Phishing Attacks Explained: How Hackers Trick People Online
Student Vocation Cybersecurity Learning Series — Lesson 6 of 30
Imagine receiving an email that appears to come from your bank.
The message says:
“Your account has been temporarily restricted. Verify your information immediately to restore access.”
The email includes a button that says Verify Account.
You become worried and consider clicking it.
But what if the email is not from your bank at all?
What if someone is pretending to be the bank to steal your login information?
This is an example of a phishing attack.
Phishing is one of the most important online threats to understand because it targets something every internet user depends on: trust.
In this lesson, you will discover what phishing means, how attackers deceive people, common phishing methods, how to recognize suspicious messages, and practical ways to protect yourself.
You will also complete a safe exercise using fictional messages.
-
What Is Phishing?
Phishing is a form of cyberattack in which an attacker uses deceptive communication to trick someone into revealing sensitive information, visiting a fraudulent website, downloading malicious software, or taking another harmful action.
Phishing commonly occurs through email, but it can also happen through text messages, social media, messaging applications, and phone calls.
Attackers may impersonate trusted organizations such as:
- Banks and financial institutions.
- Schools and universities.
- Online shopping platforms.
- Government agencies.
- Delivery companies.
- Social media services.
- Employers and colleagues.
The attacker wants the recipient to believe that the message comes from a legitimate source.
Beginner-friendly example
A student receives a message claiming to be from the school’s examination office:
“Your examination registration is incomplete. Sign in immediately to prevent cancellation.”
The message directs the student to a fake website requesting their school account password.
If the student enters their password, the attacker may gain access to the account.
The important point is that the message uses deception to influence the student’s decision.
-
How Do Phishing Attacks Work?
Although phishing attacks vary, many follow a recognizable pattern.
Stage 1: Impersonation
The attacker pretends to represent a trusted organization or person.
For example, a message might appear to come from a bank, school administrator, or delivery company.
Stage 2: Creating a reason to act
The message introduces a problem, opportunity, or urgent request.
Examples include:
- “Your account will be suspended.”
- “You have won a scholarship.”
- “A package could not be delivered.”
- “Your payment failed.”
- “Your examination results are ready.”
These claims may be designed to create fear, curiosity, excitement, or urgency.
Stage 3: Requesting an action
The recipient is encouraged to click a link, open an attachment, provide information, send money, or approve an unexpected login request.
Stage 4: Potential compromise
If the recipient follows the fraudulent instructions, the attacker may obtain credentials, financial information, or access to an account.
Some phishing attempts also lead to malware infections, connecting directly to what we learned in Lesson 5.
Not every phishing attempt succeeds. Recognizing suspicious requests and verifying them independently can interrupt the attack.
-
What Is Social Engineering?
Social engineering is the manipulation of people into performing actions or revealing information they would not otherwise provide.
Phishing is one form of social engineering.
Instead of relying entirely on a technical vulnerability, an attacker may exploit human emotions or assumptions.
Common manipulation techniques include:
Urgency: Making the recipient feel they must act immediately.
Fear: Threatening account suspension, financial loss, or disciplinary action.
Authority: Pretending to be a manager, teacher, government official, or bank representative.
Curiosity: Promising unexpected information, photographs, or results.
Reward: Offering a prize, scholarship, gift, or employment opportunity.
Example
A student receives a message announcing a fully funded international scholarship. The message demands a registration payment and personal account credentials within one hour.
The offer may be designed to exploit the student’s excitement and fear of missing an opportunity.
A legitimate scholarship opportunity should be verified through the official organization before any personal information or payment is provided.
-
Types of Phishing Attacks
Phishing has several forms. Understanding the differences helps you recognize suspicious activity across communication channels.
- Email phishing
Email phishing involves fraudulent emails that impersonate trusted organizations or individuals.
Example: An unexpected email claims that your cloud storage account will be deleted unless you sign in through a provided link.
- Spear phishing
Spear phishing targets a particular individual or organization using information that makes the message appear personally relevant.
Example: A message refers to a student’s actual department and claims that a course registration document needs urgent approval.
Personalized details do not automatically prove that a message is genuine.
- Whaling
Whaling is a form of targeted phishing aimed at senior executives or other high-profile individuals.
Example: Someone impersonates a company director to request an unauthorized financial transaction.
- Smishing
Smishing refers to phishing through SMS or similar text messaging.
Example: A text message claims that a delivery has failed and asks the recipient to visit an unfamiliar website.
- Vishing
Vishing is phishing conducted through voice communication, such as telephone calls.
Example: A caller claims to represent a bank’s security department and requests a one-time verification code.
A legitimate caller should not need you to disclose a secret authentication code.
- Social media phishing
Attackers may use fake profiles, compromised accounts, or direct messages to distribute fraudulent requests.
Example: A message from an unfamiliar profile promises free examination materials but requests account credentials.
- QR code phishing
Some fraudulent messages use QR codes to direct people to deceptive websites.
Example: A printed notice claims that students must scan a code to confirm their registration, but the destination requests unrelated personal information.
A QR code is simply another way to open a destination. Its presence does not make the destination trustworthy.
-
How to Recognize a Phishing Email or Message
There is no single warning sign that identifies every phishing attempt, but several clues can help.
Warning sign 1: Unexpected urgency
Messages that demand immediate action deserve careful verification.
Example: “Your account will be permanently deleted in 15 minutes.”
Warning sign 2: Requests for passwords or verification codes
Be suspicious of messages asking you to reveal passwords, one-time codes, recovery codes, or other authentication secrets.
Warning sign 3: Unusual sender addresses
A message may display the name of a trusted organization while using an unrelated sender address.
However, a familiar-looking address alone is not proof of authenticity. Sender details can be misleading or accounts can be compromised.
Warning sign 4: Suspicious links
A link may lead to a website that imitates a legitimate login page.
For example, a fraudulent address may use a familiar brand name as part of a longer, unrelated domain.
Always check the actual website address carefully.
Warning sign 5: Unexpected attachments
An unsolicited attachment may be unsafe, especially when the sender pressures you to open it immediately.
Warning sign 6: Unusual requests
A school administrator unexpectedly requesting your banking password or an employer asking for secret login codes should raise concern.
Warning sign 7: Poor writing or unusual formatting
Some fraudulent messages contain spelling errors, strange formatting, or awkward language.
However, modern phishing messages can be grammatically correct and professionally designed. Good spelling is not proof of legitimacy.
-
How Fake Websites Trick Users
Phishing websites may imitate legitimate services by copying familiar logos, colors, layouts, and sign-in forms.
A fraudulent page may look almost identical to the website it is impersonating.
Example
Imagine that the legitimate address for a fictional school portal is:
https://portal.example.edu
A suspicious message instead directs students to:
https://portal.example.edu.login-check.example.com
The second address is not a page under example.edu. Its hostname belongs under example.com.
This demonstrates why users should examine the actual domain rather than relying on familiar words appearing somewhere in the address.
These addresses are illustrative examples, not websites to visit for the exercise.
Does HTTPS mean a website is trustworthy?
No.
In Lesson 4, we learned that HTTPS helps protect information exchanged between your browser and a website.
However, a fraudulent website can also use HTTPS.
The padlock or HTTPS connection does not prove that the organization behind the website is genuine.
You must still verify the website’s identity and purpose.
-
Phishing vs Malware: What Is the Difference?
Phishing and malware are related but different.
| Feature | Phishing | Malware |
| Meaning | Deceptive communication intended to trick someone | Malicious software or code |
| Main technique | Social engineering | Harmful software behavior |
| Common delivery | Emails, texts, calls, social messages | Unsafe downloads, compromised software, exploited vulnerabilities |
| Possible result | Credential theft, fraud, or harmful actions | Data theft, disruption, spying, or unauthorized access |
| Relationship | May persuade a person to download malware | May be delivered through a phishing attack |
Remember: Phishing is a method of deception, while malware is malicious software. One attack may involve both.
-
What Should You Do When You Receive a Suspicious Message?
Follow these simple steps.
Step 1: Stop and assess the request. Avoid acting immediately because a message creates fear or excitement.
Step 2: Do not open suspicious links or attachments. Avoid interacting with content that you cannot verify.
Step 3: Verify independently. Open the organization’s official application or enter its known website address yourself rather than using the link in the message.
Step 4: Contact the organization through a trusted channel. Use contact information from an official website, previous legitimate documentation, or another trusted source.
Step 5: Protect authentication information. Do not share passwords, one-time codes, or recovery codes in response to unexpected messages.
Step 6: Report suspicious activity. Use your email provider’s phishing-reporting feature or your school’s or organization’s security reporting process.
Step 7: Remove the suspicious message after reporting. Avoid forwarding it unnecessarily to other people.
These habits help reduce the likelihood of phishing-related account compromise.
-
What If You Already Clicked a Phishing Link?
Clicking a suspicious link does not automatically mean that your device or account has been compromised.
The appropriate response depends on what happened.
If you opened a page but entered nothing
Close the page and avoid downloading anything from it. Check for unexpected downloads or changes and seek technical advice if you notice suspicious behavior.
If you entered a password
Visit the genuine service using its official application or a trusted address and change the password.
If you reused that password elsewhere, update those accounts too.
Review account activity, active sessions, and recovery settings where available.
If you shared a verification code
Contact the affected service through its official support channels and follow its account-recovery or security instructions.
If you downloaded a suspicious attachment
Avoid opening or running it. Follow your device’s security guidance and consult trusted technical support if necessary.
If financial information was involved
Contact your financial institution promptly through an official channel.
If the incident involves a school or workplace account, notify the responsible IT or security team.
-
How Can Students Protect Themselves from Phishing?
Students often use online portals, email, learning platforms, social media, and scholarship websites.
Good security habits include:
- Accessing school portals through official websites or saved bookmarks.
- Verifying scholarship and admission announcements independently.
- Avoiding unexpected requests for login credentials.
- Using unique passwords for important accounts.
- Enabling multi-factor authentication when available.
- Checking website addresses before entering personal information.
- Reviewing unexpected login notifications.
- Reporting suspicious messages to the appropriate administrator or provider.
- Avoiding pressure to act immediately on unfamiliar requests.
- Keeping devices and browsers updated.
These habits are useful for students, job seekers, teachers, employees, and anyone who uses online services.
-
Safe Practical Activity: Spot the Phishing Warning Signs
Activity title: Can You Recognize a Suspicious Message?
Objective: Learn to distinguish suspicious messages from ordinary notifications by examining fictional examples.
Materials: A notebook or document for recording your answers.
Safety rule: Do not visit any links, scan QR codes, download attachments, contact senders, or submit information. Every example below is fictional and intended only for classroom analysis.
Example A: Urgent bank message
From: Account Support — alerts@bank-review.example
Subject: Immediate Account Verification Required
Message:
“Your account will be suspended within 30 minutes. Reply with your password and verification code to prevent permanent closure.”
Your task: Identify at least three warning signs.
Example B: School announcement
From: School Administration — notices@school.example
Subject: Updated Academic Calendar
Message:
“The updated academic calendar is available through the school’s usual student portal. Please access the portal using your saved bookmark or the official school website.”
Your task: Identify which features appear more consistent with a routine announcement and explain how you would independently verify it.
Example C: Scholarship opportunity
From: Scholarship Desk — awards@scholarship-check.example
Subject: Congratulations! You Have Been Selected
Message:
“You have won a fully funded scholarship. To claim it, provide your email password and pay a processing fee immediately. This offer expires in one hour.”
Your task: Explain why the message is suspicious.
Example D: Unexpected delivery message
From: Delivery Team — updates@parcel-notice.example
Subject: Delivery Could Not Be Completed
Message:
“We could not deliver your package. Open the attached file and follow its instructions to arrange another delivery.”
Your task: Explain how you would verify the delivery claim safely.
Suggested analysis
Message |
Assessment |
Main reason |
| A | Highly suspicious | Requests a password and verification code under extreme time pressure |
| B | Lower apparent risk, but still verify | Directs users to their usual official portal without asking for secrets |
| C | Highly suspicious | Uses an unexpected reward, secret credentials, payment, and urgency |
| D | Suspicious until verified | Unexpected attachment and an unverified delivery claim |
Important: Message B is not automatically genuine simply because it sounds professional. Always verify unexpected communications through a trusted channel.
Reflection
After completing the activity, write down three habits you will use whenever you receive an unexpected email, text, or direct message.
Expected learning outcome: You should be able to identify common phishing warning signs and explain how to verify a message without interacting with suspicious content.
