What Is Phishing, and How Do You Actually Spot It?

Short answer: Phishing is a fake email or message made to look like it's from someone you trust, pushing you to click a link and log in on a copycat page so your password gets stolen. Spot it by hovering over any link and checking where it actually leads before you click.

Phishing isn't a technically sophisticated attack. It doesn't break into anything — it just asks, convincingly enough, and waits for someone to hand over the keys. That's what makes it the most common way a small business actually gets hit: it doesn't require a hacker to find a flaw in your software, just one tired, busy moment where an email looks close enough to real.

What's actually happening

A phishing email is built to look like it came from someone you'd trust without a second thought — your bank, a vendor you actually use, Google, your web host, even a coworker. It usually does two things at once: creates a reason to act right now (an account will be suspended, an invoice is overdue, a password needs resetting), and gives you a link to click to fix it.

The link is the actual attack. It doesn't lead to the real site — it leads to a look-alike, a page built to copy the real login screen almost exactly, sitting on a domain that's close to the real one but not quite it (yourbnk-secure.com instead of yourbank.com, for example). Whatever you type in — your password, sometimes a two-factor code right after — goes straight to whoever built the fake page, not to the company it's impersonating.

A local business scenario

(A composite, illustrative pattern — not one specific business's story.)

A shop owner gets an email that looks exactly like it's from their point-of-sale software provider: "Your account will be suspended in 24 hours — verify your billing details to keep accepting payments." The logo is right, the layout is right, even the tone matches every other email that company has actually sent. It arrives Friday afternoon, right when a suspended payment system would be genuinely disastrous for the weekend rush.

The owner clicks through, lands on a login page that looks identical to the real one, and types in their username and password to "verify" the account. Nothing visibly breaks. The page even redirects to a normal-looking confirmation message. It isn't until Monday — when a real login attempt gets flagged, or a customer mentions a strange charge — that anything looks wrong at all. By then, whoever received those credentials has had an entire weekend with them.

Why it works on careful people

Phishing doesn't succeed by fooling people who are being careless — it succeeds by targeting the moment right before anyone would normally be careful. Three things do most of the work:

• Urgency — a deadline measured in hours removes the instinct to slow down and check.
• Authority — it appears to come from someone you're already used to trusting, so the message starts with the benefit of the doubt.
• Familiarity — a copied logo and a matching tone make "this looks right" stand in for "this is verified," when those aren't the same thing at all.

The one habit that catches almost all of it

Before clicking any link in an email asking you to log in, verify, or act urgently: hover over it first (on a phone, press and hold) and look at where it actually goes — not the text that's displayed, the real destination underneath. A mismatched or unfamiliar domain is the single clearest tell there is, and it takes about two seconds to check.

Best practices

1. Hover before you click. Check the real destination of a link, not just the text or button label — this alone catches most phishing attempts.
2. Check the sender's actual email address, not just the display name. "Your Bank Support" can be typed by anyone; the address after the @ can't be faked as easily.
3. Never act on urgency from inside the message. If it claims to be your bank, vendor, or a coworker asking for something time-sensitive, verify through a channel you already know — a phone number from a past bill, not one in the email — before doing anything.
4. Turn on multi-factor authentication everywhere it's offered. It won't stop a phishing email from arriving, but it stops a stolen password from being enough on its own.
5. When in doubt, don't click. Delete it, or report it if your email provider offers a "report phishing" option — there's no downside to being wrong about a real email; there's a real one to being wrong about a fake one.

Helpful, free resources

• Google's Phishing Quiz — eight real examples pulled from actual phishing attempts. Test whether you'd actually catch the mismatch described above.

A note on what this is and isn't: this post is general security education, not a personalized risk assessment of your specific business or systems. If you want a free, automated starting point for your own site, we offer a Security Health Check — free for any business, no obligation.