Glossary

#phishing #MFA #email security #social engineering

What is phishing? The types of attack, and defenses more reliable than spotting it

Phishing impersonates someone you trust to lure you to a fake site and steal passwords or data. It targets people, not software bugs. The types (spear phishing, BEC, smishing, adversary-in-the-middle) and defenses more reliable than 'being careful' (phishing-resistant MFA, domain checks, email auth), defense-only.

Published 2026-06-13 Updated 2026-10-06 9 min read

On this page

Phishing means pretending to be someone you trust to lure you to a fake site. Here are the types and the more reliable defenses (no attack steps).

How it works: it targets human judgment, not a software defect

Where XSS or SQL injection exploits a defect in software, phishing exploits human judgment. Messages like "your account is suspended" or "urgent — confirm now" use urgency, authority, and fear to steal the moment you'd otherwise stop and think, then lure you to a pixel-perfect fake site to type your password. A site with zero technical vulnerabilities still leaks credentials if its users are fooled.

Entry route #1

Much ransomware and many breaches start with phishing. It's the most common first step

Urgency / authority / fear

'Right now,' 'from the CEO,' 'you can stop it' — pressure that removes the pause to think

AiTM

Adversary-in-the-middle: the fake site relays even one-time codes and can defeat ordinary MFA

The types (different names, same impersonate-and-lure approach)

Bulk phishing

blasted to many people

Spear phishing

aimed at a specific person/org

BEC

impersonate a supplier/exec to order a payment

Smishing

over SMS

Vishing

over phone

AiTM

relays login to the real site, defeats MFA

Common types of phishing. The channel and target differ, but the core — impersonate and lure — is the same.

The names differ, but the core is the same: lure you by faking trust. In particular BEC (business email compromise) causes large financial losses without any malware at all — just "a payment request that looks like it's from a supplier." It's a type you stop with a business-process check, not technology.

Phishing vs spam vs spoofed email vs tech support scams

Terms people mix up, side by side. They overlap, but their goals differ.

Term	Goal	Typical form
Phishing	Steal credentials or card details, or get malware run	Email or SMS posing as a company, leading to a fake login page
Spam	Send ads or scam links in bulk	Unsolicited advertising; can include phishing
Spoofed email	Fake the sender (a technique, not a goal)	Claims a real domain or person; used for phishing and BEC
Tech support scam (fake warning)	Get you to call, then ask for money or remote access	A screen saying "your PC is infected" with a phone number

Spoofing is the technique; phishing is the scam that uses it. To keep your own domain from being spoofed, see setting up SPF, DKIM and DMARC; for fake warnings, see handling a tech support scam.

Examples: the situation in Japan, and incidents

The Council of Anti-Phishing Japan received a record 2,454,297 phishing reports in 2025, about 1.43 times the 2024 figure.

Phishing has also been the entry point for incidents. In the KADOKAWA ransomware attack (2024), credentials stolen by phishing aimed at employees were described as the way in. In the Coincheck NEM theft (2018), email sent to employees was reported as the first step. Fake emails using the name of a company that just had a breach also tend to follow soon after (for example, the Medica Shuppan case).

Defense: stop it with a mechanism, not vigilance

Use phishing-resistant MFA (most important)

A mechanism that doesn't respond to fake sites is the most reliable defense. Passkeys / hardware security keys (FIDO2) are bound to the domain, so on a fake domain the authentication simply can't complete — not even adversary-in-the-middle (AiTM) can relay it. SMS/authenticator codes can be relayed, so move your most important accounts (email, domain, payments) to resistant MFA first (→ choosing MFA).

Don't click the link — go to the official site yourself

Don't tap links in email or SMS; reach the official site directly via a bookmark or by typing the address. The more a message poses as "account check," "billing," or "delivery," the more you should open it your own way, not through its link.

Cut email spoofing with technology

Set up your domain's SPF/DKIM/DMARC correctly so spoofed mail impersonating your domain can be rejected at the receiving end (→ what SPF/DKIM/DMARC are). A password manager won't autofill on a fake domain, so "it didn't fill" is itself a tell that the site is fake.

Pause under urgency/authority; verify payments out-of-band

"Right now," "from the exec," "you can stop it" — that pressure is the signal of a scam. When you're being rushed, pause. For any request involving a payment or credentials, verify the person through a separate channel like a phone call before acting (the most important BEC defense).

Easy to defeat

Password plus an SMS/authenticator code only. With a pixel-perfect fake site relaying the code (AiTM), even a careful person has their credentials taken. A defense that assumes "I can spot it."

Actually stops it

A passkey/hardware key bound to the domain. On a fake domain the authentication can't complete, so even a fooled user isn't breached. A mechanism that's "safe even if you can't spot it."

This site's view: 'be careful' is not a defense strategy

We think leaning on "staff training" and "awareness" alone for phishing is shaky. Now that adversary-in-the-middle (AiTM) is routine, no matter how careful someone is, they can't reliably detect a pixel-perfect fake site plus code relay. Awareness can help, but it can't be the main defense. What to rely on is a mechanism: roll out domain-bound phishing-resistant MFA, starting with your most important accounts. Investing in a design that stays safe even when people can't spot the fake works better than trying to train people to spot it.

How to check for yourself

Check your own domain's email authentication

Enter your domain in the SPF / DKIM / DMARC Checker to confirm all three are set and that the DMARC policy isn't still p=none.

Look at a message's authentication results and domain

In Gmail use "Show original"; in Outlook, view the message source. Find spf=, dkim= and dmarc= in the Authentication-Results header. Even when they pass, check separately whether the sender's domain belongs to the real company.

Use your password manager's autofill as a signal

If your password manager doesn't autofill on a site where you saved a login, the domain may be different. Check the domain in the address bar before typing anything.

Check which MFA your key accounts use

For email, cloud, payment and domain-registrar accounts, check the security settings for passkey or hardware-key support, and switch wherever it's available.

Thinking "I won't be fooled" is the most dangerous belief

The biggest mistake in phishing defense is the overconfidence of "I can spot it." Adversary-in-the-middle (AiTM) shows a pixel-perfect screen and relays the password and one-time code you type to the real site on the spot. In other words, even if you're careful and enter the correct code, that correct code is stolen too. So basing your defense on "vigilance to spot it" is itself the mistake; the right move is to shift to a mechanism: authentication that can't complete on a fake domain (phishing-resistant MFA). Refusing to stop at "be careful" is the starting point of modern phishing defense.

Sources (primary)

Council of Anti-Phishing Japan, "Phishing Report 2026" (Japanese) — antiphishing.jp (2025 report count; rise of attacker-owned domains passing DMARC)
Council of Anti-Phishing Japan, "Report phishing" (Japanese) — antiphishing.jp
APWG, "Report Phishing" — apwg.org
NIST SP 800-63B-4, "Digital Identity Guidelines: Authentication and Authenticator Management" — pages.nist.gov (definition of phishing-resistant authentication)

Classification

CWE classifies the types of weakness behind vulnerabilities; MITRE ATT&CK classifies attacker techniques. Both are maintained by MITRE and widely used to label vulnerability reports and detection rules.

ATT&CK (attack technique)

T1566Phishing

© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. ATT&CK Terms of Use

FAQ

QCan I just spot phishing if I'm careful?

Believing 'I can spot it' is dangerous overconfidence. Modern phishing uses pixel-perfect fake sites and 'adversary-in-the-middle (AiTM)' relays that pass the password and one-time code you type straight to the real site in real time, so even careful people get their SMS or authenticator codes stolen along with the password. That's why the main defense isn't vigilance but a mechanism that doesn't respond to fake sites: domain-bound phishing-resistant MFA (passkeys/security keys).

QWhat types of phishing are there?

Common ones: bulk phishing blasted to many people; spear phishing aimed at a specific person or org; BEC (business email compromise), impersonating an executive or supplier to instruct a payment; smishing over SMS; and vishing over phone. On top of these, adversary-in-the-middle (AiTM) phishing relays your login to the real site and is especially dangerous because it can defeat ordinary MFA.

QDoes enabling MFA stop phishing?

MFA is strongly recommended, but it depends on the type. SMS and authenticator one-time codes can be defeated when an adversary-in-the-middle relays the code in real time. What can't be relayed is domain-bound phishing-resistant MFA like passkeys or hardware security keys (FIDO2): on a fake domain the authentication simply can't complete. See the guide on choosing MFA for details.

QI typed my password into a phishing site. What now?

Change the password right away, reaching the service through its official site or app yourself. Change it on any other service where you reused the same password, and turn on multi-factor authentication. Check sign-in history and whether your recovery email or forwarding settings were changed. If you entered a card number, call the card issuer; for online-banking details, call the bank; if money was lost, report it to the police.

QWhere should I report a phishing email?

Forward it, without clicking any links, to your national reporting channel: in Japan, the Council of Anti-Phishing Japan (info@antiphishing.jp; for SMS, attach a screenshot); internationally, the Anti-Phishing Working Group (reportphishing@apwg.org). Also tell the company whose name was used, so it can warn its customers.

QIf an email passes SPF, DKIM and DMARC, is it safe?

Not necessarily. Email authentication only checks that the message was sent properly from that domain; if the domain itself belongs to the attacker, it passes. The Council of Anti-Phishing Japan's Phishing Report 2026 says that in the second half of 2025 attackers sharply increased their use of their own domains to pass DMARC, reaching about 75.3% of phishing by December. You still have to check whether the sender's domain really belongs to the company.