Phishing Explained Without the Jargon

Most successful attacks do not begin with brilliant code. They begin with a message that someone believed.

That message is phishing: a communication — usually email, increasingly text or chat — that impersonates someone trusted in order to make you click, pay, or hand over a password. I gave the two-sentence definition in my policymaker's glossary. This piece is the full lesson, in the style I committed to in Teaching Cybersecurity to People Who Will Never Write Code: one concept per block, and no blaming the reader.

That last point first, because it shapes everything else.

Phishing is not a stupidity test

I have watched intelligent, careful people fall for phishing — during my sysadmin years in Kuala Lumpur supporting hundreds of end users, and later in a telecom security operations centre where phishing-driven incidents were routine. The victims were not careless. They were busy, and the message was designed by someone who understood busy people.

Phishing works because it is engineered against human psychology, not against human intelligence. Blaming the clicker is like blaming a driver for a road designed to cause crashes.

The psychology: three levers

Nearly every phishing message pulls at least one of three levers.

Urgency. "Your account will be closed today." Urgency exists to switch off deliberate thinking. A person deciding in ten seconds uses reflexes; a person deciding in ten minutes uses judgement. The attacker wants the ten-second version of you.

Authority. The message appears to come from your bank, your boss, the tax office. We are trained from childhood to respond to authority quickly and to feel that questioning it is risky. Attackers rent that training for free.

Familiarity. The logo is right. The tone is right. The signature matches the real person's. Familiarity lowers our guard because in ordinary life, familiarity is an excellent security signal. Online, it is cheap to fake.

The technique: three fakes

Behind the psychology sit three simple technical tricks. None requires genius.

ANATOMY OF A PHISH — THREE FAKES

   +--------------+     +--------------+     +------------------+
   | FAKE SENDER  | --> | FAKE REASON  | --> | FAKE DESTINATION |
   | trusted face |     | urgency/fear |     | a page that      |
   |              |     | authority    |     | harvests you     |
   +--------------+     +--------------+     +------------------+
        who                   why                    where

The faked sender. Email was designed in a trusting era; the "From" line is closer to the return address handwritten on an envelope than to a passport. It can often be forged outright, or approximated: finance@yourcompany.co instead of .com.

The lookalike link. The text of a link and its true destination are two different things, like a signpost that reads "Bank" but points down an alley. Hovering over a link (or long-pressing on a phone) reveals the real destination — one of the few universally useful defensive habits.

The counterfeit page. The destination looks exactly like your bank's login page, because copying a page's appearance takes minutes. You type your username and password; the page quietly delivers them to the attacker, then often forwards you to the real site so nothing seems wrong.

An analogy, with its honest limit: phishing is a con artist in a convincing uniform. The limit is scale. A con artist works one victim at a time; a phishing campaign knocks on fifty thousand doors at once and needs only a handful to open. Defences that assume rare, targeted deception underestimate the arithmetic.

A realistic walkthrough (hypothetical)

The following scenario is invented, but it is assembled from patterns I saw repeatedly in real incident queues.

Miriam runs finance at a thirty-person import business. On a hectic afternoon, she receives an email that appears to come from the company's managing director, who is travelling: "Our supplier changed banks. Please pay the attached invoice today so the shipment isn't held at port. I'm boarding now, can't take calls."

Look at the engineering. Urgency: the shipment and the deadline. Authority: the director. Familiarity: the writing style is close, because the attacker read the company's website and the director's public posts. And one more piece — the pre-empted verification: I can't take calls exists precisely to block the phone check that would kill the scam.

There is no malware here. No attachment does anything sinister. The entire attack is a story plus a bank account number. If Miriam pays, the company has been breached without a single system being touched.

The defence is equally non-technical: a standing rule that no payment details ever change on the strength of a message alone, verified through a second channel — a known phone number, never a number from the suspicious message itself. Miriam does not need to detect the fake. She needs a rule that works even when the fake is perfect.

Checklist for individuals

• ☐ Treat urgency itself as a warning sign. Real institutions rarely demand action in minutes.
• ☐ Check links before clicking: hover on a computer, long-press on a phone.
• ☐ Never enter a password on a page you reached from a message. Go to the site yourself, by typing the address or using your bookmark.
• ☐ Verify money and password requests through a second channel you already trust.
• ☐ Turn on two-step login (a code or prompt in addition to your password) everywhere it is offered — it often saves you even after a password is stolen.
• ☐ If you clicked, say so immediately. Speed of reporting matters far more than the embarrassment.

Checklist for small-organisation leaders

• ☐ Write the two-channel rule for payments and account changes, and apply it to everyone — especially yourself.
• ☐ Make reporting a suspected click blame-free and fast. A punished reporter is your last reporter.
• ☐ Enable two-step login on email first; a taken-over mailbox is the seed of most deeper fraud.
• ☐ Ask your IT provider to turn on the email settings that make forging your own domain harder — the request is reasonable and they will know what you mean.
• ☐ Run occasional walkthroughs of scenarios like Miriam's in team meetings. Ten minutes of story beats an hour of policy.
• ☐ Assume someone will eventually click, and decide in advance what happens next.

The one idea to keep

Phishing succeeds by manufacturing trust faster than you can verify it. So do not compete on detection — compete on process. Rules that survive a perfect fake protect you better than instincts that must spot an imperfect one. Later in this series I will apply the same logic to a fashionable phrase executives keep hearing from vendors: zero trust.

SOC Analyst Diary: What Detection Engineering Really Looks Like →

← All writeups