How phishing actually works

The story people are told about phishing is that it catches the careless. That story is comforting and wrong, and believing it is itself a risk — it teaches you to feel safe whenever a message looks professional.

Phishing does not exploit stupidity. It exploits the shortcuts that make you able to process a hundred emails a day.

The three ingredients

Almost every successful phish combines the same three things.

A pretext that fits your day. An invoice at a company that pays invoices. A password expiry notice during a week when IT actually is doing a migration. A delivery notification in December. The message doesn’t have to be surprising — in fact it works far better when it isn’t. Attackers who have read your public LinkedIn, your job posting, or your last press release can make the pretext fit precisely.

A reason to act now. Urgency suppresses verification. “Your account will be suspended in 24 hours” isn’t there to frighten you; it’s there to make you skip the step where you check. Deadlines, angry executives, and expiring links all do the same job.

A frictionless action. One click. One login. One approved prompt. The easier the action, the less deliberation it triggers.

Remove any one ingredient and the attack usually fails. That’s useful, because it means you only have to interrupt one of them.

Why the sender looks legitimate

Two reasons, and the second is the one people underestimate.

The first is display-name spoofing. Mail clients show a friendly name, not an address. A message from accounts-payable@random-domain.example can display as Finance Team and, on a phone, the address may not be visible at all without deliberately tapping to expand it.

The second is that the account may be genuinely legitimate. If an attacker has already compromised a supplier’s mailbox, the phish arrives from the real company, on the real domain, passing SPF, DKIM, and DMARC — because it is that company’s mail server sending it. Every authentication check passes. It may even arrive as a reply inside an email thread you started.

This is why “check that the sender is who they say they are” is necessary but nowhere near sufficient. Sender authentication proves the message came from that domain. It cannot prove the person at the keyboard is the account’s owner.

What the attacker is actually after

Usually one of three things:

1. Credentials. A convincing login page, and now they have your password. This is why credential phishing pairs so well with MFA fatigue — the password is step one, not the finish line.
2. A session. Modern phishing kits proxy the real login page in real time, relaying your password and your MFA code, then stealing the resulting session cookie. This defeats most MFA, which is the single most important thing to understand about the current threat.
3. An action. No malware, no credentials — just a person persuaded to change bank details, approve a payment, or send a file. Nothing to detect technically, because nothing technical happened.

That third category is why purely technical controls will never close this. The payload is a decision.

The reframe worth keeping

Stop asking “does this look fake?” A good phish does not look fake.

Ask instead: “Is this message trying to make me do something quickly?”

Urgency is the ingredient that is hardest for an attacker to remove, because without it you have time to verify — and verification is what kills the attack. A message that is genuinely urgent will survive a two-minute delay. One that can’t survive two minutes was never legitimate.

Next: the tells that still work when the message looks perfect.