Common Phishing Scams and How to Protect Yourself Today

Last month, a client forwarded me an email from "his bank." Every logo was correct. The email address looked right. The wording was cleaner than anything his actual bank has ever sent him. He clicked, entered his login, and lost access to his account for nine days.

What struck me wasn't the email. It was his reaction afterward: "It looked completely normal. There was nothing weird about it." He was right. And that's the entire problem with common phishing scams in 2026 — they no longer look like scams. The misspellings, the clumsy grammar, the obvious fake sender: those tells are mostly gone. Generative AI has been quietly rewriting the rules, and most of the advice floating around online still assumes we're fighting the phishing of five years ago.

I've spent the last few years building internal security training for small teams, and I've watched this shift up close. What follows is what actually works now — plus the uncomfortable parts nobody likes to admit.

Why phishing emails look harmless at first

Here's the thing nobody tells you: the goal of a phishing email is to feel boring. Exciting messages get scrutinized. Boring ones get clicked.

A package delivery notification. A calendar invite from a colleague. An invoice from a supplier you actually use. These are the messages that slip past your defenses, because your brain has filed them under "routine" and stopped paying attention. That automatic processing is exactly what attackers are counting on.

The AI rewrite nobody warned you about

For years, security training told people to look for bad spelling and awkward phrasing. That advice is now actively dangerous, because it creates false confidence. A message written by a large language model has no typos. It has natural rhythm. It can reference your company's actual language, pulled from a LinkedIn post or a press release, and sound like it came from someone who works down the hall.

A former colleague summed up the shift better than any slide deck I've seen: "The old phishing emails looked foreign. The new ones look like my boss."

And the worst part? The volume. Tools that once required technical skill now generate hundreds of personalized messages in an afternoon. Attackers don't need a hit rate of 30%. A fraction of a percent is enough when sending costs nothing.

The mechanics behind the disguise

Two techniques deserve a plain-language explanation, because they explain why your eyes deceive you.

• Lookalike domains: a real domain might be yourcompany.com, while the fake one is yourcornpany.com — an "rn" that reads as an "m" at normal font sizes.
• Homoglyph attacks: attackers swap a Latin letter for a visually identical character from another alphabet. The URL looks correct. It isn't.
• Display-name spoofing: the sender name shows your CEO's real name while the underlying address is something entirely unrelated.
• Legitimate platform abuse: the message genuinely comes from a real file-sharing or form service, which is why your email filter trusts it. The malicious part is the link inside.

That last one is my personal nemesis. I once clicked a link inside a genuine notification from a real service, because I'd seen hundreds of identical ones. The page asked me to re-authenticate. I got as far as typing my username before something felt off. Total waste of a Saturday morning spent resetting passwords.

The most current scams right now

The phishing landscape isn't one thing. It's a family of attack types, and they target different moments of inattention. Here are the five I see most often in the wild, and what each one actually looks like when it lands in your inbox.

Five scams to recognize

1. Spear phishing — a message tailored to you specifically, referencing your role, your projects, or a recent company announcement. These are the most dangerous because there is nothing generic to latch onto.
2. Invoice and payment fraud — a supplier or finance colleague "updates their bank details." The amount is plausible and often matches a real contract.
3. QR-code phishing (quishing) — the message contains no clickable link at all, just a QR code. Your email scanner sees nothing suspicious to flag.
4. Vishing — a phone call or voicemail claiming to be IT support, then a follow-up email "confirming" the request. The two channels reinforce each other.
5. Multi-factor authentication fatigue — you receive a flood of login prompts until you approve one just to make it stop. This one doesn't even need you to click anything.

Notice what's missing from that list: the clumsy "Nigerian prince" email. It still exists, but it's now the bottom of the barrel, aimed at the least attentive targets. The sophisticated attacks don't bother announcing themselves as emergencies. They arrive as follow-ups.

A real comparison: which attacks slip through which defenses

The table below is based on the incidents I've helped clean up over the past couple of years, not on any published research. Treat the proportions as orders of magnitude, not precise figures.

Attack type	How it arrives	Does a spam filter catch it?	What stops it
Mass phishing	Email, unknown sender	Usually yes	Filter plus basic caution
Spear phishing	Email, plausible sender	Often no	Verifying the request by a second channel
Quishing	QR code in email or print	No — nothing to scan	Never scanning codes from unexpected messages
Vishing	Phone call	Not applicable	Calling back on a number you looked up yourself
MFA fatigue	Login prompts on your phone	No	Never approving a prompt you didn't trigger

Franchement, the pattern jumps out: the attacks that get through are the ones that don't look like attacks. Everything your filter catches is the easy stuff.

What are the best practices for protecting yourself from phishing attacks?

Good question, and it deserves a better answer than "be careful." Careful isn't a procedure. Here's a procedure.

The core principle is a single rule, and if you take nothing else from this article, take this: if a message asks you to log in, pay, or confirm something, don't use the link it gives you. Open a new tab, type the address yourself, or use your saved bookmark. The message becomes irrelevant the moment you stop letting it steer you.

Around that rule, build a few habits:

• Turn on multi-factor authentication everywhere it's offered — ideally an app or hardware key, not SMS codes.
• Use a password manager, so you never type credentials into a page you reached by clicking a link.
• Verify unusual requests by a second channel. If your "CEO" emails asking for a wire transfer, walk over or call the number you already have.
• Keep your devices and browser updated. Most attacks exploit flaws that were patched months ago.
• Treat urgency as a red flag, not a motivator. Real organizations rarely need a decision in the next ten minutes.

Does this take effort? A little, at first. The password manager setup took me an afternoon and annoyed me for a week. Three years on, I'd never go back — I now know exactly which of my accounts have weak credentials, and I've stopped reusing the same password across a dozen sites, which was my worst habit by far.

What is the one thing you can do to protect yourself against phishing sites?

If you want the single highest-leverage habit: never reach a login page by clicking a link in a message. Always go there yourself.

This one action neutralizes the overwhelming majority of phishing attempts, because the fake site only works if you arrive through the attacker's door. A spoofed domain you typed yourself doesn't exist — you'll land on the real one. Bookmark the sites that matter (bank, email, work tools, cloud storage) and use those bookmarks exclusively. The habit costs you two extra seconds and removes an entire category of risk.

What are 5 things you can do to protect yourself from cybercrime?

Zooming out from phishing specifically, these are the five measures I'd prioritize if I were setting up protection for myself from scratch today.

1. Lock down your accounts. Unique passwords plus multi-factor authentication on email, banking, and anything holding payment details. Your email is the master key — if it falls, everything resets through it.
2. Slow down on unsolicited contact. Whether it's a text, a call, or a message on a platform, the first move is always the same: verify independently before acting.
3. Update everything. Operating systems, browsers, apps. Set them to update automatically so it stops being a decision.
4. Back up your data offline. Ransomware is a different beast from phishing, but the recovery plan overlaps — and a backup you can't reach over the network is the one that saves you.
5. Talk about it. Tell the people around you what you're seeing. My client who lost nine days of access warned his entire team, and two of them recognized nearly identical emails a week later. That's how the defense actually scales.

Item five is the one people skip, and it's the one with the best return. Security isn't a personal skill. It's a shared habit that spreads through conversation.

If you think you clicked: what to do in the first hour

The most common mistake isn't clicking the link. It's the silence afterward. People feel embarrassed and hope nothing happens. That delay is what turns an inconvenience into a disaster.

So if you suspect you responded to a phishing email, do this, in order:

• Change the password for the affected account immediately — and any account that shares that password.
• If you entered payment details, call your bank or card issuer now. Speed beats politeness.
• Turn on or reset multi-factor authentication, which often kicks the attacker out of an active session.
• Check your account's recent activity and connected devices for anything you don't recognize.
• Report the message to your IT team or email provider, then delete it.

I'll be honest: I broke this rule once and waited two days before mentioning it. Nothing happened, but those 48 hours of quiet dread taught me more than any training module. The lesson wasn't "don't click." It was "don't hide."

Quick answers to common questions

How do I identify a phishing email? Look past the content. Check the actual sender address, not the display name. Hover over links to see where they really point. Ask whether you expected this message at all. And if it's asking for credentials, payment, or urgent action — treat it as hostile until you've verified it through another channel.

Why do phishing emails appear harmless at first? Because that's the design. Attackers deliberately avoid anything that triggers alarm. No threats, no drama, no typos — just an ordinary-looking notification that matches your daily routine. The harmlessness is the payload.

Spear phishing emails are the most common targeted attacks — is that still true? Yes, and more so each year. Generic campaigns are cheap and get filtered, while targeted messages aim at individuals with access. The economics push attackers toward precision, not volume.

The part that should worry you

Here's my honest position, and I'll defend it: most phishing training is built for a threat that no longer exists. It teaches people to spot bad grammar and suspicious links, when the actual danger now arrives in perfect prose, from a platform you trust, referencing a project you really are working on.

The uncomfortable implication is that you can't rely on recognizing a scam. You have to rely on a procedure you follow regardless of how convincing the message looks. Verify independently, reach sites yourself, lock your accounts, and tell someone the moment you slip.

Which leaves one question worth sitting with. If a message arrived tomorrow that looked exactly like the ones you receive every day — same sender, same tone, same request — what would make you stop and check? If the answer is "nothing in particular," that's not a character flaw. It's just the gap the scammers have already found.