Phishing, fraud, and impersonation
Phishing
Phishing is a social-engineering attack that impersonates a trusted party, usually by email, text message or a lookalike website, to make the target hand over credentials, payment details or access.
How phishing works
A phishing attempt has three parts: a lure, a destination and a payoff. The lure is the message, which borrows a brand's name, logo and tone and adds a reason to act now: a locked account, a missed delivery, a refund, an invoice. The destination is where the link leads, most often a page on a domain the attacker controls that copies the real sign-in or checkout form. The payoff is whatever the victim types into that form, or the malware the page delivers.
The destination is the part a brand-protection team can actually see and act on. The lure lives in the victim's inbox; the destination lives on a hostname, with a registrar, a DNS provider, a certificate and a hosting provider, each of which has an abuse process.
Common variants
Phishing is named by channel or by target, but the mechanics are the same.
- Email phishing: bulk messages sent to many recipients, often from a spoofed or lookalike sender.
- Spear phishing: a message written for one person or one team, using details gathered in advance.
- Smishing and vishing: the same lure delivered by SMS or by voice call.
- Business email compromise: no malicious link at all, just a request for a payment or a change of bank details.
Warning signs
No single sign is conclusive, but several together usually are.
- The message creates urgency or secrecy and asks the reader to skip a normal process.
- The visible sender, the link text and the real destination describe different organisations or domains.
- The sign-in or payment page asks for something the genuine service never collects on that page.
What a brand-protection team does about it
For the organisation being impersonated, the work is finding the destination pages early, collecting evidence (the URL, the page, DNS and certificate records, timestamps) and reporting them to the providers that can remove them. Speed matters because most phishing pages are short-lived, and so is the window in which a takedown protects customers.
Related terms
Sources
- CISA: recognize and report phishing
- NCSC: phishing attacks, defending your organisation
- MITRE ATT&CK T1566: Phishing
- APWG phishing activity trends reports
External guidance is general. Adapt it to your legal, regulatory and operational requirements.