Can You Spot the Phish?
Understanding phishing attacks and staying safe in our digital lives
By Mahisha .K
B.Tech Information Technology | St. Joseph’s College of Engineering
Introduction
In March 2016, John Podesta, chairman of Hillary Clinton’s presidential campaign, received an email that appeared to be a security alert from Google. It warned him about suspicious activity on his account and asked him to change his password immediately. However, the email was a phishing attempt. After the malicious link was clicked, his account was compromised, and more than 50,000 of his private emails were eventually exposed.
This incident demonstrated how a single deceptive email could lead to a serious security breach, with consequences extending far beyond an individual’s inbox.
Phishing is a cyberattack in which criminals pretend to be trusted individuals or organisations to trick people into revealing sensitive information or performing unsafe actions. From fake college notifications to fraudulent internship offers, these attacks can target anyone.
So, how can we recognise these tricks before becoming victims? Let’s explore the warning signs, understand different phishing techniques and test our ability to spot a phish!
What Exactly Is Phishing?
Phishing is a type of cyberattack in which someone pretends to be a trusted person or organisation to trick people into sharing private information or performing an unsafe action.
Attackers may try to steal:
- Usernames and passwords
- Banking and payment details
- One-Time Passwords (OTPs)
- Personal and educational information
- Access to email and social media accounts
For example, imagine receiving an email saying that your college account will be blocked unless you verify your login details immediately. The link takes you to a page that looks like your college portal, but it is actually fake. Once you enter your password, the attacker may collect it.
How Does a Phishing Attack Work?
Most phishing attacks follow a similar pattern:
- Creating a fake identity: The attacker pretends to be a bank, college, courier company or employer.
- Sending a message: The victim receives an email, SMS, social media message or phone call.
- Creating urgency: The message may say that an account will be suspended or an opportunity will expire.
- Tricking the victim: The victim clicks a link, opens an attachment or shares confidential details.
- Misusing the information: The attacker may use the collected information to access accounts or commit financial fraud.
Phishing does not always depend on advanced hacking techniques. It often succeeds by exploiting ordinary human reactions such as fear, curiosity, trust and urgency.
Types of Phishing Attacks
1. Email Phishing
Attackers send emails that look like they come from genuine organisations. They may include fake login links or harmful attachments.
2. Spear Phishing
This type of phishing targets a particular person or organisation. Attackers may use personal information to make their messages look more convincing.
3. Smishing
Smishing means phishing through SMS or text messages.
4. Vishing
Vishing means phishing through voice calls.
All these methods are forms of social engineering, where attackers manipulate people into taking actions that compromise their security.
How to Recognise a Phishing Message
Not every phishing message looks suspicious at first. However, some warning signs can help us identify them.
- Unusual sender address: Check whether the sender’s email address belongs to the organisation they claim to represent.
- Urgent warnings: Messages such as “Act now or lose access” may be designed to make you panic.
- Suspicious links: The displayed text may show a genuine company name while the actual link leads to a different website.
- Spelling and grammar mistakes: Unusual wording and mistakes may indicate a suspicious message, although professional-looking messages can also be fraudulent.
- Requests for confidential information: Be careful if a message asks for passwords, PINs or OTPs.
- Unexpected attachments: Avoid opening files that you were not expecting, especially from unknown senders.
A useful habit is to visit an organisation’s official website directly instead of following links in unexpected messages.
Can You Spot the Phish? — The Challenge
Now it’s your turn!
Read each situation carefully and choose the action you would take before checking the correct answer.
Scenario 1: The College Account Alert
You receive an email:
Get Mahisha Kannan’s stories in your inbox
Join Medium for free to get updates from this writer.
“Your college student account will be deactivated today. Click the link below and enter your username and password to continue using the portal.”
What would you do?
A. Click the link immediately.
B. Reply to the email asking for details.
C. Visit the official college portal independently and verify the notification.
Correct answer: C — Verify first!
The message creates urgency and asks for login credentials through an unfamiliar link. Always check with the official college website or IT department before taking action.
Scenario 2: The Internship Offer
You receive a message saying you have been selected for an internship at a well-known company. However, the sender asks you to pay a registration fee before receiving the offer letter.
What should you do?
A. Pay the fee to secure the opportunity.
B. Verify the opportunity through the company’s official website or placement department.
C. Share your personal details immediately.
Correct answer: B — Verify the opportunity!
An upfront payment demand is a warning sign. Never pay simply because a message promises an internship. Check the company and the offer independently.
Scenario 3: The Bank Call
Someone calls you claiming to be a bank employee. They say there is a problem with your account and ask you to share the OTP you just received.
What would you do?
A. Share the OTP to solve the problem.
B. Ask the caller to wait while you check your account.
C. Refuse to share the OTP and contact the bank through its official customer care channel.
Correct answer: C — Never share your OTP!
This is a possible vishing attack. An OTP is confidential and should never be shared with callers.
How did you do?
- 3 correct: Excellent! You know how to recognise common phishing warning signs.
- 2 correct: Good job! Keep practising and stay alert.
- 0–1 correct: Don’t worry. Now you know what to look for next time.
Remember, the purpose is not just to get all the answers right. It is to develop the habit of checking before clicking.
How Can We Protect Ourselves?
A few simple habits can make a big difference:
- Think before clicking: Avoid opening unfamiliar links, even when a message looks genuine.
- Verify the sender: Check the email address, phone number or account before responding.
- Never share OTPs or passwords: Keep confidential information private.
- Use strong and unique passwords: Avoid using the same password for every account.
- Enable Multi-Factor Authentication (MFA): Add an extra layer of protection to important accounts.
- Keep devices updated: Install security updates for your operating system, browser and applications.
- Avoid suspicious attachments: Do not open unexpected files from unknown senders.
- Report suspicious messages: Inform the organisation being impersonated or the appropriate cybercrime authorities.
What If You Have Already Fallen for It?
Even careful people can sometimes become victims of phishing. If you accidentally click a suspicious link or share confidential information, take action quickly.
- Change the password of the affected account immediately.
- Contact your bank if banking or payment details were exposed.
- Enable Multi-Factor Authentication wherever possible.
- Inform your college or the relevant service provider if their account is involved.
- Preserve suspicious messages, screenshots and transaction details as evidence.
- For financial cyber fraud in India, call 1930 or report it through the National Cyber Crime Reporting Portal.
Taking quick action can help reduce further damage.
Final Thoughts
Staying safe online is not only about using antivirus software or advanced security tools. It also depends on the small decisions we make every day.
A message may look genuine, a sender may seem familiar and an offer may sound exciting. But taking a few seconds to verify information can prevent serious problems.
STOP. THINK. VERIFY. THEN CLICK.
Can you spot the phish before it catches you?
References
- Indian Computer Emergency Response Team (CERT-In). CERT-In’s Digital Safety Compass Handbook.
- Indian Computer Emergency Response Team (CERT-In). Preventing Online Scams, Advisory CIAD-2024–0050, October 2024.
- European Union Agency for Cybersecurity (ENISA). Phishing/Spear Phishing — Glossary. https://www.enisa.europa.eu/
- Cybersecurity and Infrastructure Security Agency (CISA). Avoid Phishing Scams with Three Simple Tips. https://www.cisa.gov/secure-our-world/recognize-and-report-phishing
- Associated Press (November 10, 2017). Reporters Reveal Anatomy of Russian Hack. https://www.ap.org/the-definitive-source/behind-the-news/reporters-reveal-anatomy-of-russian-hack/
