Cybersecurity Foundations (Grades 6–8) · lesson 7 of 48 · 15 min
The Art of the Fake — What Phishing Really Is
Imagine you receive an email from your bank. It has the bank’s logo, the right colours, a professional tone, and your name at the top. It says there has been suspicious activity on your account and you need to verify your identity immediately by clicking a link. The link takes you to a page that looks exactly like your bank’s website. You enter your username and password. And just like that — your account is compromised.
You were not hacked by a sophisticated technical exploit. You were tricked. This is phishing — and it is the single most common way attackers gain access to accounts, networks, and organisations worldwide.
Phishing is a type of social engineering attack. Instead of exploiting a software vulnerability, it exploits human psychology — our tendency to trust familiar brands, respond to urgency, and act without thinking critically when we feel threatened or excited.
The name comes from “fishing” — attackers cast a wide net (send millions of emails) hoping some percentage of recipients will take the bait. Even a 0.1% success rate on a million emails means 1,000 compromised accounts.
Phishing by the numbers
The FBI’s 2023 Internet Crime Report found phishing was the most common cybercrime reported, with over 298,000 complaints. Verizon’s Data Breach Investigations Report found that 36% of all data breaches involved phishing. The average cost of a phishing-related breach is $4.9 million. And 84% of organisations reported experiencing at least one phishing attack in 2023.
The Anatomy of a Phishing Attack
Every phishing attack has the same basic structure, even if the details vary. Understanding the anatomy helps you recognise attacks regardless of how they are disguised.
The attack succeeds when the victim either: (1) clicks a link and enters credentials on a fake login page, (2) opens an attachment that installs malware, or (3) replies with sensitive information directly. All three outcomes give the attacker what they need.
The Phishing Family — Variants You Need to Know
Phishing has evolved into a family of related attacks, each targeting a different channel or victim profile.
Spear phishing — the dangerous upgrade
Regular phishing is a numbers game — send a million emails, trick a thousand people. Spear phishing is targeted. The attacker researches you first: your name, employer, colleagues, recent purchases, travel plans. The email references real details about your life. It is dramatically more convincing and much harder to spot. Spear phishing is responsible for the majority of successful corporate breaches.
Activity 1 — Classify the Phishing Attack
Phishing Variant Classifier
- An email to millions saying “Your Netflix account has been suspended — verify now”
- phishing
Generic mass email impersonating a popular service — classic phishing.
- A text message: “USPS: Your package #7823 is held. Pay $3.99 to release: [link]”
- smishing
SMS-based phishing (smishing) — fake delivery notification with a malicious link. A call from “Microsoft Support” saying your computer has a virus and they need remote access vishing Voice phishing (vishing) — fake tech support call designed to gain remote access or steal credentials. An email to a specific employee using their name, manager’s name, and referencing a real project they are working on spear Personalised attack using researched details — spear phishing targeting a specific individual.
- A text: “Your bank account has been locked. Call 1-800-555-0123 immediately”
- smishing
SMS phishing creating urgency about a bank account — smishing. An email to a CEO appearing to come from the board chair, requesting an urgent wire transfer spear Targeted attack on a high-value executive (whaling is a subtype of spear phishing).
How Phishing Campaigns Are Built
Understanding how attackers build phishing campaigns helps you see why they are so convincing — and where the cracks are.
Phishing kits — the industrialisation of fraud
Phishing kits are pre-packaged tools that include cloned websites, email templates, and credential harvesting code for popular targets (banks, Google, Microsoft, Amazon). They are sold on dark web markets for as little as $50. This means someone with no technical skill can launch a professional-looking phishing campaign in minutes. The barrier to entry is extremely low.
Activity 2 — Phishing Psychology Matching
Psychological Trigger Matching
Real-World Phishing Case Studies
Case 1: Google and Facebook — $100 Million Phishing Scam (2013–2015)
A Lithuanian man named Evaldas Rimasauskas sent fake invoices to Google and Facebook, impersonating a real hardware vendor called Quanta Computer. Both companies paid the invoices — totalling over $100 million — before the fraud was discovered. The attack used no malware, no hacking, and no technical exploits. Just convincing fake emails and invoices. Both Google and Facebook eventually recovered most of the money, but the case demonstrated that even the world’s most sophisticated technology companies are vulnerable to phishing.
Case 2: Democratic National Committee Breach (2016)
Russian intelligence operatives sent spear phishing emails to Democratic Party staff. One email to campaign chairman John Podesta appeared to be a Google security alert asking him to change his password. His IT aide mistakenly told him it was “legitimate” (intending to say “illegitimate”). Podesta clicked the link and entered his credentials. His emails were stolen and published, influencing a presidential election. The entire breach started with one convincing email.
Case 3: Twitter Bitcoin Scam (2020)
Attackers used phone-based social engineering (vishing) to trick Twitter employees into giving them access to internal admin tools. They then hijacked the accounts of Barack Obama, Joe Biden, Elon Musk, Apple, and others to post a Bitcoin scam. The accounts had a combined following of hundreds of millions. The attackers made over $100,000 in Bitcoin before Twitter shut down the accounts. The breach started with a phone call to a Twitter employee.
Activity 3 — Scenario Lab: Recognise and Respond
Phishing Recognition Scenarios
Activity 4 — Flashcard Review
Phishing — Key Terms and Concepts
Phishing A social engineering attack using fake emails, texts, or websites to trick victims into revealing credentials or downloading malware. The #1 initial access method in data breaches.
- Core
- Spear Phishing
A targeted phishing attack using personalised information about the victim — their name, employer, colleagues, recent activity — to appear more convincing than generic phishing.
- Variant
- Whaling
Spear phishing targeting high-value executives (CEO, CFO, board members). Often impersonates regulators, lawyers, or other executives. High financial impact.
- Variant
- Smishing
SMS-based phishing. Fake text messages impersonating banks, delivery services, or government agencies. Common examples: fake package delivery alerts, bank fraud warnings.
- Variant
- Vishing
Voice phishing — phone calls from fake tech support, IRS agents, bank fraud departments, or other authorities. Designed to steal credentials or gain remote access.
- Variant
- Lookalike Domain
A domain registered to look like a legitimate one: “paypa1.com”, “amazon-security.net”. Used to host fake login pages. The URL is the most reliable indicator of a phishing site.
- Technique
- Credential Harvesting
The goal of most phishing attacks — capturing usernames and passwords entered on a fake login page and sending them to the attacker.
- Technique
- Phishing Kit
A pre-packaged tool sold on dark web markets that includes a cloned website, email templates, and credential harvesting code. Allows non-technical attackers to launch professional phishing campaigns. Technique
Activity 5 — Spot the Phishing Email
Now put your knowledge to the test. Examine this email carefully and identify the red flags that reveal it as a phishing attempt.
Phishing detection challenge
Read this email carefully. Click on any part that looks suspicious. Find all the warning signs, then submit your analysis.
- <>
- 🔗
warning signs found
You found of warning signs (%)
Excellent analysis! You have a sharp eye for phishing. Good effort. Review the indicators below to sharpen your skills.
Submit my analysis
Final Quiz — Phishing Recognition
Phishing Knowledge Check
You receive an email from “support@amazon-customer-service.net” saying your order was cancelled. What is the first thing to check?
- Whether the email has a professional logo
- The exact sender domain — “amazon-customer-service.net” is NOT amazon.com
- Whether the email has a padlock icon
- How many spelling errors it contains
Answer: The exact sender domain — “amazon-customer-service.net” is NOT amazon.com
The sender domain is the most reliable indicator. Logos and professional formatting can be copied perfectly. The domain “amazon-customer-service.net” is not Amazon’s real domain (amazon.com). Always check the full domain, not just the display name.
What makes spear phishing more dangerous than generic phishing?
- It uses more sophisticated malware
- It uses personalised information (your name, employer, recent activity) to appear more convincing
- It targets more people at once
- It is sent from real company email addresses
Answer: It uses personalised information (your name, employer, recent activity) to appear more convincing
Generic phishing is easy to spot because it is impersonal. Spear phishing uses your real name, mentions your employer, references recent events, and may even appear to come from a colleague. This personalisation makes it far more convincing and harder to detect.
A website with a padlock (HTTPS) in the browser is safe to enter your password on.
- True
- False
Answer: False
The padlock only means the connection between your browser and the site is encrypted. It says nothing about whether the site is legitimate. Phishing sites routinely use HTTPS and display the padlock. Always verify the full domain name, not just the presence of a padlock.
You receive a text saying your package could not be delivered and you need to pay a $3 redelivery fee. What should you do?
- Pay the $3 — it is a small amount and not worth worrying about
- Click the link in the text to check your order status
- Go directly to the carrier’s official website by typing the URL yourself to check your shipment
- Reply to the text asking for more information
Answer: Go directly to the carrier’s official website by typing the URL yourself to check your shipment
Fake package delivery texts (smishing) are extremely common. The $3 fee is a trick — entering your card details gives attackers your full payment information. Never click links in unexpected texts. Go directly to the official site by typing the URL yourself.
Previous lesson: Password managers
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: Spotting phishing emails