Most phishing arrives by email, but it also comes by text message, phone call, chat and QR code. The message creates urgency: the account is locked, an invoice is overdue, or the boss needs a favor right away. A link leads to a fake sign-in page that copies the real one and captures what you type, or an attachment installs malware. Spear phishing targets one person and uses details about them to look convincing.
It remains common because it works on people rather than software. Training helps, but it is not enough, so assume that someone will eventually click. Phishing-resistant MFA, such as passkeys and security keys, makes a stolen password far less useful, because the key checks that it is talking to the real site. Email filtering and an easy way to report suspicious messages reduce the risk further.
Signs include a sender address that does not quite match, an unexpected request, pressure to act fast, and a link whose domain is slightly off. When in doubt, open the site yourself instead of using the link. AI tools can write messages with perfect spelling, so poor grammar is no longer a reliable sign.
Turn on MFA, use phishing-resistant methods for administrators, teach people to report rather than delete, confirm payment changes by phone, and run realistic exercises without blaming anyone.