Phishing: How to Recognize and Avoid Attacks

Octo fishing with a line in his own aquarium

In 2024, Kaspersky's solutions blocked more than 893 million phishing attempts - nearly 2.4 million per day - and the Anti-Phishing Working Group recorded close to one million in the fourth quarter alone. Behind these numbers lies the same manipulation mechanism, one that anyone can learn to defeat.

What is phishing?

Phishing is a fraud technique that involves impersonating a trusted organization - a bank, delivery service, or government agency - to steal personal information or login credentials. Its effectiveness rests on a single lever: the appearance of legitimacy.

A phishing message reproduces the logos, colors, and tone of an official communication. Users rely on this visual appearance to judge whether a message is trustworthy, and that habit is exactly what attackers exploit. Whether delivered via email or a fake website, the mechanics are the same: create a convincing appearance to trigger a thoughtless action.

What are the signs of a phishing email?

A phishing email almost always combines the same signals: an urgent pretext, a sender impersonating a well-known brand, a link to a site where you're asked to enter your credentials, and a request for information that a legitimate service would never ask for this way. Spotting them comes down to a few key habits.

An urgent pretext: "suspicious activity on your account," "package on hold," "payment declined." The goal is to make you act before you think.
A sender impersonating a brand: the display name looks legitimate, but the actual sending address doesn't match the official domain.
A link or button to click: it leads to a fake site, visually identical to the real one, where you're asked for your credentials.
A request for sensitive information: password, card number, security code. A reputable service will never ask for these by email.

None of these signs is proof on its own, but when they appear together, suspicion is warranted. The common thread across all such messages is pressure: they aim to trigger an emotional reaction rather than calm analysis.

How do you spot a fake URL?

The most reliable way to identify a phishing site is to read the URL carefully - specifically the domain name. The real domain is what appears just before the first slash, and everything to its left can be fabricated by the attacker.

Using example.com as the legitimate domain:

Subdomain abuse: example.another-dangerous-site.cam. Here, the real domain is another-dangerous-site.cam, not example.
Deceptive hyphen: example-secure-login.cam. A completely different domain that contains the brand name.
Different extension: example.site instead of example.com.
Typosquatting: examplle.com - a doubled letter that's easy to miss when reading quickly.

The rule to remember: the real domain is the word right before the extension (.com, .org, .net). Anything separated by an additional dot to the left is a subdomain that anyone can create.

How can you verify that an email is authentic?

You can't rely on appearance alone. Technical mechanisms like SPF and DKIM verify that an email was sent from a server authorized for the displayed domain, but they prove the technical origin of the message - not the honesty of its sender.

SPF (Sender Policy Framework) lists the servers authorized to send email for a domain. DKIM (DomainKeys Identified Mail) adds a cryptographic signature that the recipient can verify. This information appears in the technical headers of the message.

These mechanisms have an important limitation, however. An attacker can configure a perfectly valid SPF and DKIM on a domain they own, such as support-security-amazon.com. The result is technically clean but humanly deceptive: the check proves that the domain sent the message, not that it belongs to the brand it's impersonating.

I clicked on a phishing link - what should I do?

Clicking a link is generally not enough to compromise an account: the danger lies in what you do next. If you didn't enter anything or download anything, simply close the page. If you entered a password, change it immediately.

Don't enter any information on the opened page, and close it.
If you already entered a password, change it immediately on the real service by typing its official address yourself, rather than going back through the link you received.
Change that password everywhere you reused it. This is why using a unique password per site significantly limits the damage.
Enable two-factor authentication on the account if you haven't already.
In the days that follow, monitor for login attempts and changes you didn't request.

If you shared a credit card number, contact your bank to cancel the card. Acting quickly significantly reduces the consequences of a mistaken click.

How do you know if you've been phished?

Several signs indicate that a phishing attack succeeded: a familiar password that no longer works, password reset emails you didn't request, messages sent in your name, or a login alert from an unfamiliar location. At the slightest doubt, it's best to react as if the account has been compromised.

You can no longer log in with your usual password.
You receive change confirmations (password, recovery address, phone number) that you didn't initiate.
Your contacts are receiving messages or emails you didn't send.
The service reports a login from a device or country you don't recognize.

In that case, change the affected password from a trusted device, check the list of connected devices in your account settings, and revoke any sessions you don't recognize.

How does a password manager protect against phishing?

A password manager compares the actual URL of a site against the one stored for each set of credentials. If the domain doesn't match exactly, it won't offer to fill in the fields. This is passive protection that requires no particular effort from the user.

Where the human eye might confuse example.com with examplle.com, the password manager performs a strict, character-by-character comparison, immune to visual domain-masking tricks. This automatic check acts as a daily safety net: if the manager doesn't offer your credentials on a site you're supposed to know, that's an immediate red flag.

Is 2FA enough against phishing?

No - not against real-time attacks. Two-factor authentication (2FA) is a genuine security improvement, but in an AiTM (Adversary-in-the-Middle) scenario, the attacker intercepts and relays each step of the login process, including the one-time code.

Here's how it works: the victim enters their credentials on the fake site. That site immediately forwards them to the real site, which sends a 2FA code. The victim enters that code on the fake site, which relays it in turn. The attacker ends up logged in with a valid code, before it even expires.

Diagram of an AiTM attack: the victim, the attacker's proxy, and the legitimate server exchange data in real time, leading to session cookie theft — The attacker's proxy relays each step in real time, including the 2FA code, then captures the session cookie.

2FA remains effective against delayed attacks: a stolen password database becomes useless if 2FA is active. But against a real-time relay, a one-time code is no longer enough.

Do passkeys protect against phishing?

Yes. A passkey is cryptographically bound to the exact domain for which it was created. On a rogue site - even one that looks visually identical - it simply doesn't activate, because there is no shared secret to enter or intercept.

Authentication relies on a cryptographic exchange between the user's device and the legitimate server: nothing to replay, nothing to steal. Even a real-time AiTM relay cannot bypass this protection. Passkeys are the structural answer to phishing, eliminating the weak link represented by a secret that a user can unknowingly hand over.

Key takeaways

Phishing relies on the appearance of legitimacy and a sense of urgency: slowing down before you click is the first reflex to develop.
The URL is the most reliable indicator: learn to read the actual domain name before entering anything.
If you entered a password on a fake site, change it immediately on the real service - and everywhere else you reused it.
A password manager checks the URL on your behalf and won't be fooled by a fake domain.
2FA protects against delayed attacks, but not against real-time phishing.
Passkeys are the only structural protection that makes phishing technically ineffective.

Beyond good individual habits, protecting your data also depends on the platform you choose. Discover our approach to security and data sovereignty.