the safety of their information and find alternative