How to Recognize and Defend Against Phishing Attacks

Phishing is the #1 method cybercriminals use to steal credentials, install malware, and commit fraud. AI has made these attacks dramatically more convincing.

Key statistics:

• 36% of all data breaches involve phishing (Verizon DBIR 2025)
• AI-generated phishing emails have a 60% higher click rate than traditional ones
• Business email compromise (BEC) caused $2.9 billion in losses in 2024
• The average phishing site is online for only 14 hours before being taken down

Types of phishing:


1. Email phishing — Mass emails impersonating trusted organizations

1. Spear phishing — Targeted attacks using personal information
2. Whaling — Targeting executives and high-value individuals
3. Smishing — Phishing via SMS text messages
4. Vishing — Phone call phishing (voice phishing)
5. Quishing — Phishing via QR codes

Train your eye to catch these red flags:

Email red flags:

• ⚠️ Urgency/fear: "Your account will be suspended in 24 hours!"
• ⚠️ Unexpected attachments: Especially .zip, .exe, .html, .iso files
• ⚠️ Mismatched sender: Display name says "Amazon" but email is @amaz0n-support.com
• ⚠️ Generic greetings: "Dear Customer" instead of your name
• ⚠️ Grammar mistakes: Though AI is reducing these significantly
• ⚠️ Requests for sensitive info: Legitimate companies never ask for passwords via email
• ⚠️ Suspicious links: Hover before clicking — does the URL match the claimed sender?

URL red flags:


• Misspelled domains: "paypa1.com", "arnazon.com"
• Extra subdomains: "login.amazon.com.evil.com" (look at the root domain!)
• Punycode/homograph attacks: "аpple.com" (that "а" is Cyrillic, not Latin)
• URL shorteners: bit.ly, tinyurl in official communications
• HTTP instead of HTTPS on login pages

Website red flags:


• No padlock icon or invalid certificate
• Slightly different design from the real site
• Forms asking for more info than usual
• Unable to navigate to other pages (only the phishing page works)

AI has transformed phishing from "spray and pray" to personalized, convincing attacks.

What AI enables:

• Perfect grammar and tone: No more spelling-mistake giveaways
• Personalization at scale: AI scrapes social media to craft targeted messages
• Voice cloning: Deepfake phone calls impersonating your boss or family
• Real-time translation: Flawless attacks in any language
• Chatbot interactions: AI-powered fake customer support chats

How to defend against AI phishing:


1. Verify through a separate channel: Got an email from your boss? Call or text them directly.

1. Use hardware security keys: They verify the actual website domain, defeating phishing regardless of how convincing the email is.
2. Establish verification protocols: Agree on code words for sensitive requests
3. Be skeptical of urgency: Legitimate requests can wait for verification

Technical defenses:

• Enable DMARC/DKIM/SPF on your email domain
• Use a browser with built-in phishing protection (Chrome, Firefox, Edge)
• Install a reputable ad/script blocker (uBlock Origin)
• Keep software updated — many attacks exploit known vulnerabilities
• Use DNS filtering (Cloudflare 1.1.1.2, Quad9 9.9.9.9)

Behavioral defenses:


• Never click links in unexpected emails — navigate to the site directly
• Always verify the full URL before entering credentials
• Use your password manager's autofill (it won't fill credentials on fake sites!)
• Enable login notifications on all important accounts
• Report phishing: forward to reportphishing@apwg.org or phishing@irs.gov

Organizational defenses:


• Conduct regular phishing simulations for employees
• Implement email filtering and sandboxing
• Use conditional access policies (location, device, risk level)
• Establish clear reporting procedures for suspicious messages

Stay calm and act quickly:

Immediate steps (first 15 minutes):

1. Disconnect from the internet if you downloaded something
2. Don't enter any more information on the suspicious page
3. Change the password for the account that was targeted (from a different, clean device)
4. Enable 2FA if you haven't already
5. Run an antivirus scan on your device

Within the first hour:


6. Change passwords for any accounts using the same password (see why reuse is dangerous?)
7. Check account activity for unauthorized access
8. Revoke active sessions on the affected accounts
9. Alert your bank if financial info was exposed
10. Enable fraud alerts on your credit reports

Within 24 hours:


11. Report the phishing to the impersonated organization
12. Report to authorities: IC3.gov (US), Action Fraud (UK), ACSC (AU)
13. Monitor your accounts for unusual activity
14. Warn contacts if your email was compromised