How to Protect Yourself from Phishing Attacks

What is phishing?

Phishing is a social engineering attack where an attacker creates a convincing copy of a legitimate website — often pixel-perfect — and tricks a victim into entering credentials there. The moment the victim submits the form, the attacker captures the username, password, and any second factor, then uses them to take over the real account within seconds.

The word comes from the metaphor of "fishing" for victims with bait (usually an email). The spelling changed to emphasize that attackers often use phone numbers (SMS phishing, or "smishing") and professional-looking infrastructure.

Why phishing is still the #1 threat

Most large-scale account breaches today don't involve hacking, cracking passwords, or bypassing encryption. They involve a human typing a password into a fake site. Phishing is:

• Cheap — an attacker can send millions of emails for the cost of a VPS and a spoofed domain
• Hard to filter — modern kits rotate domains, use legitimate hosting, and adapt to filters in real time
• Effective — even security-aware users fall for well-crafted targeted attempts (spear phishing)
• Scalable — a single successful phish often yields access to dozens of connected services through password reuse

The 2024 Verizon Data Breach Investigations Report found that phishing was the initial access vector in over 36% of all breaches — more than any other single cause.

How modern phishing works

Phishing has evolved far past the "Nigerian prince" emails of the 2000s. A modern phishing attack typically includes:

1. A convincing lure

Usually an email, text, or chat message creating urgency ("Your account will be suspended"), authority ("Microsoft security team"), or curiosity ("Someone tagged you in a photo"). Spear-phishing takes this further with personal details pulled from LinkedIn, breach dumps, or prior correspondence.

2. A pixel-perfect fake site

Attackers use off-the-shelf phishing kits that clone the target site's HTML, CSS, and JavaScript. Many kits are sold as a service (phishing-as-a-service), with working dashboards and customer support.

3. A real-time proxy for 2FA

The dangerous part: modern kits don't just capture your password. They act as a man-in-the-middle proxy that forwards everything you type — including your TOTP code — to the real site within seconds, bypassing most 2FA. This technique is called adversary-in-the-middle (AiTM) and is used in tools like Evilginx2 and Modlishka.

4. Session token theft

Once you authenticate through the proxy, the attacker captures your session cookie and can use it to stay logged in even after you change your password. This is why phishing response always includes revoking active sessions, not just password rotation.

What actually stops phishing

Hardware security keys (FIDO2 / WebAuthn)

This is the only category of defense that is phishing-proof by design. When you log in with a FIDO2 key, your key cryptographically verifies the exact domain of the site requesting authentication. A fake site — no matter how visually perfect — has a different domain, so the key refuses to respond. The cryptographic handshake simply does not complete.

Google famously mandated YubiKeys for all 85,000+ employees in 2017 and reported zero successful phishing attacks on company accounts in the years since.

Passkeys

Passkeys are the consumer-friendly evolution of FIDO2. They use the same domain-bound cryptography and are built into iOS, Android, macOS, and Windows. If a site you use supports passkeys, enabling one makes that account phishing-proof.

Password managers

A password manager is your second line of defense because it only autofills credentials on the exact domain where they were saved. If you land on paypaI.com (capital I) instead of paypal.com, your manager silently refuses to fill the form. That refusal is a loud warning that something is wrong.

Email and DNS filtering

Email providers use DMARC, SPF, and DKIM to detect spoofed sender addresses. Most modern providers catch the obvious attempts, but targeted attacks still slip through. Enable "report phishing" buttons in your mail client so you help the filters improve.

What each defence actually stops

Anti-phishing advice tends to arrive as an undifferentiated list. It is more useful to know which measure closes which attack:

Two rows deserve attention. A password manager is an anti-phishing tool, not just a convenience: it refuses to autofill on a domain that does not match, which makes it a better detector of a fake page than human judgement is. And a TOTP code — the thing most people think of as "having 2FA" — does not stop a modern phishing page at all, because the page simply relays the code to the real site while you wait.

Why "just be careful" stopped being enough

Advice written five years ago assumed phishing looked wrong: broken grammar, mismatched logos, a sense of haste. That assumption no longer holds.

Generated text removed the language tell entirely. A phishing email today can be fluent, correctly branded, contextually plausible, and personalised with details scraped from a breach or a public profile. The grammatical errors that once did the work of a warning label are gone.

Worse, the most effective attacks now reference something true. A message about a delivery you are actually expecting, from a service you actually use, arriving the week you actually ordered something. Vigilance is a real defence against the clumsy 90%, and it is close to useless against the careful 10% — which is precisely the 10% aimed at people worth attacking.

This is the argument for defences that do not depend on your judgement at that moment. A hardware key does not get tired at the end of a workday. A password manager does not decide the domain looks close enough.

If you entered credentials on a fake page

Speed matters more than certainty here — act before you finish confirming it was fake.

1. Change the password immediately, on the real site, reached by typing the address yourself rather than clicking anything. If that password was reused anywhere, change it there too, starting with your email.
2. Sign out all active sessions. Most major services offer this in security settings. A stolen password is often less valuable than the session it produced, and changing the password alone does not always kill the session.
3. Check what changed. Attackers routinely add a recovery email or phone, register their own 2FA method, or set a forwarding rule that silently copies your mail. Review recovery options, active 2FA methods, connected apps, and mail forwarding rules.
4. Enable a phishing-resistant factor on that account if it supports one. The account has already been targeted once, which makes it more likely to be targeted again.
5. Watch the email account hardest. It is the reset path for everything else, so a quiet compromise there is worth more to an attacker than the account you actually lost.

There is no shame in this step. Phishing pages are built specifically to defeat attention, and the people who fall for them are not careless — they are busy.

Red flags to watch for

When you receive a message asking you to log in, verify, or act urgently:

• Urgency and threats — "Your account will be closed in 24 hours"
• Generic greetings — "Dear customer" instead of your name
• Look-alike domains — paypaI.com, app1e.com, secure-microsoft-login.net
• Unexpected attachments — especially .zip, .html, or .pdf files asking you to log in to view them
• Grammar or formatting errors — large companies proofread their emails
• Link mismatch — hover over the link and check if the destination matches the text

If anything feels off, close the email. Navigate to the site manually. If there is a real issue, you will see it when you log in through your normal workflow.

What to do if you fell for one

Act quickly — speed matters because attackers start using credentials within minutes.

1. Change the password immediately on a different device (your phone, for example, if you fell for it on your laptop)
2. Revoke all active sessions in the account settings — this kicks out anyone currently using stolen session tokens
3. Enable 2FA if it wasn't already on, and use a hardware key or passkey if possible
4. Check for unauthorized activity — sent emails, recent logins, billing changes, new forwarding rules
5. Notify the affected institution if it's a financial or work account
6. Check other accounts that used the same password — even if you're sure you don't reuse passwords, check

The bottom line

Phishing thrives because it bypasses technology and targets humans. The best defenses mix three layers: password managers (refuse to autofill on wrong domains), phishing-resistant 2FA (hardware keys or passkeys that bind to the real domain), and healthy skepticism (never log in from an email link).

Enable all three on your most important account — your email — first. From there, the rest of your digital life gets meaningfully safer.