What Is Phishing - Tactics, How to Spot It, and Countermeasures

What Phishing Is

Phishing is a cyberattack in which the attacker impersonates a trusted organization or individual to trick you into handing over passwords, credit card numbers, or personal information. The word is a respelling of "fishing" with f replaced by ph, from the same tradition of wordplay as "phreaking", the abuse of telephone networks.

In "10 Major Security Threats 2026", published in January 2026 by Japan's IPA (Information-technology Promotion Agency), "theft of personal information through phishing" is listed among the threats facing individuals. Phishing is not a technically advanced attack; it is a form of social engineering that exploits gaps in human judgment.

Common Tactics

Email phishing: A message disguised as one from a bank or service provider leads you to a fake site. Wording that manufactures urgency, such as "your account will be suspended" or "we detected unauthorized access", is characteristic.
Smishing (SMS phishing): Carried out over SMS. Notices posing as a missed parcel delivery or an unpaid bill are the typical examples.
Spear phishing: A targeted attack aimed at a specific person or organization, using information gathered beforehand to make the message credible. "Whaling", aimed at company executives, is one variety.
Clone phishing: The attacker copies a legitimate message you received earlier and swaps only the link for one pointing at a fake site. A recipient who remembers the original message is unlikely to suspect it.

Checking the mail headers is an effective defense. See whether the sender domain recorded in the Return-Path and Received headers matches the displayed sender. If the sender reads "support@amazon.co.jp" but the Return-Path reads "noreply@xyz-random.com", the message is very likely phishing.

How to Spot a Fake Site

Checking the following points improves your chances of recognizing a phishing site.

Read the URL: Watch for domains one character away from the real one (for example amaz0n.com) and for fake domains that carry the real name in a subdomain (for example amazon.security-check.com).
Do not judge by HTTPS alone: Many phishing sites also obtain a TLS/SSL certificate, so a padlock icon by itself does not mean the site is safe.
Do not click links in email directly: Make it a habit to reach the official site from a browser bookmark or a search engine.
Unnatural language: Check for phrasing typical of machine translation, mismatched fonts, and odd punctuation.

It also helps to know the typical shape of a phishing URL. A frequent trick is to place the legitimate domain in a subdomain or a path so that it looks genuine, as in https://amazon.co.jp.account-verify.com/login. Read the URL in the address bar from the right-hand end. The top-level domain at the end (.com or .jp) plus the label one step to its left is the part that identifies the registrant, so the destination in this example is account-verify.com. When the suffix has two levels, such as co.jp or ne.jp, read one more label to the left (for amazon.co.jp, the registrant is amazon). Because each registry decides how far its own suffix extends, browsers determine the boundary using a list called the Public Suffix List. Every label further to the left is a subdomain, which the owner of the domain can add freely. Note also that if a URL contains @ between :// and the next /, the host name is whatever follows the @ (https://amazon.co.jp@example.com/ connects to example.com).

What to Do If You Are Caught

If you have entered information on a phishing site, take the following steps without delay.

Change the password for that service immediately
Change it on every other service where you reused the same password
If you entered credit card details, contact the card issuer and ask them to suspend the card
Enable two-factor authentication
Report the site to the Council of Anti-Phishing Japan (https://www.antiphishing.jp/)

To keep the damage from spreading, follow-up action matching what you typed in also matters. If you entered an email address and password, the attacker may attempt credential stuffing to log in to other services. Use your password manager to list every service that shares that password, and change them all.

Phishing Techniques That Spread in the 2020s

During the 2020s, tactics spread that the old habit of "watching out for suspicious email" is not enough to stop.

QR code phishing (quishing) uses a QR code embedded in an email or a printed document to lead the victim to a fake site. Because a QR code gives no visual view of the URL, scanning it with a smartphone already opens the fake site. Physical attacks in which a fake QR code is pasted over the payment code in a car park have also been reported.

Phishing that abuses generative AI uses large language models to mass-produce phishing email in fluent language. The clumsy wording and grammatical errors that used to mark phishing email are gone, and the quality is indistinguishable from genuine business email. Cases have also been observed in which a target's social media posts and public information are analyzed by a model to auto-generate spear phishing email tailored to that individual.

Vishing (voice phishing) is carried out over the telephone. The caller claims to be from a bank or card issuer, says "we have detected fraudulent use", and extracts the card number and PIN. Because the caller ID can be spoofed to display a legitimate telephone number, the incoming call screen alone tells you nothing.

Adversary-in-the-middle phishing (AiTM) is an advanced tactic in which the attacker places a reverse proxy between the user and the genuine site and steals credentials and the session cookie in real time. The user believes they have logged in to the genuine site, but the attacker holds the session cookie, so the forms of two-factor authentication that rely on entering a one-time password are defeated. What does work as a countermeasure is a passkey (FIDO2). The key is tied to the domain of the genuine site, so no signature is produced on a look-alike domain and the authentication cannot be completed even through a reverse proxy.

Common Misconceptions

You can tell a phishing email at a glance: Phishing email is highly polished, and much of it is almost indistinguishable from genuine mail. Spear phishing in particular uses the names of real business partners or colleagues, so even security professionals are sometimes fooled.
HTTPS (the padlock icon) means the site is safe: With the spread of free SSL certificates from providers such as Let's Encrypt, most phishing sites serve HTTPS. The padlock only indicates that the connection is encrypted; it is no guarantee that the site is legitimate.

Phishing