Phishing — Defender's Guide

Phishing — Defender’s Guide

Phishing is the most common initial-access technique used by both nation-state and criminal actors. It works because it bypasses encryption, MFA, and most technical controls by targeting the human. This page is the defender’s perspective: how to recognize attacks, verify suspicions, report them, and recover. For the offensive/red-team perspective on running authorized phishing tests, see Phishing Simulation.

If you just clicked something

Don’t panic, don’t keep typing. Close the page or app. Don’t enter any more credentials, codes, or info. Jump to If You Already Clicked or Typed and work the checklist.

Recognition — the five red flags

Real phishing attempts share a recognizable shape. If a message hits 3 or more of these in close succession, treat it as phishing until proven otherwise:

1. Pretext — claims to be someone you’d trust: a contact, “official support,” IT, your bank, a service you use, a known executive.
2. Urgency — “suspicious activity detected,” “your account will be locked in 24 hours,” “act now or lose access.”
3. Authority — invokes power: “by order of,” “FBI alert,” “your CEO needs this,” “compliance requires.”
4. Action — asks you to do something you normally wouldn’t: type a code, click a link, scan a QR, install an app, transfer funds, run a script, “verify” credentials.
5. Quiet — tells you not to confirm out-of-band: “don’t call to verify,” “don’t tell anyone,” “this is confidential,” “even support shouldn’t see this.”

The presence of the “Quiet” flag is the most reliable single indicator. Legitimate services never tell you to hide information from their own staff.

Variants

Email phishing (the classic)

• Sender display name matches a known entity; sender address often doesn’t (support@signa1.org, irs@treasury-gov.net)
• Reply-To header differs from From header
• Links look right at a glance but point elsewhere (hover before clicking; on mobile, long-press)
• Attached “invoice,” “DocuSign,” “shared document,” or “FedEx tracking” — opens to a credential-harvesting page
• HTML rendering hides URL — the visible text says https://yourbank.com but the actual href is different
• “Re:” or “Fwd:” prefix on a thread you don’t remember

Verification: Look at the actual sending domain (not display name). Hover over every link. Check email headers for SPF/DKIM/DMARC results if your client surfaces them.

Smishing (SMS phishing)

• Carrier “shortcodes” can be spoofed; sender ID is essentially advisory
• Lures: package delivery (“USPS attempted delivery”), banking (“fraud alert”), tax/government (“refund pending”), toll roads (“unpaid toll, click to resolve”)
• Links often use URL shorteners (bit.ly, tinyurl) to obscure the actual destination
• Increasingly used for 2FA-code requests — the lure asks you to “reply with the code you just received”

Verification: If your bank/carrier/etc. genuinely needs your attention, log into the app or call the number on the back of your card — never the number in the message.

Vishing (voice phishing)

• Caller ID can be spoofed to match any number — including your bank, the IRS, or your own work caller ID
• AI-cloned voices are now common — a “family member’s emergency call” may be a synthesized voice trained on social-media audio
• “Callback scams” — leaves a voicemail with a number that’s not the real institution
• “Tech support” calls claiming infection on your computer
• “Refund department” overcharge schemes
• Walk-the-victim-through-a-process attacks: “open your banking app, I’ll guide you”

Verification: Hang up. Call back on a number you obtain independently (from the back of your card, the official website typed by hand, an old statement). If asked for codes or to install remote-access software, it’s a scam — full stop.

Quishing (QR-code phishing)

• Sticker over a legitimate QR on a parking meter, restaurant table, or charging station
• QR-code attachments in email that bypass URL scanners (the QR is an image)
• “Scan to verify” or “scan to view document” lures
• See the Signal/RIS campaign — uses QR codes to attach attacker devices to victim accounts

Verification: Most phone cameras preview the URL before opening. Read it. If it doesn’t match the expected domain, don’t open. Be especially cautious with QR codes from email or in physical public spaces.

In-app phishing (CMA, gaming, social)

• Messages from “official” bot accounts that don’t exist
• Friend requests from duplicate accounts of people you know
• “Verification needed” prompts in DMs
• See Signal/RIS campaign for a live example

Verification: Real platform messages come through system-level notifications and settings panels, not chat DMs. No platform asks you to reply with a code in chat.

Verification protocol (when something feels off)

The cheap habit that defeats most phishing:

1. Pause. Phishing relies on urgency. Adding 60 seconds defeats most attacks.
2. Don’t reply on the same channel. If a “support” message arrives via Signal, call the contact (or check the official website). If an email arrives from “your CEO,” walk over or call their office number.
3. Open the service directly. Type the URL or open the app yourself — never click a link in the suspicious message.
4. Check the actual sender. Email full address. SMS shortcode. Phone number cross-referenced against your records.
5. If still uncertain, screenshot and ask your security team. Better to ask 100 false alarms than miss one real attack.

Reporting

Report every phishing attempt, including ones you didn’t fall for. Reports help platforms and authorities track campaigns.

Channel	Where to report	What it does
Email	Forward to reportphishing@apwg.org (APWG) and spam@uce.gov (FTC). Most workplaces have a “Phish Alert Button” in Outlook/Gmail.	Feeds antiphishing blocklists
SMS/Smishing	Forward to 7726 (SPAM) in the US, Canada, UK, AU	Carriers track and block
Voice/Vishing	reportfraud.ftc.gov (US); your local equivalent elsewhere	Aggregate scam-tracking
In-app (Signal/Telegram/WhatsApp/etc.)	Use the in-app “Report” function (usually long-press the message). Block the sender.	Platform-side moderation
Suspected nation-state targeting	IC3.gov, then your local FBI Field Office	Counterintelligence tracking
Financial fraud	Your bank’s fraud line (back of card), then reportfraud.ftc.gov	Account protection + investigation
Identity theft	identitytheft.gov	Federal recovery program
Your organization	Whatever your IT/security team’s process is. Always tell them, even if you didn’t fall for it — they may be tracking a campaign.	Org-side response

If you already clicked or typed

Triage in this order. Move fast on credentials and codes.

If you only clicked a link (no input yet)

1. Close the page/app immediately. Don’t enter anything.
2. Note the URL. Take a screenshot before closing if you can do so safely.
3. Scan the device for malware (Mobile Hardening Guide).
4. Report to your security team or IT.
5. Watch the device for unusual behavior (unprompted reboots, new apps, unfamiliar notifications) over the next several days.

If you typed credentials

1. Immediately change the password on the affected service from a different, trusted device.
2. Also change it everywhere else you reused it (this is why password managers and unique passwords matter).
3. Review the service’s “active sessions” / “logged-in devices” / “linked devices” lists and revoke anything you don’t recognize.
4. Enable MFA / passkey if you hadn’t already. Prefer passkey or hardware key over SMS.
5. Check the service’s recent activity log for things you didn’t do.
6. Begin the Cyber Incident Response Guide.

If you typed a verification code or 2FA token

This is the most urgent variant. Once an attacker has the code, they have a ticking clock to use it.

1. Within minutes: log into the service yourself, change the password, and check active sessions.
2. If the service offers a “log out all devices” function, use it.
3. If you can’t log in (the attacker already took the account), use the account-recovery process and report to the service immediately.
4. If this was a phone-number-based service (Signal, WhatsApp, banking SMS-2FA), call your carrier’s fraud line — the attacker may chain into a SIM swap.
5. Notify your contacts via a different channel — the attacker may be impersonating you to them.

If you installed something

1. Disconnect from the network (airplane mode for mobile, unplug ethernet/WiFi for laptops).
2. Don’t reboot — runtime malware artifacts may aid forensics.
3. For mobile: factory reset is the safe assumption unless you have access to expert forensic help.
4. For laptops: image the disk if you need forensics; otherwise, full reinstall from known-good media.
5. Treat all credentials entered on that device since the install as burned. Rotate from a clean device.
6. See the Cyber Incident Response Guide.

Building phishing resistance

Most of this is in the DFP Guide; the highest-leverage items for phishing specifically:

• Use a password manager that autofills only on the correct domain. If autofill doesn’t trigger, the page you’re on isn’t the page you think it is.
• Use passkeys or hardware MFA instead of SMS or TOTP wherever possible. Passkeys are phishing-resistant by design — they don’t work on a spoofed domain.
• Email hardening: use a provider that enforces SPF/DKIM/DMARC checks (Email Hardening Guide).
• Browser hygiene: don’t reuse a “general browsing” browser for banking and admin work. Compartmentalize.
• Disable link previews in apps that fetch URLs on receipt — they can leak your IP and timing to attackers.
• Train regularly: even one-question phishing quizzes monthly keep awareness sharp. Real campaign samples (like the Signal/RIS lures) make the best training material.

Related

• Signal/CMA Account Takeover (RIS, 2026) — current live campaign with the exact patterns this page describes
• Social Engineering Overview
• Phishing Simulation (red team) — authorized testing of phishing controls
• Digital Force Protection — prevention baseline
• MFA & Passkeys — phishing-resistant authentication
• Email Hardening — defender-side email config
• Cyber Incident Response Guide — what to do if compromised

Sources

• CISA — Phishing Guidance: Stopping the Attack Cycle at Phase One
• FBI — Spoofing and Phishing
• APWG — Anti-Phishing Working Group
• FTC — How to Recognize and Avoid Phishing Scams
• NIST SP 800-63B — Authentication Guidelines