What Is Phishing in Cyber Security? Types, Examples and How to Stay Safe

Phishing Meaning

The word phishing is a play on “fishing”. Attackers cast a wide net of messages and wait for someone to bite. The message usually creates urgency or fear: your account will be blocked, your parcel is held, your electricity will be cut, you have won a prize or a tax refund is waiting. A link or attachment then leads to a fake page that looks real or installs malware.

Phishing remains one of the most common starting points for breaches because it targets people rather than software. Even well-protected organisations can be compromised when one employee enters credentials into a fake login page.

Types of Phishing Attacks

• Email phishing: mass emails impersonating banks, marketplaces or government portals.
• Spear phishing: a personalised message aimed at a specific person using details from LinkedIn or social media.
• Whaling: spear phishing aimed at senior executives.
• Smishing: phishing via SMS, common with fake KYC, FASTag, electricity bill and courier messages.
• Vishing: phone calls from fake bank officers, police or customer-care agents.
• Quishing: malicious QR codes placed on posters or sent in messages.
• Clone phishing: a real email is copied and re-sent with a malicious link.
• Business email compromise: impersonation of a vendor or CEO to redirect payments.
• Social media and messaging phishing: fake profiles, job offers and investment groups on WhatsApp and Telegram.

Common Phishing Scenarios in India

Patterns repeat across cities. A message claims your bank KYC has expired and asks you to click a link; the page asks for card number and OTP. A caller says your parcel contains illegal items and connects you to a “police officer” who demands money. A part-time job offer on WhatsApp pays small amounts first and then asks for large “deposits”. An email from your “HR” asks you to open a salary revision PDF that is actually a credential-stealing page. A QR code sent to “receive” money actually authorises a payment from your account.

Understanding the pattern is more useful than memorising examples: urgency, authority, a link or app and a request for secrets or money.

How to Recognise a Phishing Message

1. Check the sender: look at the full address, not just the display name.
2. Hover over links: the real destination appears in the status bar; shortened links deserve extra suspicion.
3. Look for urgency: deadlines and threats are designed to stop you thinking.
4. Check spelling and tone: mistakes and unusual phrasing are clues, though modern phishing can be polished.
5. Be wary of attachments: unexpected invoices, ZIP files and macro-enabled documents are high risk.
6. Verify through another channel: call the official number printed on your card or on the official website.
7. Remember that banks never ask for OTP, PIN or CVV.

How to Prevent Phishing

For individuals: enable multi-factor authentication, use a password manager (it will not autofill on fake domains), keep browsers updated and never install apps or screen-sharing tools at a stranger’s request. For organisations: deploy email filtering with SPF, DKIM and DMARC, run regular awareness training and simulated phishing, restrict macros, require MFA for all accounts and provide an easy way to report suspicious messages.

Security teams investigate reported phishing by analysing headers, URLs and attachments, searching mailboxes for similar messages, blocking indicators and resetting exposed credentials. This is a core task in a SOC analyst role.

What to Do If You Clicked or Lost Money

1. Disconnect from the network if you installed something suspicious.
2. Change passwords for affected accounts from a clean device and enable MFA.
3. Call your bank immediately to block cards and report the fraud.
4. Call the national cyber crime helpline 1930 without delay and file a complaint at cybercrime.gov.in.
5. Keep screenshots, phone numbers, URLs and transaction IDs.
6. Warn friends and colleagues if your account was used to send messages.

We explain the process in detail in how to file a cyber crime complaint in India.

Learning to Fight Phishing Professionally

Phishing analysis, email security and awareness programme design are real job roles. Our beginner course teaches phishing recognition in plain language, while the complete course adds a lab where you build a phishing simulation, analyse headers and write an incident report. Organisations can also book employee awareness training.

Anatomy of a Phishing Email

Consider a typical message: “Dear customer, your bank account will be suspended today because KYC is pending. Click here to update immediately.” Several signals appear together. The greeting is generic. A deadline creates pressure. The sender address is slightly off, for example a free-mail domain or a look-alike domain with an extra letter. The link text shows the bank’s name but the real link, visible when you hover, goes to an unrelated address, perhaps a newly registered domain. The landing page copies the bank’s logo and asks for username, password, card number and OTP in a single form. A genuine bank would not ask for all of that on a page reached from a link in a message.

Practise reading messages this way: who is the sender really, what do they want me to do, what happens if I wait, and can I verify through a channel I trust?

Email Authentication: SPF, DKIM and DMARC

Organisations can reduce spoofing of their own domain using three DNS-based controls. SPF lists which servers may send mail for the domain. DKIM adds a cryptographic signature to messages. DMARC tells receiving servers what to do when SPF or DKIM checks fail and sends reports to the domain owner. Properly configured, they make it far harder for criminals to send mail that appears to come from your domain, although they cannot stop look-alike domains.

A Simple Phishing Simulation Exercise

In our lab sessions learners build a harmless simulation to understand how campaigns work. Using an open-source tool in an isolated environment, you create a template that resembles a password-reset email, set up a landing page that records only whether a click occurred, send it to a controlled test mailbox and analyse the results. You then write an awareness note explaining the warning signs. The goal is to learn how to design effective, ethical training — never to attack real people.

Phishing on Mobile: Special Risks

Phones hide full URLs, show fewer security warnings and make it easy to tap before thinking. Messaging apps add new risks: short links in groups, fake customer-care numbers shared on social media and QR codes that trigger payment requests. Protect yourself by using official apps, checking the sender number and refusing to scan QR codes to receive money; a QR code is only needed to pay.

Where to Go Next: Practice and Resources

Foundational topics become easier once you see how they connect. Treat each article as one piece of a map: networks carry data, operating systems run services, applications process input, people make decisions and attackers look for the weakest link among them. Revisit the basics regularly, because later topics such as cloud security and incident response build directly on them.

• Official documentation and RFCs for protocols you use daily.
• OWASP and MITRE ATT&CK websites for structured knowledge.
• Beginner labs on guided learning platforms.
• Government awareness portals for scams and safe practices.
• A study partner with whom you can explain concepts to each other.

More Questions Learners Ask

Are free resources enough for fundamentals?

They are a good start, but structured feedback from a live course helps you avoid gaps.

How often do fundamentals change?

Core principles change slowly, while tools and threats change quickly, so invest more in principles.

Which fundamentals matter most for employers?

Networking, Linux and Windows basics, common attack types and clear communication.

Do I need to memorise all these terms?

No. Understand the idea behind each term and how it appears in a real incident; vocabulary becomes natural through labs and repetition.

What is the best order to learn security topics?

Start with networking and operating systems, then threats and controls, then hands-on labs, and finally a specialisation.

How can I test whether I really understand a concept?

Try to explain it in two minutes to a non-technical friend and then demonstrate it in a lab.

Interview Questions Related to This Topic

Employers often use fundamentals like these to check whether a candidate really understands a topic. Try answering in your own words before reading the model answer.

What is the difference between a virus, worm and trojan?

A virus attaches to files and needs user action to spread, a worm spreads by itself across networks and a trojan pretends to be legitimate software while performing malicious actions.

What happens when you type a URL in a browser?

The browser resolves the domain with DNS, opens a TCP connection, performs a TLS handshake for HTTPS, sends an HTTP request and renders the response. Security professionals add where attacks can occur at each step, such as DNS spoofing or certificate issues.

How do you respond to a ransomware infection?

Isolate affected systems, preserve evidence, identify the strain and entry point, restore from clean backups, reset credentials and report to relevant authorities such as CERT-In. Paying should not be the default plan.

Terms to Remember

A shared vocabulary makes learning faster. These terms appear repeatedly in classes, labs and interviews:

• Social engineering: Manipulating people, rather than breaking technology, to gain access or information.
• Least privilege: Giving each user or system only the access needed for the job, limiting damage if an account is compromised.
• Incident response: The organised process of detecting, containing, eradicating and recovering from a security incident and learning from it.
• Spoofing: Disguising a sender, address or website as a trusted one, such as a forged email sender or fake caller ID.
• ISO 27001: An international standard for an information security management system, often required by enterprise customers.
• Phishing: A fraudulent message, usually email, SMS or WhatsApp, that tricks a person into revealing credentials, paying money or installing malware.

Learn This Hands-On: Recommended Courses

Reading builds understanding, but practice builds skill. If this topic interests you, the best next steps are Cyber Security Course for Beginners, SOC Analyst Course and Cyber Security Course. Every course includes live labs, and a new batch starts every week. You can try a free demo class first, compare fees or read about the cyber security course in your city.

Related reading: What Is Social Engineering in Cyber Security? Techniques and Defence • Types of Cyber Attacks: 15 Common Attacks Explained With Examples • How to File a Cyber Crime Complaint in India: Step-by-Step (cybercrime.gov.in and 1930).