Phishing and Passwords — How Attackers Steal Credentials and How to Stop Them

What phishing is — and is not

Phishing is a social engineering attack that tricks a person into voluntarily handing over their credentials — usually by presenting a convincing fake login page for a service they trust. It is not a brute-force attack, a dictionary attack, or a technical exploit. It does not need to break any cryptographic mechanism. It simply needs to create a moment where the target types their username and password into a form controlled by the attacker, rather than the legitimate site. This makes phishing uniquely difficult to defend against with purely technical controls, because the user's own action is the vulnerability.

How a credential phishing attack unfolds

A typical attack: the attacker registers a lookalike domain (like "paypa1.com" or "bankofamerica-security.com"), creates a convincing copy of the target site's login page, and sends emails to potential targets. The email creates urgency: "Your account has been suspended — verify your information within 24 hours or lose access." The target clicks the link, lands on the lookalike page, types their credentials, and is often redirected to the real site after submission to avoid suspicion. The attacker captures the credentials in real time. For accounts with SMS-based MFA, real-time phishing kits (Evilginx2, Modlishka) can even capture the MFA code as the user enters it, relaying it to the real site before it expires.

Spear phishing: targeted attacks

Generic phishing casts a wide net. Spear phishing targets a specific person using information gathered from social media, LinkedIn, company websites, or previous breaches. A spear-phishing email appears to come from a colleague, manager, or vendor — it references real projects, real names, and real context. The targeted nature makes it far more convincing. Business email compromise (BEC) is a spear-phishing variant where attackers impersonate executives to request wire transfers or sensitive information from finance staff. The FBI's Internet Crime Complaint Center (IC3) reported roughly $2.77 billion in BEC losses in the United States in 2024.

Why awareness alone is not enough

Security training programs teach employees to spot phishing indicators: check the sender address, look for spelling errors, hover over links. These are useful but have a fundamental limitation: attackers know exactly what users are trained to look for and design around it. Lookalike domains can pass visual inspection. AI-generated phishing emails often have no spelling errors. Compromised legitimate email accounts send phishing from real addresses. Even well-trained, security-conscious users get phished — the question is whether the consequence of that phishing is containable.

The two defences that actually work

Passkeys (FIDO2/WebAuthn) are the most widely available phishing-resistant authentication method. The private key will only sign authentication challenges from the exact domain it was registered for — a lookalike domain cannot elicit a valid signature. If your passkey was created for paypal.com, it will not authenticate on paypa1.com. Hardware security keys (YubiKey, Google Titan) are FIDO2 devices that offer the same phishing resistance, with the credential held on dedicated hardware. TOTP-based MFA adds a partial defence — an attacker needs both your password and the current TOTP code — but real-time phishing kits can capture both. SMS MFA provides minimal resistance to determined phishing.

Practical anti-phishing habits

Never click login links in emails — go directly to the site by typing the URL or using a bookmark. Verify the domain in the browser address bar before entering credentials — read the full domain name (everything before the first single slash), not just its beginning. Enable passkeys or hardware security keys on any account that supports them. Use a password manager with auto-fill: a manager will only fill credentials on the exact saved domain, not on a lookalike. Report suspicious emails to your IT team or email provider. These habits do not make phishing impossible, but they substantially reduce the risk for the accounts that matter most.

What to do if you think you were phished

Act quickly and do not wait to be certain. Change the password on the real site, reached by typing the address or using a bookmark, and change it anywhere else you reused it. Sign out of other sessions, check for unfamiliar mail-forwarding rules, recovery addresses and connected devices, and remove anything you do not recognise. If it was a work account, tell your IT or security team immediately; if money or card details were involved, contact your bank. Speed matters far more than embarrassment, and reporting the message helps protect others from the same campaign.