CYBER-09-002-P · Primer — Phishing

The idea in one sentence

Phishing is a message that impersonates someone you trust to trick you into a click, a login, or a payment.

Why it exists

Attackers learned it is far easier to fool a person than to break a firewall. Every technical control — encryption, patching, network segmentation — can be bypassed if a legitimate user simply hands over their password or approves a transfer. Think of a con artist in a delivery uniform: the uniform is not a real credential, but it borrows the trust you already extend to delivery drivers, and that borrowed trust gets them through the door. Phishing is that same trick at internet scale, sent to thousands of inboxes for the cost of one email, which is why it remains the single most common way real breaches begin.

How it works

A phishing message copies the look and voice of a trusted source — your bank, your IT department, a coworker, a well-known brand — and pairs it with a reason to act right now. First comes the lure: a subject line about a locked account, an unpaid invoice, or a package on hold. Then comes the pressure: "verify within 24 hours or lose access," designed to make you act before you think. Finally comes the hook: a link to a fake login page that looks identical to the real one, an attachment that installs malware, or a direct request to reply with data or send a payment. The fake site captures whatever you type and hands your credentials straight to the attacker, who uses them on the real site seconds later.

The one gotcha

The display name and the logo prove nothing — only the real sender address and the real link destination matter. An email can show "IT Support" or your CEO's name while coming from a lookalike domain like micros0ft-support.com, and a button labeled "Log in to your account" can point anywhere. So build three habits: check the actual sender address, not just the friendly name; hover over any link (or long-press on mobile) to see where it truly goes before you click; and never, ever enter your password on a page you reached from an emailed link — open a new tab and type the address yourself, or use a saved bookmark. When in doubt, verify through a channel you already trust, like calling the person back on a known number.

See it (visualization plan)

A CompareScene-style pair shows the trusted-looking email on the left and the hidden real sender/link on the right. A ChainScene walks the lure → pressure → hook mechanism, then a TilesScene shows the three variants (email phish, spear phishing, smishing). The gotcha lands as a LayersScene: "Display name says 'IT Support'" over "Real sender: micros0ft-support.com," followed by a CardsScene of the three defensive moves.

See it — A simple flow showing phishing steps.

flowchart LR
A["Phishing"] --> B["Lure<br/>Fake email"] --> C["Pressure<br/>Urgent"] --> D["User clicks<br/>link"] --> E["Compromise<br/>Creds"]

The one-line takeaway

Trust the real sender and the real link, never the display name.

Where you'll meet it

You will meet phishing in your own inbox and text messages every week, and inside every corporate security-awareness program that runs simulated phishing tests. It is catalogued as MITRE ATT&CK technique T1566, and CISA publishes ongoing guidance because credential-harvesting phishing is the leading entry point for ransomware and business email compromise. The same instincts protect you across email, SMS, Slack, and voice calls — anywhere a message can pretend to be someone it is not.

Named concepts: phishing, email security