{"id":79084,"date":"2024-03-21T19:48:03","date_gmt":"2024-03-21T19:48:03","guid":{"rendered":"https:\/\/mailrelay.com\/glosario\/phishing\/"},"modified":"2026-10-07T10:44:04","modified_gmt":"2026-10-07T10:44:04","slug":"phishing","status":"publish","type":"glossary","link":"https:\/\/mailrelay.com\/en\/glossary\/phishing\/","title":{"rendered":"Phishing"},"content":{"rendered":"\n

Phishing is a type of fraud in which someone impersonates a trusted company or person to steal data, passwords or money.<\/strong> It usually arrives by email, but also by SMS, phone calls or social media.<\/p>\n\n

The message imitates a bank, a store, a delivery company or a coworker. Its goal is to get you to click a link, download a file or hand over your details without thinking.<\/p>\n\n

What does phishing mean?<\/h2>\n\n

The word comes from fishing<\/em>: the attacker casts the bait and waits for someone to bite. The initial \u201cph\u201d is a nod to the slang of the early hackers.<\/p>\n\n

It is also known as identity spoofing<\/strong> or online fraud<\/strong>.<\/p>\n\n

How does a phishing attack work?<\/h2>\n\n

1. The bait.<\/strong> A message arrives that looks legitimate: copied logos, tone and signature.<\/p>\n\n

2. The urgency.<\/strong> \u201cYour account will be blocked today\u201d, \u201cYour package is on hold\u201d, \u201cFinal payment notice\u201d.<\/p>\n\n

3. The action.<\/strong> You are asked to click, log in, download an attachment or reply with your details.<\/p>\n\n

4. The theft.<\/strong> The fake page captures your password or card details, or the attachment installs malware<\/a>.<\/p>\n\n

A typical example: you get an SMS from a supposed delivery company. It says your package is on hold and that you need to pay \u20ac1.99 in customs fees. The link leads to a website identical to the real one that asks for your card details.<\/p>\n\n

Types of phishing<\/h2>\n\n
Type<\/th>Channel<\/th>Description<\/th><\/tr><\/thead>
Email phishing<\/td>Email<\/td>Mass messages that imitate a well-known brand<\/td><\/tr>
Spear phishing<\/td>Email<\/td>A targeted attack on a specific person, using real information about them<\/td><\/tr>
Whaling<\/td>Email<\/td>Spear phishing aimed at executives or staff with access to payments<\/td><\/tr>
Smishing<\/td>SMS<\/td>Text messages with fake links, for example about a delivery<\/td><\/tr>
Vishing<\/td>Phone<\/td>Calls from people posing as the bank or technical support<\/td><\/tr>
Social media phishing<\/td>Social media and messaging apps<\/td>Fake profiles or stolen accounts that send malicious links<\/td><\/tr>
Fake website (pharming)<\/td>Browser<\/td>Copies of real websites that collect your login details<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Spear phishing<\/strong> is the most dangerous type for businesses: the attacker researches the victim and personalizes the message, sometimes impersonating a supplier or the CEO themselves.<\/p>\n\n

\"Infographic<\/figure>\n\n

How to spot a phishing email<\/h2>\n\n

Check the real sender.<\/strong> Not just the name: the full address. A lookalike domain (with swapped or added letters) is a clear warning sign.<\/p>\n\n

Be wary of urgency.<\/strong> Legitimate companies rarely demand that you act \u201cwithin the next few hours\u201d.<\/p>\n\n

Hover over the links.<\/strong> Before clicking, check where they actually lead.<\/p>\n\n

Check the attachments.<\/strong> Invoices or documents you weren’t expecting, especially compressed files or files with macros.<\/p>\n\n

Look at the greeting and the mistakes.<\/strong> A generic \u201cDear customer\u201d or spelling errors are common.<\/p>\n\n

No legitimate sender will ask for your password by email.<\/strong> Not your bank, not any reputable service.<\/p>\n\n

\n

Make sure your subscribers recognize your emails<\/strong><\/p>\n\n\n\n

Set up SPF and DKIM in Mailrelay and always send from a verified sender.<\/p>\n\n\n\n

\n
Create a free account<\/a><\/div>\n<\/div>\n<\/div><\/div>\n\n

What to do if you’ve fallen for it<\/h2>\n\n

Change the password<\/strong> of the affected account and of any other account where you use it.<\/p>\n\n

Turn on two-step verification.<\/strong> A one-time code (OTP<\/a>) blocks many break-ins even if attackers have your password.<\/p>\n\n

Notify your bank<\/strong> if you gave out payment details, so they can block the card.<\/p>\n\n

Get help.<\/strong> In Spain, INCIBE offers free help on 017.<\/p>\n\n

Report it.<\/strong> To the police or the Guardia Civil, with screenshots of the message.<\/p>\n\n

Phishing and email marketing: how to protect your brand<\/h2>\n\n

If you have a subscriber list, attackers can use your name to deceive them. This is known as spoofing<\/a>. To prevent it:<\/p>\n\n

Authenticate your domain.<\/strong> Set up SPF<\/a>, DKIM<\/a> and DMARC<\/a> so no one can send emails on your behalf without being detected.<\/p>\n\n

Always send from the same sender.<\/strong> Your subscribers will spot a strange message more quickly.<\/p>\n\n

Don’t ask for sensitive data by email.<\/strong> And say so in your communications: \u201cWe will never ask for your password\u201d.<\/p>\n\n

Use links to your own domain.<\/strong> Avoid URL shorteners that hide the destination.<\/p>\n\n

Also, an email that looks like phishing ends up in spam<\/a>. Good design and a clear sender also protect your deliverability.<\/p>\n\n

\"Infographic<\/figure>\n\n

Common mistakes<\/h2>\n\n

Thinking it only affects large companies.<\/strong> Small businesses are a frequent target because they tend to have less protection.<\/p>\n\n

Trusting the browser padlock.<\/strong> Many fake websites also use HTTPS.<\/p>\n\n

Not training your team.<\/strong> Most attacks get in through someone’s click, not a technical flaw.<\/p>\n\n

Reusing passwords.<\/strong> If one leaks, the attacker tries it on all your other accounts.<\/p>\n\n

Replying to check.<\/strong> Answering the message confirms that your address is active.<\/p>\n\n

How Mailrelay helps you<\/h2>\n\n

Mailrelay helps you set up SPF and DKIM on your sending domain and keep a consistent sender, so your subscribers can tell your emails apart from fake ones. The statistics alert you to bounces and complaints that could point to a problem.<\/p>\n\n

The free account includes up to 80,000 emails a month and 20,000 contacts, with human support by chat, ticket and phone.<\/p>\n\n

\n

Send your newsletters with Mailrelay<\/strong><\/p>\n\n\n\n

Up to 80,000 emails a month and 20,000 contacts for free, with human support on every plan.<\/p>\n\n\n\n

\n
Try Mailrelay for free<\/a><\/div>\n<\/div>\n<\/div><\/div>\n\n

Frequently Asked Questions<\/h2>\n\n

These are the most common questions about phishing.<\/p>\n\n

What is phishing in a nutshell?<\/h3>\n\n

A scam in which someone impersonates a trusted company or person to steal your data or money.<\/p>\n\n

What’s the difference between phishing and spam?<\/h3>\n\n

Spam is unwanted advertising. Phishing is fraud that aims to steal something from you.<\/p>\n\n

What is smishing?<\/h3>\n\n

Phishing by SMS: text messages with fake links, for example about a package or from your bank.<\/p>\n\n

What is spear phishing?<\/h3>\n\n

An attack targeted at a specific person, using real information about them to be more convincing.<\/p>\n\n

Where do I report a phishing attempt?<\/h3>\n\n

In Spain, to INCIBE (phone 017) and to the police or the Guardia Civil. You can also forward it to the company being impersonated.<\/p>\n\n

Related terms<\/h2>\n\n