How to Protect Yourself from Phishing Attacks

What is phishing?

Phishing is a social engineering attack where an attacker creates a convincing copy of a legitimate website — often pixel-perfect — and tricks a victim into entering credentials there. The moment the victim submits the form, the attacker captures the username, password, and any second factor, then uses them to take over the real account within seconds.

The word comes from the metaphor of "fishing" for victims with bait (usually an email). The spelling changed to emphasize that attackers often use phone numbers (SMS phishing, or "smishing") and professional-looking infrastructure.

Why phishing is still the #1 threat

Most large-scale account breaches today don't involve hacking, cracking passwords, or bypassing encryption. They involve a human typing a password into a fake site. Phishing is:

• Cheap — an attacker can send millions of emails for the cost of a VPS and a spoofed domain
• Hard to filter — modern kits rotate domains, use legitimate hosting, and adapt to filters in real time
• Effective — even security-aware users fall for well-crafted targeted attempts (spear phishing)
• Scalable — a single successful phish often yields access to dozens of connected services through password reuse

The 2024 Verizon Data Breach Investigations Report found that phishing was the initial access vector in over 36% of all breaches — more than any other single cause.

How modern phishing works

Phishing has evolved far past the "Nigerian prince" emails of the 2000s. A modern phishing attack typically includes:

1. A convincing lure

Usually an email, text, or chat message creating urgency ("Your account will be suspended"), authority ("Microsoft security team"), or curiosity ("Someone tagged you in a photo"). Spear-phishing takes this further with personal details pulled from LinkedIn, breach dumps, or prior correspondence.

2. A pixel-perfect fake site

Attackers use off-the-shelf phishing kits that clone the target site's HTML, CSS, and JavaScript. Many kits are sold as a service (phishing-as-a-service), with working dashboards and customer support.

3. A real-time proxy for 2FA

The dangerous part: modern kits don't just capture your password. They act as a man-in-the-middle proxy that forwards everything you type — including your TOTP code — to the real site within seconds, bypassing most 2FA. This technique is called adversary-in-the-middle (AiTM) and is used in tools like Evilginx2 and Modlishka.

4. Session token theft

Once you authenticate through the proxy, the attacker captures your session cookie and can use it to stay logged in even after you change your password. This is why phishing response always includes revoking active sessions, not just password rotation.

What actually stops phishing

Hardware security keys (FIDO2 / WebAuthn)

This is the only category of defense that is phishing-proof by design. When you log in with a FIDO2 key, your key cryptographically verifies the exact domain of the site requesting authentication. A fake site — no matter how visually perfect — has a different domain, so the key refuses to respond. The cryptographic handshake simply does not complete.

Google famously mandated YubiKeys for all 85,000+ employees in 2017 and reported zero successful phishing attacks on company accounts in the years since.

Passkeys

Passkeys are the consumer-friendly evolution of FIDO2. They use the same domain-bound cryptography and are built into iOS, Android, macOS, and Windows. If a site you use supports passkeys, enabling one makes that account phishing-proof.

Password managers

A password manager is your second line of defense because it only autofills credentials on the exact domain where they were saved. If you land on paypaI.com (capital I) instead of paypal.com, your manager silently refuses to fill the form. That refusal is a loud warning that something is wrong.

Email and DNS filtering

Email providers use DMARC, SPF, and DKIM to detect spoofed sender addresses. Most modern providers catch the obvious attempts, but targeted attacks still slip through. Enable "report phishing" buttons in your mail client so you help the filters improve.

Red flags to watch for

When you receive a message asking you to log in, verify, or act urgently:

• Urgency and threats — "Your account will be closed in 24 hours"
• Generic greetings — "Dear customer" instead of your name
• Look-alike domains — paypaI.com, app1e.com, secure-microsoft-login.net
• Unexpected attachments — especially .zip, .html, or .pdf files asking you to log in to view them
• Grammar or formatting errors — large companies proofread their emails
• Link mismatch — hover over the link and check if the destination matches the text

If anything feels off, close the email. Navigate to the site manually. If there is a real issue, you will see it when you log in through your normal workflow.

What to do if you fell for one

Act quickly — speed matters because attackers start using credentials within minutes.

1. Change the password immediately on a different device (your phone, for example, if you fell for it on your laptop)
2. Revoke all active sessions in the account settings — this kicks out anyone currently using stolen session tokens
3. Enable 2FA if it wasn't already on, and use a hardware key or passkey if possible
4. Check for unauthorized activity — sent emails, recent logins, billing changes, new forwarding rules
5. Notify the affected institution if it's a financial or work account
6. Check other accounts that used the same password — even if you're sure you don't reuse passwords, check

The bottom line

Phishing thrives because it bypasses technology and targets humans. The best defenses mix three layers: password managers (refuse to autofill on wrong domains), phishing-resistant 2FA (hardware keys or passkeys that bind to the real domain), and healthy skepticism (never log in from an email link).

Enable all three on your most important account — your email — first. From there, the rest of your digital life gets meaningfully safer.