What is phishing — and why does it work?

You’ve probably heard the term phishing before.

It shows up in headlines, workplace training, and warning emails — but what does it actually mean?

And more importantly:

Why does it work so well?

So what is phishing?

Phishing is when someone pretends to be a trusted person or organisation to trick you into giving away information.

That might be:

• Your password
• A security code
• Bank details
• Personal information

The key idea is simple:

It’s not about breaking into systems — it’s about convincing people to open the door.

What does a phishing message look like?

Phishing usually arrives as something familiar.

For example:

• An email that looks like it’s from your bank
• A message saying your account needs urgent attention
• A delivery notification asking you to click a link
• A password reset you didn’t request

At first glance, these messages often look completely normal.

That’s intentional.

So why does phishing work?

Because it targets something very human.

Phishing messages are designed to create a feeling, not just deliver information.

Common triggers include:

• Urgency → “Act now or your account will be locked”
• Fear → “Suspicious activity detected”
• Curiosity → “You’ve received a secure message”
• Trust → familiar logos, names, and language

When we feel pressure, we’re more likely to act quickly — and less likely to double-check.

That’s what attackers rely on.

What actually happens if someone clicks?

In many cases, the message leads to a fake website.

It might look exactly like a real login page.

When someone enters their details:

• The information is sent to the attacker
• The person is often redirected to the real site
• Everything appears normal

But the attacker now has what they need.

Is this how most accounts get hacked?

In many cases, yes.

It’s easy to imagine attackers using advanced tools to guess passwords.

In reality:

It’s often much simpler to just ask — in a convincing way.

Phishing is effective because it avoids technical barriers entirely.

How can you spot a phishing message?

There’s no single giveaway — but there are patterns.

Things to look for:

• Messages that create pressure to act quickly
• Links that don’t quite match the real website
• Unexpected requests for passwords or codes
• Messages that feel slightly “off” in tone or wording

The most important signal is often your instinct:

“Something about this doesn’t feel right.”

That’s worth listening to.

What should you do instead?

If you receive a message like this:

• Don’t click the link straight away
• Go directly to the official website or app
• Check the message through a trusted route
• Take a moment — phishing relies on speed

You’re not expected to be perfect.

Just slowing down is often enough to break the attack.

Should you be worried?

Phishing is common — but it’s also very preventable.

The risk doesn’t come from not understanding technology.

It comes from being caught off guard in a moment of pressure.

That’s something everyone experiences.

What does this mean for me?

You don’t need to memorise technical rules.

Just keep a few simple habits in mind:

• Be cautious of unexpected messages
• Avoid clicking links in emails or texts where possible
• Use official apps or websites instead
• Take your time — urgency is often the trick

And remember:

If someone is trying to rush you, that’s usually the point where you should slow down.

🧠 The Human Factor

References and sources

• National Cyber Security Centre (NCSC) — Phishing guidance
• UK ICO — Online safety advice
• Industry reports on social engineering and phishing trends