Common Phishing Attacks and How to Recognize Them Before It's Too Late

I still remember the email that got my colleague. Perfect logo, correct sender name, urgent tone. It said our shared drive was about to be locked unless she re-authenticated. She'd been with the company seven years. She clicked. Forty minutes later, IT was rebuilding her mailbox permissions and we were all sitting in a conference room learning what a credential-harvesting page looks like.

That was the day I stopped treating common phishing attacks as a category I understood and started treating them as a moving target. Because the attack that works tomorrow will look nothing like the one that worked yesterday.

What common phishing attacks actually look like in 2026

The email is still the workhorse. But it's no longer the only horse. Over the past few years, the mix of vectors I see has shifted sideways — the volume is similar, but the channel diversity is what catches people off guard.

Here's the practical breakdown:

• Email phishing — mass send, spoofed brand, one link. Still the most common by volume.
• Spear phishing — targeted at you specifically, often using details pulled from your public LinkedIn, your company site, or a previous data breach.
• Smishing — SMS pretending to be your bank, your delivery carrier, or your own IT department.
• Vishing — a phone call from someone claiming to be "the helpdesk" who just needs to "confirm your MFA code."
• Clone phishing — a near-copy of a legitimate email you actually received, with the link or attachment swapped.
• Quishing — a QR code in a poster, a PDF, or a letter that sends you to a fake login page.
• Whaling — aimed at executives, usually around wire transfers or board-level approvals.

Notice what's missing from that list: "obvious." None of these are obvious anymore.

The one detail most people miss

The from-name is meaningless. Anyone can set a display name to "Microsoft Account Team" in thirty seconds. What matters is the actual address, expanded — and even that isn't always enough, because attackers register lookalike domains that pass a casual glance.

"rnicrosoft.com" instead of "microsoft.com." An extra letter. A dash where there shouldn't be one. A different top-level domain — ".co" instead of ".com". These work because your eye skims past them.

Hover before you click. Always. It costs you two seconds.

How to recognize a phishing attempt before you click

Forget the checklist you've seen a hundred times. Forgetting spelling errors is fine — plenty of phishing emails today are grammatically flawless, because they're written by professionals. The signals that actually work are behavioral, not cosmetic.

The real signals

1. Urgency with a deadline — "your account will be suspended in 24 hours." Legitimate services almost never give you a countdown.
2. Bypass of an existing process — an invoice that suddenly needs to be paid to a new bank account. A request from your boss's name asking you to buy gift cards. A "quick approval" that skips the tool you normally use.
3. Link text ≠ actual URL — hover. If the visible link says "portal.company.com" and the real destination is "portal-company-verify.xyz", you have your answer.
4. Unexpected attachment — a PDF, a .html file, or an Office document with macros, from someone you don't regularly exchange files with.
5. A reply chain you don't remember — clone phishing often inserts itself into a real thread you were already part of. The message looks familiar. The link doesn't.
6. Pressure to keep it private — "don't discuss this with anyone yet" is a classic. It removes your best defense: other people.
7. Login page reached without typing a URL — if you clicked into a sign-in screen, close it and go directly from your bookmark bar.

Two of those matter more than the rest. Urgency, and process bypass. Everything else is a variation.

Why 2FA doesn't save you the way you think

I used to be relaxed about phishing because our team had 2FA everywhere. Then I watched a live replay of a real-time relay attack — the attacker sits between you and the real login page, forwards your password, then forwards your one-time code, and grabs the session cookie. To the server, it looks like a normal login.

This is why the industry has been moving toward passkeys and hardware keys. Not because passwords are weak, but because anything you type can be relayed. Passkeys don't leave your device. That's the entire point.

Common phishing attacks, side by side

The differences matter, because your response should be different for each one.

Attack type	Channel	Typical target	Strongest giveaway
Mass email phishing	Email	Anyone	Link to an unrelated domain
Spear phishing	Email	Specific person	Suspiciously accurate personal detail + urgency
Whaling	Email / phone	Executives, finance	Wire transfer or approval outside normal process
Clone phishing	Email	Anyone in an existing thread	Same email, slightly different link
Smishing	SMS	Consumers, staff	Unsolicited link from a short code number
Vishing	Phone call	Anyone with an MFA prompt	Caller asks you to read a code aloud
Quishing	QR code	Retail, office, public spaces	QR sticker physically pasted over a real one

If you only remember one row, remember the vishing one. No legitimate helpdesk will ever ask you to read your one-time code aloud. Ever.

How to prevent phishing attacks in your organization

Here's where I'll be blunt, because I've watched this fail the same way across three companies I've worked with.

Annual training doesn't work. Once a year, everyone clicks through a slideshow, passes a five-question quiz, and forgets everything by lunch. I've measured click rates on simulated campaigns before and after that training. The improvement lasted roughly three weeks.

What actually moved the needle:

• Monthly simulations — short, unannounced, and never punitive. The moment a simulation becomes a "gotcha" that affects someone's review, people stop reporting real attacks out of fear.
• A one-click report button in the email client. If reporting takes more than one action, nobody does it.
• Kill the reward for reporting quietly. Publicly thank the people who flag suspicious mail. I've seen this single change double the reporting rate inside a quarter.
• DMARC, SPF, and DKIM properly configured on your own domain — this doesn't stop inbound phishing, but it stops attackers spoofing your brand to phish your customers.
• Passkeys or hardware keys for anything sensitive. This is the one change that eliminates entire attack categories rather than reducing them.
• A published process for "urgent" financial requests. If someone asks for a wire outside that process, the answer is a phone call to a known number — not a reply to the email.

The failure mode nobody talks about

The worst phishing incident I've seen wasn't caused by a missing technical control. It was caused by fear of looking foolish. Someone clicked, realized their mistake, and spent three hours trying to fix it themselves before telling anyone. By then the account had been used to send internal phishing to forty colleagues.

Make it easy to say "I think I clicked something wrong." That single sentence, said early, saves weeks of cleanup.

What to do if you already clicked

The clock is running. Here's the order that actually matters.

1. Disconnect from the network if you entered credentials or opened an attachment. Not permanently — just long enough to contain anything malicious.
2. Change the password for the compromised account, from a different device, and change it everywhere you reused it. Reuse is the amplifier.
3. Revoke active sessions for that account. Changing the password alone doesn't kill a stolen session cookie.
4. Tell your IT or security team immediately. Not after you've "looked into it." Now.
5. Check for forwarding rules and mailbox delegates that you didn't create. Attackers install these to keep reading your mail after you've changed the password.
6. Watch your bank and card statements closely for the next 30 days if any financial information was involved.

I've seen a case where the person did all six steps in under an hour and nothing happened. I've seen the opposite too — someone waited until the next morning, and by then the account had been used to request a wire transfer. The difference was timing, not skill.

The question that actually protects you

Phishing doesn't succeed because people are careless. It succeeds because it arrives at the exact moment you're busy, tired, or slightly worried about something — and it offers a plausible way to make that worry go away.

So the most useful mental habit isn't a checklist. It's one question, asked before you click anything:

Did I expect this, in this form, right now?

If the answer is no, take ten seconds. Hover the link. Call the person on a number you already have. Open the site from your own bookmark. If it's legitimate, those ten seconds cost you nothing. If it isn't, they just saved your account, your money, and probably a very long afternoon with your IT team.

Ten seconds. That's the whole defense.