Phishing Scams in 2026: How They Work & How to Avoid Them

What is Phishing? Types, Real Examples & How to Spot Every Attack (2026 Guide)

In February 2024, a finance employee at a multinational company in Hong Kong received a video call from his CFO. The CFO asked him to authorise a series of urgent transfers totalling $25 million. The employee was nervous about the large amount but recognised the CFO's face, voice, and mannerisms on the call. Several other colleagues were also on the call — the employee could see their faces and hear their voices too.

Every person on that call except the employee was a deepfake generated by AI. The $25 million was transferred and never recovered.

That incident illustrates something important: phishing in 2026 is not the poorly-written email from a Nigerian prince that you can spot by the spelling mistakes. It is hyper-personalised, increasingly indistinguishable from real communication, and now delivered not just via email but via phone calls, SMS, WhatsApp, social media, and video. Understanding every variant — and how to detect each one — is now a fundamental life skill.

The scale of the problem: Phishing accounts for 48% of all ransomware initial access (Mandiant M-Trends 2026). Email phishing decreased to just 6% of intrusions — but voice-based phishing (vishing) surged to fill the gap. AI-generated phishing campaigns are now indistinguishable from legitimate communication to the untrained eye. 3.4 billion phishing emails are sent every day.

Quick Navigation:

What phishing actually is — and why the old mental model is dangerous
Every type of phishing explained — email, spear, whaling, smishing, vishing, clone, QR
AI-powered phishing — the 2026 escalation you need to understand
Anatomy of a real phishing email — every red flag dissected
Real attack scenarios — the $25M deepfake, the IT helpdesk bypass, the CEO fraud
How to spot phishing — the detection checklist for every channel
What to do if you clicked — damage control steps
Protecting your organisation — technical and human controls

What Phishing Actually Is — And Why the Old Mental Model Is Dangerous

Phishing is the use of deception to manipulate a person into taking an action that benefits an attacker — typically clicking a malicious link, entering credentials on a fake website, revealing sensitive information, or authorising a fraudulent financial transaction.

The old mental model — "phishing is a suspicious email you can spot easily" — is dangerous because it creates false confidence. People who have learned to check for poor grammar and strange sender addresses feel immune. They are not. Modern phishing:

Is often personalised with real information about the victim pulled from data breaches, LinkedIn, and social media
Comes from compromised legitimate email accounts (a real colleague's real email address)
Uses domains that are visually identical to the real thing (paypa1.com, amazon-secure.co)
Bypasses email security tools using legitimate cloud services (SharePoint, Google Drive, Dropbox) to host malicious content
Is increasingly delivered via voice calls, SMS, and video rather than email
In the most sophisticated cases, uses AI to generate completely convincing audio and video of real people

The single most important reframe: Phishing is not a technical attack — it is a social engineering attack delivered through technology. The vulnerability being exploited is not in the email server. It is in human trust, urgency responses, and authority compliance. Recognising that helps you understand why technical filters alone cannot stop it.

Every Type of Phishing — Explained with Real Examples

Most Common

Email Phishing (Bulk / Generic)

Mass-sent emails impersonating a trusted brand — PayPal, your bank, Netflix, Amazon, Microsoft, or a government body — designed to trick a large number of recipients into clicking a link and entering their credentials. The message creates urgency: "Your account has been suspended," "Unusual activity detected," "Your payment failed." The link goes to a convincing fake version of the real website. The goal is credential theft or malware installation.

Real example: During the UK COVID-19 lockdowns, the NCSC observed millions of phishing emails impersonating HMRC (the UK tax authority) claiming recipients were owed a tax refund. Clicking led to a fake HMRC login page that harvested National Insurance numbers, dates of birth, and banking details. Over 1,200 phishing sites were taken down in the first 12 months.

Red flags: Urgency in the subject line. Generic greeting ("Dear Customer"). Slightly wrong domain (hmrc-refund.gov.uk instead of hmrc.gov.uk). Link URL does not match the claimed sender. Requests for information a legitimate company already has.

High Success Rate

Spear Phishing — Targeted, Personalised Attacks

Unlike bulk phishing which is generic, spear phishing targets a specific individual with a message crafted using real information about them — their name, job title, employer, manager's name, recent work projects, colleagues, or personal details obtained from data breaches and social media. The email appears to come from someone the victim knows or from a relevant authority. The personalisation dramatically increases click rates. Spear phishing is the entry point for most serious corporate intrusions and often precedes ransomware attacks.

Real example: In the 2016 Democratic National Committee (DNC) hack, Russian intelligence operators sent a targeted email to John Podesta, then chairman of the Hillary Clinton campaign. The email appeared to be a genuine Google security alert about a suspicious sign-in from Ukraine. It included a convincing "Change Password" button. Podesta's aide called it "legitimate" (meant to say "illegitimate"). The credentials were harvested and used to access the entire campaign email archive.

Red flags: How did they know that detail about me? The request is slightly unusual for this person. Urgency combined with a request to bypass normal process. The email is addressed to me by name from someone I recognise — but the reply-to address is different from the from address.

Executives & Finance Teams

Whaling — CEO and Executive Targeting

Whaling is spear phishing aimed specifically at senior executives — CEOs, CFOs, CTOs, and board members. These individuals have maximum access and financial authority. Attacks often impersonate regulators, legal firms, or other executives requesting urgent action — authorising a wire transfer, providing login credentials, or signing a document. The attacker researches the target extensively beforehand. Because executives are often above normal security protocols in their organisations ("just get it done" culture), whaling has exceptionally high success rates.

Real example: Business Email Compromise (BEC) — a form of whaling — cost organisations globally $2.9 billion in 2023 according to FBI IC3. In a typical BEC attack, an attacker either compromises the CEO's email account or registers a domain that looks identical (CEO@company.co instead of CEO@company.com) and uses it to instruct the CFO to make an urgent wire transfer to a new supplier. Average loss per successful attack: $125,000.

Red flags: Financial request from a senior executive that bypasses normal approval processes. Urgency and request for secrecy ("do not discuss with anyone else"). Slight domain difference in the sender address. Any financial transfer to a new or changed bank account should require voice verification through a known phone number.

Mobile Devices

Smishing — SMS Phishing

Phishing delivered via SMS. Impersonates delivery companies (FedEx, DHL, Royal Mail, India Post), banks, government agencies (IT department, UIDAI), or telecom providers. Common lures: "Your package is on hold — pay a small customs fee," "Unusual activity on your account — verify now," "Your KYC is expired — update to avoid service disruption." Mobile users are statistically more likely to click links than desktop users, and SMS messages feel more trusted than email. The link leads to a mobile-optimised fake website.

Real example: The FluBot malware campaign (2021-2022) spread across Europe through smishing. Recipients received SMS messages claiming to be from DHL about a package. Clicking installed malware on Android phones that stole banking credentials, intercepted SMS two-factor authentication codes, and sent the same phishing SMS to all contacts. Millions of devices were infected across Spain, Germany, UK, and Australia before international law enforcement dismantled the operation.

Red flags: SMS from an unknown number asking you to click a link. Unexpected delivery notification for something you didn't order. Requests for payment via link rather than through the official app. URL shorteners in SMS links (you cannot see the real destination).

Fastest Growing

Vishing — Voice Phishing

Phishing conducted via phone call. Attackers impersonate bank fraud departments, technical support, tax authorities (IT department, IRS), or government agencies. Voice creates a stronger sense of urgency and authority than text. In 2025, traditional email phishing fell to just 6% of intrusions while vishing surged — partly because humans are instinctively more trusting of a voice than text, and partly because AI voice cloning now allows attackers to impersonate real people convincingly. Callers use information from data breaches to sound legitimate ("I can see your account ending in 4821").

Real example: The ShinyHunters/Scattered LAPSUS group systematically targeted IT help desks at major companies in 2023-2024 using vishing. They would call an organisation's IT helpdesk impersonating an employee (using real employee names, employee IDs, and personal details purchased from dark web markets) and request a password reset and MFA bypass due to a "lost phone." This technique was used in the Twilio, Uber, and MGM Resorts breaches. The MGM Resorts attack — initiated by a single 10-minute helpdesk call — caused $100 million in losses.

Red flags: Caller knows personal details about you (doesn't prove legitimacy — that data came from a breach). Any call creating urgency about account security, payments, or legal action. Requests to install remote access software ("TeamViewer," "AnyDesk") to "fix" a problem. Hang up and call back on a number from the official website.

Increasingly Common

Clone Phishing

An attacker takes a legitimate email that the victim has previously received — a real delivery notification, a real meeting invite, a real newsletter — and creates an almost identical copy. The email looks exactly right because it is copied from a real one. The only change is the links or attachments, which are replaced with malicious versions. Clone phishing is particularly effective because the email passes visual scrutiny completely — it has the right logo, right layout, right footer, right tone, because it was copied from a genuine message.

Red flags: Email that looks familiar but arrives unexpectedly ("re-sending this as the link expired"). The timing feels slightly off. Hover over links before clicking — the URL should match the company's real domain exactly. Be suspicious of "updated" versions of emails you already received.

Growing Rapidly

QR Code Phishing (Quishing)

Malicious QR codes embedded in emails, printed on physical documents, or placed as stickers over legitimate QR codes in public places. QR codes bypass email link scanning — security tools that analyse URLs in emails cannot analyse what is inside an image containing a QR code. The attacker emails a document, invoice, or supposed multi-factor authentication setup page that contains a QR code. When scanned on a mobile device, the victim is taken to a phishing page. QR phishing increased by 587% in 2023 and has continued growing.

Red flags: Unsolicited emails asking you to scan a QR code to verify your account or complete security setup. QR codes in physical locations that look like they have been placed over an existing code (check the physical surroundings). Use a QR code scanner that shows you the URL before opening it.

AI-Powered Phishing — The 2026 Escalation

How AI Has Changed Phishing

The traditional tells of phishing — poor grammar, generic greetings, awkward phrasing — were always the weakest attackers' mistakes, not a reliable detection method. AI has eliminated even those weak signals.

Large language models allow attackers to generate unlimited personalised phishing emails with perfect grammar, appropriate tone for any industry, and content contextually relevant to the specific target. A spear phishing email that previously took hours to research and write can now be generated in seconds for thousands of targets simultaneously.

More significantly, AI voice cloning and video deepfakes have moved vishing and whaling into genuinely new territory:

Voice cloning: 3 seconds of audio from a voice note, a company presentation, or a YouTube video is sufficient for current AI tools to clone a person's voice. Attackers clone the voice of a CEO, manager, or family member to add believability to a phone call. Used in the $25 million Hong Kong deepfake incident and multiple "stranded relative" scams.
Video deepfakes: The Hong Kong case used real-time deepfake video of multiple colleagues in a conference call setting. As of 2026, real-time deepfake video requires significant computing resources but is accessible to well-funded criminal groups and nation-state actors.
AI-personalised at scale: AI can scrape a target's LinkedIn, public social media, and breach data to generate a uniquely personalised email for every person in a target organisation's directory — combining the personalisation of spear phishing with the scale of bulk phishing.
Adversarial inputs: AI is being used to generate phishing content that deliberately evades AI-based email security filters, testing variations until one passes.

The practical implication: never use communication style or visual appearance as your primary trust signal. A message that looks and sounds exactly right is not proof of legitimacy.

Anatomy of a Real Phishing Email — Every Red Flag Dissected

Here is what a sophisticated 2026 phishing email looks like, with every manipulation tactic annotated:

From: security-alerts@paypa1-secure.com FAKE DOMAIN — 1 not l

To: yourname@youremail.com

Subject: Urgent: Unusual sign-in detected on your PayPal account URGENCY TRIGGER

Reply-To: collector2847@protonmail.com DIFFERENT FROM SENDER

Dear Amardeep Maroli, PERSONALISED — from breach data

We have detected an unusual sign-in attempt on your PayPal account from a new device in Moscow, Russia FEAR TRIGGER at 03:14 AM. For your security, we have temporarily limited your account.

To restore full access, please verify your identity within the next 24 hours ARTIFICIAL DEADLINE or your account will be permanently suspended.

Click here to verify your identity securely LINK GOES TO paypa1-secure.com/verify

If you do not verify, your linked bank account ending in **4821 REAL DATA FROM BREACH — creates false legitimacy will be disconnected within 24 hours.

PayPal Security Team
© 2026 PayPal Inc. All Rights Reserved. LEGITIMATE-LOOKING FOOTER
To stop receiving security alerts, click here to manage notification preferences. UNSUBSCRIBE LINK ALSO MALICIOUS

Notice what makes this effective: the personalised name and real account detail make it feel legitimate. The Moscow location trigger fear. The 24-hour deadline prevents careful thinking. The footer looks real. Only the domain — paypa1-secure.com using a numeral 1 instead of the letter l — reveals the fraud, and that distinction is easy to miss.

Real Attack Scenarios — 2024-2026

The $25 Million Deepfake Video Call — Hong Kong, 2024

A finance employee received a phishing email instructing them to attend a confidential video conference about a secret acquisition. On the call, they saw and heard the company's CFO and multiple colleagues. All were deepfakes generated using publicly available AI tools and sourced from real video footage of the individuals from company announcements and LinkedIn. The employee, reassured by the familiar faces and voices, authorised 15 transactions totalling $25 million (HKD 200 million). The company did not discover the fraud until the employee called the real CFO about a follow-up to the meeting.

MGM Resorts — The 10-Minute Helpdesk Call, 2023

The Scattered Spider (LAPSUS$-linked) group researched an MGM employee on LinkedIn, obtained their personal details from publicly available breach databases, then called MGM's IT helpdesk impersonating the employee. A 10-minute phone call — vishing with publicly available information — resulted in an IT helpdesk agent resetting the employee's credentials and MFA. Attackers gained access to MGM's identity provider and ultimately deployed BlackCat ransomware across the organisation. MGM estimated losses of over $100 million. The intrusion vector: a single phone call, no technical exploitation required.

AI-Personalised Spear Phishing — Corporate Campaigns 2025-2026

Multiple incident response firms have documented campaigns in 2025-2026 where attackers used AI to generate unique, personalised phishing emails for every employee in a target organisation. Each email referenced real projects the employee was involved in (scraped from public communications), addressed them by name, and impersonated their direct manager using language patterns consistent with the manager's communication style (extracted from public LinkedIn posts and email signature footers). Click rates on these campaigns were 3-5x higher than generic phishing. Traditional security awareness training that focuses on spotting poor grammar provides no defence.

How to Spot Phishing — The Detection Framework

The key insight is that you cannot rely on single indicators. Sophisticated phishing passes any single check. You need a layered assessment:

Email: The SLAM Method

Before clicking anything in an email, run through four checks:

S — Sender: Is the exact email domain correct? Hover over the sender name to reveal the actual email address. Check for subtle substitutions: 0 for O, 1 for l, rn for m, a hyphen added (paypal-security.com). Even if the sender looks right, check the Reply-To address separately.
L — Links: Hover over every link before clicking. Does the URL match the claimed company's real domain? Be suspicious of URL shorteners, redirect services, or legitimate cloud services (Google Drive, SharePoint) hosting pages that then redirect elsewhere.
A — Attachments: Did you expect this attachment? Malicious file types include .exe, .js, .vbs, .wsf, and increasingly, Office documents with macros (.docm, .xlsm) and PDFs with embedded scripts. When in doubt, do not open — contact the sender through a separate channel.
M — Message: Does the request make sense for this sender? Does the urgency feel artificial? Does it ask you to bypass a normal process or keep something confidential? Real security teams never ask for your password via email.

Phone Calls: The Verification Protocol

The most important rule for phone-based phishing: the caller's ability to cite real information about you is not evidence of legitimacy. That information is available in data breach markets. Apply this protocol to any unexpected call requesting sensitive action:

1. Do not take sensitive action during an inbound call — no matter how urgent the caller makes it sound.
2. Hang up politely and call back on a number you find independently (from the official website, the back of your bank card, or a statement) — not a number the caller gives you.
3. For executive-level financial requests, always verify via video call or in person — never act on voice-only instructions for large transfers. As a developer note: this is why your company's verification procedures need to be updated for the deepfake era — even video may not be sufficient without a pre-established code word system.

SMS and QR Codes: Default Scepticism

Treat all SMS links from unknown numbers as malicious until proven otherwise. Even SMS from "known" numbers can be spoofed. For any SMS claiming to be from your bank, delivery company, or government agency: do not click the link — go to the official website or app directly instead. For QR codes in physical locations, inspect the code for signs of tampering (stickers placed over originals). Use a QR scanner that shows you the full URL before opening it.

Anti-Phishing Protection Checklist

Enable MFA on all important accounts. Even if a phishing attack steals your password, MFA prevents account access. Use an authenticator app — not SMS MFA for critical accounts (SMS can be intercepted via SIM swapping).
Use unique passwords for every account stored in a password manager. If a phishing attack harvests one password, unique passwords mean it unlocks nothing else. The password manager also serves as a phishing detector — it will not autofill credentials on a fake site that doesn't match the real domain.
Pause before clicking links or opening attachments in any unexpected communication — email, SMS, WhatsApp, or any other channel. Urgency is a manipulation tactic, not a reason to skip verification.
Verify unexpected financial requests through a separate channel — call the person directly on a known number, or walk to their office. Never authorise transfers based solely on an email or message, even from an address you recognise.
Check exact domains, not just company names. Hover over links. Look for character substitutions, added hyphens, or additional words before the main domain.
Report phishing attempts to your organisation's security team (and to your email provider using the "Report Phishing" button). Every report improves detection for everyone in your organisation.
Keep software and browsers updated. Phishing attacks that install malware through browser exploits cannot succeed against a patched browser. This is why the vulnerabilities in the OWASP Top 10 matter for individual users too.

What to Do If You Clicked — Damage Control

If you have clicked a phishing link, entered credentials, or opened a malicious attachment — act immediately. Time is the critical factor. Here is the priority order:

If you entered credentials: Change that password immediately on the actual legitimate website (type the URL directly — do not use any link). Change it on every other site where you used the same or similar password. Enable MFA if not already active. If it was a banking or financial password, call your bank directly.
If you opened an attachment or installed something: Disconnect the device from the network (unplug ethernet, disable WiFi, disable Bluetooth). Run a full scan with up-to-date endpoint security software. Contact your IT team if this is a work device. The device may need to be rebuilt from scratch.
If you authorised a financial transfer: Call your bank immediately. Financial institutions can sometimes reverse wire transfers if contacted within hours. There is a narrow window before funds are moved beyond recovery. Report to your national fraud reporting service (Cyber Crime Portal in India at cybercrime.gov.in, Action Fraud in the UK, IC3 in the US).
Document everything: Screenshots of the email or message, the URL you visited, what you entered. This documentation supports any fraud investigation and insurance claim.

Do not feel embarrassed about being phished: A 2024 campaign targeting a major bank's employees used LinkedIn research to craft emails so personalised and accurate that the bank's own security team members were fooled. Falling for a sophisticated phishing attempt is not a sign of carelessness — it is evidence that the attack was well-crafted. Acting quickly after the fact is what limits the damage.

About the Author

Amardeep Maroli

MCA student and cybersecurity enthusiast from Kerala, India. I focus on API security, ethical hacking, and building secure web applications. I share practical guides, real attack scenarios, and beginner-to-advanced cybersecurity content — learned through hands-on lab experience, not just theory.

Phishing FAQs

Can phishing affect me even if I'm careful?

Yes. The sophistication of modern phishing means that even security professionals are successfully targeted. The MGM Resorts breach was initiated by a vishing call so convincing it fooled IT staff who are trained to be suspicious. The Hong Kong deepfake video call fooled a finance professional despite them looking at "colleagues" they recognised. Being careful reduces your risk significantly but doesn't eliminate it entirely — which is why technical controls (MFA, unique passwords, endpoint security) matter as a safety net for when the human layer fails.

How do I know if a website is a phishing site?

Check four things: (1) The domain in the browser address bar — not just the company name but the exact domain. "paypal.com" is real. "paypal-secure.com," "paypa1.com," and "paypal.secure-login.com" are phishing sites. (2) HTTPS/padlock — the padlock means the connection is encrypted, not that the site is legitimate. Phishing sites routinely use HTTPS. (3) The page looks right but feels slightly off — URL shorteners in the address bar, unusual input fields, or requests for information the real site wouldn't ask for. (4) When in doubt, close the page, open a new tab, and type the company's URL directly rather than using any link you were sent.

What's the difference between phishing and social engineering?

Social engineering is the broad category — any technique that manipulates human psychology to extract information or access. Phishing is one delivery mechanism for social engineering, specifically using deceptive digital communication (email, SMS, voice). Other social engineering techniques include pretexting (inventing a convincing scenario — "I'm from IT"), tailgating (following someone through a secure door), baiting (leaving a malware-infected USB drive in a car park), and quid pro quo (offering something in exchange for information). Phishing is the most scalable because it can be automated and sent to millions simultaneously.

Does clicking a phishing link automatically compromise my device?

Not always — it depends on the attack type. Many phishing links simply lead to a fake login page where you would have to manually enter your credentials (credential harvesting). Simply visiting the page without entering anything may not cause harm. However, some attacks exploit browser vulnerabilities (drive-by downloads) to install malware just from visiting a page — which is why keeping your browser and OS updated is important. If you clicked a link and your browser prompted you to download or install something, or if you ran any file, treat the device as potentially compromised and disconnect from the network.

How is AI changing phishing in 2026?

In three significant ways. First, AI enables perfect, grammatically flawless phishing messages in any language, removing the traditional "spelling and grammar mistakes" detection heuristic. Second, AI allows personalised spear phishing at mass scale — unique, individually crafted emails for every target in an organisation, using data scraped from public sources and breach databases. Third, and most alarmingly, AI voice cloning and video deepfakes have made voice and video impersonation accessible to criminal groups. A 3-second audio clip is sufficient to clone someone's voice with current tools. This means the "call and verify" instruction — long a reliable secondary defence against email phishing — is now itself being undermined. Organisations need to establish out-of-band verification methods (code words, pre-arranged signals) for high-value requests.

Search This Blog

TechWithAmardeep