What Is Phishing?

Definition

Phishing is a fake message, sent by email, text, phone call, or chat, that pretends to come from someone you trust so you will click a link, open a file, type in a password, or send money. It is the cybercrime most often reported to the FBI and a common first step toward business email compromise and ransomware.

How It Works

1. Pick a disguise. The attacker impersonates something you expect to hear from: Microsoft 365, your bank, a shipping company, your boss, a vendor, or your own IT help desk.
2. Build the trap. They register a lookalike domain or fake login page. A joint FBI and CISA advisory lists domains patterned like targetsname-sso[.]com and targetsname-helpdesk[.]com.
3. Deliver it. Email is still common, but the joint CISA, NSA, FBI, and MS-ISAC phishing guide also describes text messages, chat apps such as Teams and Slack, and spoofed caller ID over internet phone lines. Text-message phishing is called smishing and voice phishing is vishing.
4. Create pressure. Urgency, fear, or a reward pushes you to act before you think: "your mailbox will be deleted today," "approve this payment," "call this number."
5. Collect the payoff. The attacker uses the stolen password to sign in, installs malware from the attachment, or talks you into approving an MFA prompt. Weak forms of MFA can be beaten this way, which is why CISA recommends phishing-resistant MFA.

Real-World Example

Scattered Spider is a criminal group profiled in FBI and CISA advisory AA23-320A (first published November 2023, updated July 29, 2025). According to the advisory, its intrusions historically began with broad phishing and smishing that used organization-specific lookalike domains. Members posed as company IT or help desk staff by phone and text to get employee credentials, talked employees into sharing one-time MFA codes, sent repeated MFA prompts until someone pressed "Accept," and convinced mobile carriers to move victims' phone numbers to SIM cards they controlled. The advisory says the group then stole data for extortion and has deployed ransomware, most recently DragonForce. None of this needed an exotic exploit. It worked because people were persuaded to hand over access.

Why It Matters for a Small Business

The FBI's IC3 received 191,561 phishing and spoofing complaints in 2025, more than any other crime type, with $215,843,126 in reported losses (up from $70,013,036 in 2024). Phishing also opens the door to bigger losses: IC3 recorded $3,046,598,558 in business email compromise losses in 2025.

Verizon's 2026 DBIR found phishing was the initial access vector in 16% of breaches overall and 9% of breaches at small and medium-sized businesses. It also reports that the median click rate in email phishing simulations was 1.4%, while phone-centric simulations (voice and text) ran closer to 2%, about 40% higher. Training only on email misses the channel that now works best for attackers.

How to Spot It / How DTS Handles It

Warning signs: a sender address or link domain that is close to, but not exactly, the real one; urgent or emotional language; a login page you reached from a link instead of typing the address; an MFA prompt you did not start; a request to change payment details; or a caller who claims to be IT and wants a code. If you clicked or entered a password, report it right away.

When a phish lands, DTS resets the affected credentials, signs out active sessions, reviews sign-in logs and mailbox forwarding rules, and checks whether the account was used to target your customers. See our business email compromise response page, and our Microsoft 365 security service for prevention.

Related Terms

• Business email compromise: what a phished mailbox is usually used for next.
• Ransomware: phishing is a common first step in ransomware attacks.
• Multi-factor authentication (MFA): the control that blunts stolen passwords.
• Account takeover: what happens after a password is phished.
• Security awareness training: teaching staff to pause and report.
• Indicators of compromise: lookalike domains and sender addresses are classic examples.
• DMARC: email authentication that makes spoofing your own domain harder.

Sources

• CISA, NSA, FBI, and MS-ISAC, Phishing Guidance: Stopping the Attack Cycle at Phase One (October 18, 2023): https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one
• FBI and CISA, Cybersecurity Advisory AA23-320A, Scattered Spider (last revised July 29, 2025): https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
• FBI Internet Crime Complaint Center, 2025 IC3 Annual Report (crime type counts and losses): https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
• Verizon, 2026 Data Breach Investigations Report (Social Engineering pattern; SMB focused analysis): https://www.verizon.com/business/resources/Tf3/reports/2026-dbir-data-breach-investigations-report.pdf

---

Last updated October 14, 2026.