What the main types of phishing attacks have in common
The main types of phishing attacks include mass email phishing, spear phishing, smishing, vishing, clone phishing, fake login pages, business impersonation, and prize or refund scams. Each version uses a different delivery method, but the goal is usually the same: steal passwords, money, identity details, or account access.
Phishing works because the message feels familiar at the exact moment it asks you to hurry. A bank warning, delivery notice, tax message, job offer, or account alert can push you to click before checking who actually sent it.
The safest habit is simple: treat every unexpected link, attachment, code request, or payment instruction as unverified until you confirm it through a separate channel.
Mass email phishing
Mass phishing is the broadest version. The scammer sends the same message to many people and waits for a small percentage to click. The email may claim your password expired, your payment failed, your package is delayed, or your account will be closed.
These emails often imitate a familiar company but use a sender address that is slightly wrong. A domain may add a letter, swap a character, or hide behind a long string of subdomains. Do not click the button to “fix” the issue. Open the company’s site yourself or use the official app.
If you receive a suspicious email, the FTC’s scam guidance at consumer.ftc.gov/scams is a reliable place to compare common patterns before acting.
Spear phishing explained
Spear phishing explained plainly: it is a targeted phishing attempt built around details about you, your job, your family, your school, or your business. Instead of a generic “Dear customer,” the message may mention your role, boss, recent purchase, or a real project.
That personalization makes it more dangerous. A fake invoice sent to an accounting employee looks different from a random prize email. A message that names your manager and asks for a wire transfer can feel routine if it arrives during a busy workday.
Slow the request down. Verify through a known phone number, internal chat, or face-to-face confirmation. Do not reply directly to the suspicious thread, because the attacker may control the conversation.
Smishing and vishing
Some types of phishing scams do not arrive by email at all. Smishing uses SMS or messaging apps. Vishing uses phone calls or voicemail. Both rely on speed, fear, or curiosity.
A smishing text might say a toll bill is overdue, a bank card is locked, or a delivery needs address confirmation. A vishing call might claim to be fraud support, tech support, a government office, or a debt collector. The delivery method changes; the pressure remains.
If a message includes a phone number, use a reverse phone lookup only as a clue. Caller ID can be spoofed, and a scammer may display a number that belongs to an innocent person or a real organization.
Common phishing types compared
| Attack Type | How It Arrives | What It Wants | Safer Response |
|---|---|---|---|
| Mass phishing | Generic email blast | Login credentials or payment details | Visit the official site manually. |
| Spear phishing | Personalized email or message | Access, money, internal data | Confirm through a separate trusted channel. |
| Smishing | Text message | Link clicks, account codes, payment | Do not use the link; check the account directly. |
| Vishing | Phone call or voicemail | Codes, card numbers, remote access | Hang up and call the published number. |
| Clone phishing | Copied legitimate-looking email | Attachment opens or credential entry | Compare sender, timing, and file details. |
| Fake login page | Link from email, text, or ad | Username, password, MFA code | Use bookmarks or the official app. |
Fake login pages and clone messages
Fake login pages are built to look ordinary. The page may copy a brand’s logo, colors, and layout, then ask for your username, password, and one-time code. If you enter them, the attacker may try to sign in immediately.
Clone phishing is similar but starts from a message that looks like a real email you might have received before. The attacker copies the style, replaces an attachment or link, and sends it again as if it were a routine update.
Look at the destination before entering anything. If the domain is strange, shortened, misspelled, or unrelated to the company, close the page. If you already entered credentials, change the password from a clean browser session and review account recovery settings.
How to check domains and links safely
Phishing links often hide behind urgency, but the domain still matters. Look for the real company name immediately before the top-level ending, such as .com, .org, or .gov. Extra words after the brand can be suspicious when they change the actual domain owner.
Do not trust a link just because the visible text looks normal. A button can say “View invoice” while pointing somewhere unrelated. On a desktop, hover without clicking to preview the destination. On a phone, use caution with long-press previews because a slip can open the link.
Short links are harder to judge. If the message is unexpected and the sender is asking for account access, payment, or identity details, skip the short link entirely. Go through the official app, a saved bookmark, or a phone number from a statement or card you already trust.
For shared family or workplace devices, tell others not to use the suspicious message either. One click from another account can restart the same problem.
Attachments, QR codes, and shared files
Not every phishing attempt uses a blue link. Some arrive as invoices, shipping labels, voicemail files, shared documents, calendar invites, or QR codes taped to a parking meter or sent in a message. The format changes, but the request still asks you to trust the source quickly.
Attachments can carry malware or send you to a credential page. Shared files can ask you to sign in before viewing. QR codes can move the risky link from your computer to your phone, where the address bar is smaller and harder to inspect.
If a file was expected, verify it with the sender through a known channel. If it was not expected, do not open it out of curiosity. Curiosity is one of the main tools the attacker is counting on.
Business, government, and tech-support impersonation
Phishing often borrows authority. A message may pretend to come from the IRS, a bank, a delivery company, a payroll provider, a marketplace, or a software vendor. The script usually says something bad will happen unless you act now.
Tech-support versions may ask you to install remote-access software or share a screen. Business versions may request gift cards, wire transfers, payroll changes, or new bank details. Government versions may threaten arrest, benefits loss, or penalties.
The FBI’s Internet Crime Complaint Center at IC3.gov is a reporting path for many internet-enabled scams. The BBB’s Scam Tracker can also help consumers review and report suspicious business-style scams.
How to investigate a suspicious message
Do not start by clicking. Start by preserving what you have: sender address, phone number, subject line, message text, time received, and any link destination you can view without opening it. Screenshots help if you need to report the incident.
Copy a distinctive sentence from the message and search it in quotes. Widespread scams often reuse wording. If the message names a person, business, or username, a people search may help you compare public identity clues, but do not assume a public match proves the message is safe.
For a suspicious attachment, do not open it to “see what it is.” Ask the supposed sender through a trusted channel. If the message claims to be from a company, log in through the official site or app instead of the email link.
What to do if you clicked
Act quickly, but do not panic. Disconnect from the page, change the affected password from a trusted device, and enable multifactor authentication if it is not already on. If you entered a payment card, contact the issuer. If you shared identity details, watch for account changes and consider identity-theft recovery steps.
Change reused passwords anywhere else they appear. Attackers often try the same email and password combination on banking, shopping, email, and social accounts. Review forwarding rules, recovery email addresses, saved devices, and recent login history, because account access can persist after the visible password is changed.
If the scam involved money, account takeover, or stolen personal information, report it through the appropriate channel. Keep copies of messages, receipts, wallet addresses, phone numbers, and account alerts. Those details matter more than a long explanation.
Tell your workplace or school security team if the message involved organizational accounts. One person clicking may expose shared systems, vendor portals, or contact lists.
Frequently Asked Questions
What type of attack is a phishing attack?
Phishing is a social-engineering attack. The attacker tricks a person into doing something unsafe, such as clicking a malicious link, entering credentials, opening an attachment, sending money, or sharing a one-time code. The technical delivery can vary, but the manipulation is the core tactic.
What are different types of phishing attacks?
Different types include mass email phishing, spear phishing, smishing, vishing, clone phishing, fake login pages, business email compromise, tech-support impersonation, and prize or refund scams. The names describe either the delivery channel, the target, or the specific trick used to steal information.
Which type of phishing attack comes via SMS?
Phishing that comes through SMS is called smishing. The text may claim a package is delayed, a bank card is locked, a toll is unpaid, or a prize is waiting. Do not tap the link; open the official app or website yourself to check the claim.
How many types of phishing attacks are there?
There is no fixed number because attackers keep changing delivery methods and scripts. The most useful categories are mass phishing, spear phishing, smishing, vishing, clone phishing, fake login pages, and impersonation scams. Focus on the request, not just the label.
