iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Phishing is a form of social engineering: an attacker impersonates a person or organization and prompts you to reveal information, send money, grant access, or open something that delivers malware. The ten forms below are useful ways to recognize it, not a canonical or mutually exclusive list. A single scam can combine several—for example, a targeted business email with a spoofed sender and a malicious attachment that ends in a fraudulent wire transfer.
What are the most common types of phishing?
Some names describe the delivery channel; others describe who is targeted or what the attacker wants. That is why one incident can fit more than one category.
1. Email phishing
Broadly sent emails impersonate a legitimate business and ask recipients to verify personal details, follow a link, or visit a lookalike website. A familiar logo or polished writing does not establish that a message is genuine.
2. Spearphishing
Spearphishing is tailored to a particular person or organization. The sender may use personal or workplace details to make the request seem credible or pose as someone the recipient trusts.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
3. Whaling
Whaling is phishing aimed at a high-profile individual to obtain sensitive, high-value information. It is a targeting subtype rather than a separate delivery channel.
4. Business email compromise (BEC)
BEC messages appear to come from a known source and request a payment or another sensitive action. Common scenarios include changed vendor payment details, an executive asking for gift cards, or revised real-estate wire instructions. A BEC message may use a compromised account or a spoofed sender.
Rank #2
- FIDO2 + FIDO U2F certified and supported USB security key
- Secured by NXP semiconductors
- Works in every browser and application without installing any drivers
- Supports desktops, laptops, tablets via USB-A and/or NFC, and supports iOS/Android Phones via NFC
- Helps protect your accounts from phishing and other cyber-attacks. Prevents your devices from unauthorized use.
5. Smishing
Smishing is phishing delivered by text message. The message may ask you to click a link, download a file, or start a conversation that moves the scam forward.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →6. Vishing
Vishing uses phone calls, voice messages, or voice-over-IP (VoIP) to deceive people. The FBI described targeted campaigns using AI-generated voice messages in a 2025 alert, but that example does not mean every suspicious call is AI-generated.
Rank #3
- FIDO2 + FIDO U2F certified and supported USB security key
- Supports Computers, Laptops, Tablets, and Mobile Devices with a USB-C port and/or NFC
- Works without downloading any drivers. Supported OS: Android, Chrome OS, Windows, MacOS, Linux
- Durable design made to last for a long time with everyday use. Water-resistant (IP67)
- Helps protect your accounts from phishing and other cyber-attacks. Prevents your devices from unauthorized use.
7. Pharming
Pharming uses malicious code to redirect someone to a fraudulent website. Unlike a typical lure that simply sends a victim to a lookalike site, the redirection can occur even when the victim does not follow a conventional phishing link.
8. QR-code phishing
A malicious or substituted QR code can lead to a fake website. The FTC has described reports of scammers covering legitimate parking-meter QR codes with their own codes. Check that a code or its destination has not been tampered with before entering payment or account information.
Rank #4
- FIDO2 SECURITY KEY: A versatile, tamper-evident USB-C authentication device with sensitive presence detection for online security. FIDO 2.0 level 1 and U2F certified
- PASSWORDLESS CONVENIENCE: Replace frustrating passwords with a simple 4-digit PIN for accessing apps and sites. Seamlessly login to web apps and Windows sessions
- BROAD COMPATIBILITY: Works with Windows, Mac, Linux, Apple, iOS, iPhone, Android and USB-C devices. Seamlessly integrates with Identity Providers or Credential Management Systems supporting FIDO2, including Thales, Microsoft, AWS, and Google
- ENHANCED USER ADOPTION: Features a sensitive presence detector on the USB key, providing ease of use and superior security. Certified for U2F and FIDO2, ideal for individuals who want to secure access to their personal online accounts - Microsoft, Google, Twitter, Facebook, GitHub
- THALES: We offer a wide range of FIDO authenticators, providing robust, phishing-resistant MFA that comply with stringent regulations. With almost three decades of experience, Thales is a pioneer in passwordless authentication devices, supported globally by the FIDO Alliance and industry analysts
9. Sender or domain spoofing
Spoofing alters a sender name, email address, phone number, or website URL to make it look trustworthy. A small spelling change can be enough to mislead. The FBI describes spoofing as disguising these details “often just by changing one letter, symbol, or number” to make someone believe they are interacting with a trusted source. FBI guidance on spoofing and phishing.
Recommended Free Tools
10. Attachment or malware-delivery phishing
A message urges the recipient to open or download a file that can install malware or enable further compromise. The FBI describes malware being used to access legitimate invoice threads; the FTC warns that phishing links and attachments can lead to ransomware. Confirm an unexpected file through a separate, known contact method before opening it.
Best Value
- SECURITY KEY FOR ENTERPRISE ACCESS: Supports FIDO2 passkeys and U2F for secure authentication across enterprise IT systems.
- PHISHING-RESISTANT AUTHENTICATION: Enables passwordless login with secure on-device credential storage and PIN-based user verification.
- COMPATIBLE WITH ENTERPRISE SYSTEMS: Works with FIDO2, WebAuthn, and U2F across enterprise, cloud, and modern IT environments.
- DRIVERLESS FIDO2 AUTHENTICATION: FIDO2 works natively with modern browsers and platforms. No drivers required.
- USB AND NFC CONNECTIVITY: Supports authentication via USB-C and NFC. No batteries required.
How can you tell if an email or text is fake?
Do not decide based only on whether a message looks professional. Check the sender’s full address and the destination of a link, including spelling, and ask whether the request is expected. An urgent demand to change payment details, send money, disclose a code, or open an unexpected file deserves independent verification. A familiar name, logo, or phone number on the screen is not proof that the message came from that source.
- Inspect the complete email address and the actual URL destination rather than relying on a display name or link text.
- Be cautious with unexpected links, downloads, QR codes, and requests for credentials or one-time codes.
- Contact the organization or person using a number or contact method you already know or look up independently. Do not use contact details supplied in the suspicious message.
- For payment changes and wire requests, confirm with the requester through a separate channel before acting.
How do you prevent phishing?
For individuals
- Verify unusual requests independently, especially requests involving money, account access, or sensitive information.
- Avoid clicking unexpected links or downloading files until you have confirmed the sender and request.
- Enable multi-factor authentication (MFA) wherever an account supports it. MFA methods differ in strength and compatibility; use a supported method and do not share a one-time code with someone who contacts you. The FBI advises users to set up two-factor or multi-factor authentication on accounts that allow it and never disable it.
- Where available, prefer phishing-resistant MFA. CISA recommends that businesses aim for phishing-resistant MFA; a USB hardware token is one MFA option, but not every key works with every account. Check the account’s supported authentication methods, the key’s connector or standard, and account-recovery options before choosing one.
For businesses
- Train staff to recognize impersonation, unexpected files, and payment requests, and establish a clear process for reporting suspicious messages.
- Require independent confirmation of payment-detail changes and wire requests through a known contact channel.
- Work with a knowledgeable email provider or administrator to configure SPF, DKIM, and DMARC. These email-authentication tools can make it harder to spoof a company’s domain, but configuration requires care. Decide how failing messages should be handled—such as being rejected, flagged, or quarantined—and who will monitor reports. The FTC’s small-business cybersecurity guidance covers email authentication and staff training.
- Enable MFA for accounts that support it and aim for phishing-resistant methods where practical, as CISA recommends in its MFA guidance.
Does MFA prevent phishing?
MFA adds a verification step beyond a password, which can make account access harder for an attacker, but the protection depends on the method and the service’s support. CISA recommends phishing-resistant MFA for businesses where available. Compare options by the strength of the factor, whether the account supports it, the device connector or standard involved, and how you can recover the account if you lose access. Never give an authentication code to someone who contacts you unexpectedly.
What should you do if you clicked a phishing link?
Clicking a link does not by itself establish that an account or device has been compromised; what you entered or downloaded matters. If you entered a password, change it using the service’s genuine site or app, and review account security. If you opened or downloaded a file, follow your organization’s security-reporting process if applicable and seek help from a trusted IT or security professional. Report suspicious messages through the relevant service or your workplace process.
What should you do if you sent money to a phisher?
Act immediately. The FBI advises contacting your financial institution and asking it to contact the receiving institution. Report a business email compromise incident to the FBI’s Internet Crime Complaint Center (IC3). Use independently verified contact details when reaching the bank or other institution.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
